diff --git a/bin/setup-circleci-secrets b/bin/setup-circleci-secrets
index e6b83318a..f5de31d2c 100755
--- a/bin/setup-circleci-secrets
+++ b/bin/setup-circleci-secrets
@@ -5,9 +5,9 @@ set -eu
 # openssl enc -in do-setup-circleci-secrets.orig -out setup-circleci-secrets.orig -e -aes256 -pass stdin
 # openssl base64 < setup-circleci-secrets.orig
 
-openssl base64 -d <<EOF | openssl enc \
-    -out bin/do-setup-circleci-secrets \
-    -d -aes256 -pass pass:"$1"
+if [ -z "${SECRET_SCRIPT+x}" ]; then
+    # "read" return a non-zero value when reading until EOF, see "help read"
+    read -r -d '' SECRET_SCRIPT <<EOF || true
 U2FsdGVkX193YHZJXNzxU9GqigQaXWrA0AKd+BIjRcx7bmmKn/zSgOv+FfApRRjn
 KGBd2ulZw9CwsftX0HWHzVdtpgqbJUW+FEma8eNldau4/f+T+yWTVpCNQXGc3DvB
 cWYhmkoTfGWmI2v/0/Bv2TYkw7MAfjCocdluFAv7sSvYnSgIjoYxD4XXkTjLWy1P
@@ -104,5 +104,10 @@ LrFefj0OWhRx4w7pblAnZqUSYunhhhUYimEG40GkM1ZI9b0vDmbgQP/UxMj1M2yB
 aVSSW69rmjO7xjVuJnm+wNq2P3H3MFB5MaswXrn2Ah83K4oegpannt7H1nG+mWh/
 DJcoVj5UyCTFEyZMdtVWloF4TOVODNNxA+zAE9fUgrI=
 EOF
+fi
+
+echo "${SECRET_SCRIPT}" | base64 -d | openssl enc \
+    -out bin/do-setup-circleci-secrets \
+    -d -aes256 -pass pass:"$1"
 
 exec sh bin/do-setup-circleci-secrets