diff --git a/doc/help.md b/doc/help.md
index 889587f..6053a1b 100644
--- a/doc/help.md
+++ b/doc/help.md
@@ -88,6 +88,10 @@ Shows the release archives available in S3, most recent first.
 ## hx-deploy-tool unpack <release> <todir>
 Unpack and configure the specified release into the given directory.
 
+## hx-deploy-tool expand-template <templatePath> <destPath>
+Injects the deploy context specified in `deployContextFiles` into a template
+found at `templatePath` and saves the resulting file to `destPath`
+
 ## hx-deploy-tool aws-docker-login-cmd
 Assuming this is run on a AWS EC2 instance, this subcommand runs
 the appropriate docker login command using the instance profile
diff --git a/src/Main.hs b/src/Main.hs
index 862676e..c245f9a 100644
--- a/src/Main.hs
+++ b/src/Main.hs
@@ -30,27 +30,28 @@ main :: IO ()
 main = do
   args <- getArgs
   case args of
-    ["help"]                                  -> help
-    ["--version"]                             -> putStrLn (showVersion version)
-    ["list-releases"]                         -> runWithConfig       (C.listReleases)
-    ["show-log"]                              -> runWithConfig       (C.showLog)
-
-    ["fetch-context"]                         -> runWithConfigAndLog (U.fetchDeployContext Nothing)
-    ["fetch-context","--retry"]               -> runWithConfigAndLog (U.fetchDeployContext (Just 10))
-    ["unpack", release, toDir]                -> runWithConfigAndLog (U.unpackRelease id (T.pack release) toDir)
-    ["aws-docker-login-cmd"]                  -> runWithConfigAndLog (C.awsDockerLoginCmd)
-
-    ["select", release]                       -> runWithConfigAndLog (C.select (T.pack release))
-
-    ["proxy-status"]                          -> runWithConfig       (P.showStatus False)
-    ["proxy-status", "--show-slaves"]         -> runWithConfig       (P.showStatus True)
-    ["proxy-deploy", release]                 -> runWithConfigAndLog (P.deploy (T.pack release))
-    ["proxy-undeploy", deploy]                -> runWithConfigAndLog (P.undeploy (T.pack deploy))
-    ["proxy-connect", endpoint, deploy]       -> runWithConfigAndLog (P.connect (T.pack endpoint) (T.pack deploy))
-    ["proxy-disconnect", endpoint]            -> runWithConfigAndLog (P.disconnect (T.pack endpoint))
-    ["proxy-restart"]                         -> runWithConfigAndLog (P.restartProxy)
-    ["proxy-generate-ssl-certificate"]        -> runWithConfigAndLog (P.generateSslCertificate)
-    ["proxy-slave-update"]                    -> runWithConfigAndLog (P.slaveUpdate Nothing)
+    ["help"]                                    -> help
+    ["--version"]                               -> putStrLn (showVersion version)
+    ["list-releases"]                           -> runWithConfig       (C.listReleases)
+    ["show-log"]                                -> runWithConfig       (C.showLog)
+
+    ["fetch-context"]                           -> runWithConfigAndLog (U.fetchDeployContext Nothing)
+    ["fetch-context","--retry"]                 -> runWithConfigAndLog (U.fetchDeployContext (Just 10))
+    ["unpack", release, toDir]                  -> runWithConfigAndLog (U.unpackRelease id (T.pack release) toDir)
+    ["expand-template", templatePath, destPath] -> runWithConfigAndLog (U.injectContext id templatePath destPath)
+    ["aws-docker-login-cmd"]                    -> runWithConfigAndLog (C.awsDockerLoginCmd)
+
+    ["select", release]                         -> runWithConfigAndLog (C.select (T.pack release))
+
+    ["proxy-status"]                            -> runWithConfig       (P.showStatus False)
+    ["proxy-status", "--show-slaves"]           -> runWithConfig       (P.showStatus True)
+    ["proxy-deploy", release]                   -> runWithConfigAndLog (P.deploy (T.pack release))
+    ["proxy-undeploy", deploy]                  -> runWithConfigAndLog (P.undeploy (T.pack deploy))
+    ["proxy-connect", endpoint, deploy]         -> runWithConfigAndLog (P.connect (T.pack endpoint) (T.pack deploy))
+    ["proxy-disconnect", endpoint]              -> runWithConfigAndLog (P.disconnect (T.pack endpoint))
+    ["proxy-restart"]                           -> runWithConfigAndLog (P.restartProxy)
+    ["proxy-generate-ssl-certificate"]          -> runWithConfigAndLog (P.generateSslCertificate)
+    ["proxy-slave-update"]                      -> runWithConfigAndLog (P.slaveUpdate Nothing)
     ["proxy-slave-update", "--repeat", ssecs]  -> do
       secs <- readCheck ssecs
       runWithConfigAndLog (P.slaveUpdate (Just secs))
@@ -129,6 +130,7 @@ usageText = "\
   \  hx-deploy-tool fetch-context [--retry]\n\
   \  hx-deploy-tool list-releases\n\
   \  hx-deploy-tool unpack <release> <todir>\n\
+  \  hx-deploy-tool expand-template <templatePath> <destPath>\n\
   \  hx-deploy-tool show-log\n\
   \  hx-deploy-tool aws-docker-login-cmd\n\
   \  hx-deploy-tool --version\n\
diff --git a/src/Util.hs b/src/Util.hs
index 8e7c15c..7fd9c49 100644
--- a/src/Util.hs
+++ b/src/Util.hs
@@ -100,6 +100,16 @@ fetchDeployContext retryAfter = do
      env <- awsEnvFn
      liftIO $ Secrets.downloadSecretFrom env arn toFile
 
+injectContext :: (JS.Value -> JS.Value) -> FilePath -> FilePath -> IOR()
+injectContext modifyContextFn templatePath destPath = do
+  tcfg <- getToolConfig
+  liftIO $ do
+    -- load and merge the infrastructure context
+    ctx <- fmap modifyContextFn (loadMergedContext tcfg)
+
+    -- interpolate the context into each templated file
+    expandTemplateFileToDest ctx templatePath destPath
+
 -- unpack a release into the specified directory, and expand any templates
 --
 -- `modifyContextFn` can be used to modify the context before it is used to
@@ -148,16 +158,20 @@ loadMergedContext tcfg = do
      (Right jv) -> return (takeBaseName cacheFilePath, jv)
   return (JS.Object (HM.fromList [(T.pack file,jv) | (file,jv) <- values]))
 
-expandTemplateFile :: JS.Value -> FilePath -> IO ()
-expandTemplateFile ctx templatePath = do
+expandTemplateFileToDest :: JS.Value -> FilePath -> FilePath -> IO ()
+expandTemplateFileToDest ctx templatePath destPath = do
   etemplate <- TM.automaticCompile [takeDirectory templatePath] templatePath
   case etemplate of
    Left err -> error (show err)
    Right template -> do
      let text = TM.substitute template ctx
-         outfile = dropExtension templatePath
+         outfile = destPath
      T.writeFile outfile text
 
+expandTemplateFile :: JS.Value -> FilePath -> IO ()
+expandTemplateFile ctx templatePath = do
+  expandTemplateFileToDest ctx templatePath (dropExtension templatePath)
+
 toDirPath :: FilePath -> Path Abs Dir
 toDirPath path = case parseAbsDir path of
   Just p -> p