diff --git a/nix/configuration/roles/base/default.nix b/nix/configuration/roles/base/default.nix
index 812a30b0..b42cfed2 100644
--- a/nix/configuration/roles/base/default.nix
+++ b/nix/configuration/roles/base/default.nix
@@ -14,6 +14,7 @@ let
   cleanup_temporary_files = (
     patchScriptBin "cleanup_temporary_files" (builtins.readFile ./files/cleanup_temporary_files.bash)
   );
+  decode_jwt = (patchScriptBin "decode_jwt" (builtins.readFile ./files/decode_jwt.bash));
   alias_rga = pkgs.writeShellScriptBin "rga" ''
     exec ${pkgs.ripgrep}/bin/rg -uuu "''${@}"
   '';
@@ -59,6 +60,7 @@ in
       nix-output-monitor # For better view into nixos-rebuild
       # nix-serve-ng # Serve nix store over http
       cleanup_temporary_files
+      decode_jwt
       jq
       inetutils # For whois
     ];
diff --git a/nix/configuration/roles/base/files/cleanup_temporary_files.bash b/nix/configuration/roles/base/files/cleanup_temporary_files.bash
index 43918b0e..97d9ecaa 100644
--- a/nix/configuration/roles/base/files/cleanup_temporary_files.bash
+++ b/nix/configuration/roles/base/files/cleanup_temporary_files.bash
@@ -1,4 +1,7 @@
 #!/usr/bin/env bash
 #
 # Delete temporary files on entire disk
-find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null
+set -euo pipefail
+IFS=$'\n\t'
+
+exec find / -type f '(' -name '*.orig' -or -name '*~' -or -name '*.core' ')' -delete -print 2>/dev/null
diff --git a/nix/configuration/roles/base/files/decode_jwt.bash b/nix/configuration/roles/base/files/decode_jwt.bash
new file mode 100644
index 00000000..fd2742ee
--- /dev/null
+++ b/nix/configuration/roles/base/files/decode_jwt.bash
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+#
+# Decode the contents of a JWT
+set -euo pipefail
+IFS=$'\n\t'
+DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
+exec jq -R 'split(".") | .[0],.[1] | gsub("-"; "+") | gsub("_"; "/") | gsub("%3D"; "=")| @base64d | fromjson'