diff --git a/flake.lock b/flake.lock
index a86e8d2..04c6399 100644
--- a/flake.lock
+++ b/flake.lock
@@ -551,11 +551,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1746328495,
-        "narHash": "sha256-uKCfuDs7ZM3QpCE/jnfubTg459CnKnJG/LwqEVEdEiw=",
+        "lastModified": 1746461020,
+        "narHash": "sha256-7+pG1I9jvxNlmln4YgnlW4o+w0TZX24k688mibiFDUE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "979daf34c8cacebcd917d540070b52a3c2b9b16e",
+        "rev": "3730d8a308f94996a9ba7c7138ede69c1b9ac4ae",
         "type": "github"
       },
       "original": {
diff --git a/pkgs/pull-scans/pull-scan.sh b/pkgs/pull-scans/pull-scan.sh
new file mode 100755
index 0000000..16de846
--- /dev/null
+++ b/pkgs/pull-scans/pull-scan.sh
@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+TMP=$(mktemp -d)
+
+scp "carbon.net.clerie.de:/var/lib/scan-to-gpg/*.asc" "${TMP}"
+
+find "${TMP}" -iname "*.asc" | gpg --decrypt-files
+
+find "${TMP}" -mindepth 1 -not -iname "*.asc" -type f | xargs mv -t .
+
+rm -r "${TMP}"