diff --git a/config.example.scfg b/config.example.scfg
index 9de249b5a5f90bf9c59566794da9333add87a06d..f29e3ca5b3bcbece29c00645bacbcab4ec608416 100644
--- a/config.example.scfg
+++ b/config.example.scfg
@@ -3,6 +3,8 @@ # listen-addr tcp://localhost:8080
 listen-addr unix://var/run/cerrado.sock
 
 root-readme /srv/git/README.md
+passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
+aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
 
 scan /srv/git/ {
     public true
diff --git a/pkg/config/config.go b/pkg/config/config.go
index fd198086bb679225c6cc743d9df9eb2c332d0c53..902ff0d991aeae4e7719555479ec574edd10ad57 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -33,6 +33,8 @@ 	configuration struct {
 		Scan         *scan
 		RootReadme   string
 		ListenAddr   string
+		Passphrase   string
+		AESKey       string
 		Repositories []*GitRepositoryConfiguration
 	}
 
@@ -52,6 +54,8 @@ 	// information.
 	ConfigurationRepository struct {
 		rootReadme   string
 		listenAddr   string
+		passphrase   string
+		aesKey       string
 		repositories []*GitRepositoryConfiguration
 	}
 )
@@ -71,6 +75,8 @@ 	repo := &ConfigurationRepository{
 		rootReadme:   config.RootReadme,
 		listenAddr:   config.ListenAddr,
 		repositories: config.Repositories,
+		passphrase:   config.Passphrase,
+		aesKey:       config.AESKey,
 	}
 
 	if config.Scan.Path != "" {
@@ -170,6 +176,16 @@ 	if err != nil {
 		return nil, err
 	}
 
+	err = setPassphrase(block, &config.Passphrase)
+	if err != nil {
+		return nil, err
+	}
+
+	err = setAESKey(block, &config.AESKey)
+	if err != nil {
+		return nil, err
+	}
+
 	err = setRepositories(block, &config.Repositories)
 	if err != nil {
 		return nil, err
@@ -261,6 +277,16 @@
 func setRootReadme(block scfg.Block, readme *string) error {
 	scanDir := block.Get("root-readme")
 	return setString(scanDir, readme)
+}
+
+func setPassphrase(block scfg.Block, listenAddr *string) error {
+	scanDir := block.Get("passphrase")
+	return setString(scanDir, listenAddr)
+}
+
+func setAESKey(block scfg.Block, listenAddr *string) error {
+	scanDir := block.Get("aes-key")
+	return setString(scanDir, listenAddr)
 }
 
 func setListenAddr(block scfg.Block, listenAddr *string) error {
diff --git a/pkg/config/config_test.go b/pkg/config/config_test.go
index 8c1d27ebe8586e356314e45e6a5742766928b443..0970cfa43f9e5b1bf6617d654e3abc6ae0e3257c 100644
--- a/pkg/config/config_test.go
+++ b/pkg/config/config_test.go
@@ -103,6 +103,8 @@ 		{
 			name: "complete",
 			config: `
 listen-addr unix://var/run/cerrado/cerrado.sock
+passphrase $2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq
+aes-key 8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==
 
 scan "/srv/git" {
 	public true
@@ -122,6 +124,8 @@ 					Public: true,
 					Path:   "/srv/git",
 				},
 				ListenAddr: "unix://var/run/cerrado/cerrado.sock",
+				Passphrase: "$2a$14$VnB/ZcB1DUDkMnosRA6Y7.dj8h5eroslDxTeXlLwfQX/x86mh6WAq",
+				AESKey:     "8XHptZxSWCGs1m7QzztX5zNQ7D9NiQevVX0DaUTNMbDpRwFzoJiB0U7K6O/kqIt01jJVgzBUfiR8ES46ZLLb4w==",
 				Repositories: []*GitRepositoryConfiguration{
 					{
 						Name:        "linux.git",