diff --git a/scripts/nebula-regen-host-cert.nix b/scripts/nebula-regen-host-cert.nix
index a7ef614..1d6e75d 100644
--- a/scripts/nebula-regen-host-cert.nix
+++ b/scripts/nebula-regen-host-cert.nix
@@ -22,6 +22,7 @@ pkgs.writeShellApplication {
 
     if ! declare -px BW_SESSION >/dev/null 2>&1; then
       BW_SESSION="$(bw unlock --raw || bw login --raw)"
+      export BW_SESSION
     fi
 
     ca_key="$(mktemp)"