diff --git a/Makefile b/Makefile
index e41a859..dbd843a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,2 +1,2 @@
 %:
-	ansible-playbook playbook.yml --ask-become-pass --ask-vault-pass -t $@
+	ansible-playbook playbook.yml --ask-become-pass -t $@ --vault-password-file=get-vault-password.sh
diff --git a/get-vault-password.sh b/get-vault-password.sh
new file mode 100755
index 0000000..5bb7f04
--- /dev/null
+++ b/get-vault-password.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+pass show self/setup-cockpit-ansible-vault
diff --git a/todo b/todo
index 95b8d6f..982860c 100644
--- a/todo
+++ b/todo
@@ -4,4 +4,3 @@ add upstream to i3blocks-contrib repo
 
 
 hangs when wrong become password
-only ask vault if needed