diff --git a/sshca/update-machine-ids.sh b/sshca/update-machine-ids.sh
new file mode 100644
index 0000000..9ce5fe3
--- /dev/null
+++ b/sshca/update-machine-ids.sh
@@ -0,0 +1 @@
+yq eval '(select(.metadata.name == "sshca-data") | .spec.encryptedData["machine-ids.json"]) = "'"$(kubeseal -n sshca --raw --from-file sshca/machine-ids.json --name sshca-data)"'"' -i sshca/secrets.yaml