diff --git a/llarp/config/config.cpp b/llarp/config/config.cpp
index 2fa5db197..af00f3c2a 100644
--- a/llarp/config/config.cpp
+++ b/llarp/config/config.cpp
@@ -124,6 +124,18 @@ namespace llarp
 
     conf.defineOption<bool>(
         "router", "block-bogons", false, DefaultBlockBogons, AssignmentAcceptor(m_blockBogons));
+
+    conf.defineOption<std::string>(
+        "router", "contact-file", false, "", AssignmentAcceptor(m_routerContactFile));
+
+    conf.defineOption<std::string>(
+        "router", "encryption-privkey", false, "", AssignmentAcceptor(m_encryptionKeyFile));
+
+    conf.defineOption<std::string>(
+        "router", "ident-privkey", false, "", AssignmentAcceptor(m_identityKeyFile));
+
+    conf.defineOption<std::string>(
+        "router", "transport-privkey", false, "", AssignmentAcceptor(m_transportKeyFile));
   }
 
   void
diff --git a/llarp/config/config.hpp b/llarp/config/config.hpp
index 2300f82ec..6da4a498b 100644
--- a/llarp/config/config.hpp
+++ b/llarp/config/config.hpp
@@ -55,6 +55,11 @@ namespace llarp
 
     size_t m_JobQueueSize;
 
+    std::string m_routerContactFile;
+    std::string m_encryptionKeyFile;
+    std::string m_identityKeyFile;
+    std::string m_transportKeyFile;
+
     void
     defineConfigOptions(ConfigDefinition& conf, const ConfigGenParameters& params);
   };
diff --git a/llarp/config/key_manager.cpp b/llarp/config/key_manager.cpp
index d4f4b2ec9..472d7e677 100644
--- a/llarp/config/key_manager.cpp
+++ b/llarp/config/key_manager.cpp
@@ -33,11 +33,27 @@ namespace llarp
 
     fs::path root = config.router.m_dataDir;
 
-    // TODO: use fs::path, or at least support windows-style separators
-    m_rcPath = root / our_rc_filename;
-    m_idKeyPath = root / our_identity_filename;
-    m_encKeyPath = root / our_enc_key_filename;
-    m_transportKeyPath = root / our_transport_key_filename;
+    // utility function to assign a path, using the specified config parameter if present and
+    // falling back to root / defaultName if not
+    auto deriveFile = [&](const std::string& defaultName, const std::string& option) {
+      if (option.empty())
+      {
+        return root / defaultName;
+      }
+      else
+      {
+        fs::path file(option);
+        if (not file.is_absolute())
+          throw std::runtime_error(stringify("override for ", defaultName, " cannot be relative"));
+
+        return file;
+      }
+    };
+
+    m_rcPath = deriveFile(our_rc_filename, config.router.m_routerContactFile);
+    m_idKeyPath = deriveFile(our_identity_filename, config.router.m_identityKeyFile);
+    m_encKeyPath = deriveFile(our_enc_key_filename, config.router.m_encryptionKeyFile);
+    m_transportKeyPath = deriveFile(our_transport_key_filename, config.router.m_transportKeyFile);
 
     m_usingLokid = config.lokid.whitelistRouters;
     m_lokidRPCAddr = config.lokid.lokidRPCAddr;