diff --git a/home/xonsh.nix b/home/xonsh.nix
index 9b35dd0..10cb5c6 100644
--- a/home/xonsh.nix
+++ b/home/xonsh.nix
@@ -42,7 +42,6 @@
 			cci = "compass workspace run src/python3/uc/tools:circleci-checks";
 			ccover = "compass workspace cover --extra-cmd-args=\"--test_output=errors\"";
 			cexec = "compass workspace exec";
-			cfetch = "compass workspace exec bazel run src/go/compass.com/tools/circleci_results_cache/fetch/cmd/fetch:fetch";
 			cgh = "$GH_CONFIG_DIR=\"${config.home.homeDirectory}/.config/gh/compass\" gh";
 			cpip = "compass workspace run src/python3/uc/tools:run_pip_compile";
 			crun = "compass workspace run";
diff --git a/home/xonsh_footer.xsh b/home/xonsh_footer.xsh
index 8554b2d..1b6c8a2 100644
--- a/home/xonsh_footer.xsh
+++ b/home/xonsh_footer.xsh
@@ -1,5 +1,22 @@
 # vim: set ft=python :
 
+def bw_unlock():
+    if "BW_SESSION" in ${...}:
+        return $BW_SESSION
+    result = !(bw unlock)
+    while not result:
+        result = !(bw unlock)
+    l = [k for k in result.lines if 'BW_SESSION="' in k][0]
+    left, right = l.split("=")
+    token = right[1:-1]
+    $BW_SESSION = token
+    return token
+
+def _cfetch(args):
+    bw_unlock()
+    $CIRCLECI_CLI_TOKEN=$(bw get password CircleCI) 
+    compass workspace exec bazel run src/go/compass.com/tools/circleci_results_cache/fetch/cmd/fetch:fetch
+
 def _rebuild(args):
     system = uname()
     if system.sysname == 'Darwin':
@@ -48,6 +65,7 @@ def _bake(args):
         git clone src:greg/copier-templates.git ~/.copier-templates
     copier copy @(str(templates / args[0])) .
 
+aliases['cfetch'] = _cfetch
 aliases['bake'] = _bake
 aliases['rebuild'] = _rebuild
 aliases['yaml2json'] = _yaml2json