diff --git a/users/simon/modules/git.nix b/users/simon/modules/git.nix
index 0bc582c..a697356 100644
--- a/users/simon/modules/git.nix
+++ b/users/simon/modules/git.nix
@@ -1,4 +1,4 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 {
   programs.git = {
     enable = true;
@@ -12,6 +12,18 @@
     extraConfig = {
       core.quotepath = "off";
       pull.ff = "only";
+      diff = {
+        age = {
+          # This uses the de facto default key location with no ability to
+          # specify another key.
+          # If decryption fails (e.g. due to a lack of the right private key,
+          # rage’s error message will be displayed instead of the file’s
+          # contents.
+          textconv = toString (pkgs.writeShellScript "git-age-textconv" ''
+            ${pkgs.rage}/bin/rage -d -i ${config.xdg.configHome}/age/keys.txt "$@" 2>&1 || true
+          '');
+        };
+      };
     };
 
     ignores = [