diff --git a/git-wrapper.sh b/git-wrapper.sh
index cf32917..cb6a47f 100755
--- a/git-wrapper.sh
+++ b/git-wrapper.sh
@@ -7,11 +7,11 @@ EC=$?
 
 if [ "$1" = "checkout" -a -f ".git-crypt-key" -a ! "$GIT_CRYPT_RUNNING" = "true" ]; then
   export GIT_CRYPT_RUNNING=true
-  export VAULT_TOKEN=$(vault write -field=token auth/approle/login role_id="${VAULT_ROLE_ID:-}")
+  export VAULT_TOKEN=$(HOME=/tmp/githome vault write -field=token auth/approle/login role_id="${VAULT_ROLE_ID}")
 
   tmpfile=$(mktemp)
-  vault read -field=key "secret/git-crypt/$(<.git-crypt-key)" | base64 -d >${tmpfile}
-  git-crypt unlock ${tmpfile}
+  HOME=/tmp/githome vault read -field=key "secret/git-crypt/$(<.git-crypt-key)" | base64 -d >${tmpfile}
+  HOME=/tmp/githome git-crypt unlock ${tmpfile}
   rm ${tmpfile}
 fi