diff --git a/.env.example b/.env.example
index 00b73bae..3cbbb51f 100644
--- a/.env.example
+++ b/.env.example
@@ -4,3 +4,11 @@ TRUST_PROXY=false
 MAXMIND_LICENSE_KEY=
 PUID=1000
 PGID=1000
+KEYS_STORAGE=database
+
+# Encryption key used to protect sensitive data
+# Can be generated with `openssl rand -base64 32`
+# See https://pocket-id.org/docs/configuration/environment-variables#encryption-keys
+ENCRYPTION_KEY=
+# Alternatively, point to a file containing the key (could be a Docker secret)
+#ENCRYPTION_KEY_FILE=
diff --git a/.gitignore b/.gitignore
index abf848c2..5651391d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -25,6 +25,7 @@ Thumbs.db
 .env.*
 !.env.development-example
 !.env.test
+!.env.example
 
 # Vite
 vite.config.js.timestamp-*