diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..0475e6f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+# Directory entries are not enough to encrypt fines beneath it
+# https://github.com/AGWA/git-crypt#gitattributes-file
+quarry/config.yaml filter=git-crypt diff=git-crypt
diff --git a/.gitignore b/.gitignore
index 88f936b..fc1baae 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,7 +8,6 @@ __pycache__/
 .venv/
 venv/
 node_modules/
-config.yaml
 .vagrant/
 .coverage
 .python-version
diff --git a/README.md b/README.md
index 8af18da..b29faa2 100644
--- a/README.md
+++ b/README.md
@@ -71,3 +71,12 @@ Bug: <ticket number>
 
 For example:
 Bug: T317566
+
+## git-crypt ##
+
+git-crypt is used to encrypt the config.yaml file. To decrypt ask a maintainer for the decryption key and:
+```
+git clone https://github.com/toolforge/quarry.git
+cd quarry
+git-crypt unlock <path to decryption key>
+```
diff --git a/quarry/config.yaml b/quarry/config.yaml
new file mode 100644
index 0000000..90f5427
Binary files /dev/null and b/quarry/config.yaml differ