diff --git a/pkgs/additional/sane-scripts/default.nix b/pkgs/additional/sane-scripts/default.nix
index 8f931c24..c2217bd8 100644
--- a/pkgs/additional/sane-scripts/default.nix
+++ b/pkgs/additional/sane-scripts/default.nix
@@ -195,6 +195,30 @@ let
       src = ./src;
       pkgs = [ "coreutils-full" ];
     };
+    private-change-passwd = static-nix-shell.mkBash {
+      pname = "sane-private-change-passwd";
+      src = ./src;
+      pkgs = [ "gocryptfs" "rsync" "sane-scripts.private-unlock" ];
+    };
+    private-do = static-nix-shell.mkBash {
+      pname = "sane-private-do";
+      src = ./src;
+      pkgs = [ "sane-scripts.private-unlock" ];
+    };
+    private-unlock = static-nix-shell.mkBash {
+      pname = "sane-private-unlock";
+      src = ./src;
+      pkgs = [ "gocryptfs" ];
+    };
+    private-lock = static-nix-shell.mkBash {
+      pname = "sane-private-lock";
+      src = ./src;
+    };
+    private-init = static-nix-shell.mkBash {
+      pname = "sane-private-init";
+      src = ./src;
+      pkgs = [ "gocryptfs" ];
+    };
     reclaim-boot-space = static-nix-shell.mkPython3Bin {
       pname = "sane-reclaim-boot-space";
       src = ./src;
@@ -204,6 +228,7 @@ in
 symlinkJoin {
   name = "sane-scripts";
   paths = [ shell-scripts ] ++ lib.attrValues nix-shell-scripts;
+  passthru = nix-shell-scripts;
   meta = {
     description = "collection of scripts associated with uninsane systems";
     homepage = "https://git.uninsane.org";
diff --git a/pkgs/additional/sane-scripts/src/sane-private-change-passwd b/pkgs/additional/sane-scripts/src/sane-private-change-passwd
index 2d64a083..dde8a028 100755
--- a/pkgs/additional/sane-scripts/src/sane-private-change-passwd
+++ b/pkgs/additional/sane-scripts/src/sane-private-change-passwd
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gocryptfs -p rsync -p sane-scripts.private-unlock
 
 set -ex
 
diff --git a/pkgs/additional/sane-scripts/src/sane-private-do b/pkgs/additional/sane-scripts/src/sane-private-do
index 04586d90..221ea581 100755
--- a/pkgs/additional/sane-scripts/src/sane-private-do
+++ b/pkgs/additional/sane-scripts/src/sane-private-do
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p sane-scripts.private-unlock
 
 # unlock the ~/private store, run some command, and then re-lock the store
 
diff --git a/pkgs/additional/sane-scripts/src/sane-private-init b/pkgs/additional/sane-scripts/src/sane-private-init
index 54e790dc..a9e914b5 100755
--- a/pkgs/additional/sane-scripts/src/sane-private-init
+++ b/pkgs/additional/sane-scripts/src/sane-private-init
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gocryptfs
 
 set -ex
 
diff --git a/pkgs/additional/sane-scripts/src/sane-private-lock b/pkgs/additional/sane-scripts/src/sane-private-lock
index fcfd3cf3..0f460cf2 100755
--- a/pkgs/additional/sane-scripts/src/sane-private-lock
+++ b/pkgs/additional/sane-scripts/src/sane-private-lock
@@ -1,3 +1,4 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash
 
 sudo umount /home/colin/private
diff --git a/pkgs/additional/sane-scripts/src/sane-private-unlock b/pkgs/additional/sane-scripts/src/sane-private-unlock
index f63c1b89..14466075 100755
--- a/pkgs/additional/sane-scripts/src/sane-private-unlock
+++ b/pkgs/additional/sane-scripts/src/sane-private-unlock
@@ -1,4 +1,5 @@
-#!/usr/bin/env bash
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p gocryptfs
 
 set -ex
 
diff --git a/pkgs/additional/static-nix-shell/default.nix b/pkgs/additional/static-nix-shell/default.nix
index 6916b5af..2e7a936e 100644
--- a/pkgs/additional/static-nix-shell/default.nix
+++ b/pkgs/additional/static-nix-shell/default.nix
@@ -13,9 +13,10 @@ let
   #   <name> = expected string in the nix-shell invocation
   #   <value> = package to provide
   pkgsToAttrs = prefix: pkgSet: expr: ({
+    # branch based on the type of `expr`
     "lambda" = expr: pkgsToAttrs prefix pkgSet (expr pkgSet);
     "list" = expr: foldl' (acc: pname: acc // {
-      "${prefix + pname}" = pkgSet."${pname}";
+      "${prefix + pname}" = lib.getAttrFromPath (lib.splitString "." pname) pkgSet;
     }) {} expr;
     "set" = expr: expr;
   })."${typeOf expr}" expr;