diff --git a/extra-builtins.nix b/extra-builtins.nix
new file mode 100644
index 0000000..ce73079
--- /dev/null
+++ b/extra-builtins.nix
@@ -0,0 +1,3 @@
+{ exec, ... }: {
+  pass = name: exec [./nix-pass.sh name];
+}
diff --git a/nix-pass.sh b/nix-pass.sh
new file mode 100755
index 0000000..c4ec7dd
--- /dev/null
+++ b/nix-pass.sh
@@ -0,0 +1,10 @@
+#!/usr/bin/env bash
+
+# nix-pass.sh
+
+set -euo pipefail
+
+f=$(mktemp)
+trap "rm $f" EXIT
+pass show "$1" | head -c -1 > $f
+nix-instantiate --eval -E "builtins.readFile $f"