diff --git a/README.md b/README.md
index 432dea4..79189b6 100644
--- a/README.md
+++ b/README.md
@@ -123,6 +123,7 @@ This image can be configured by means of environment variables, that one can set
 * [MEMORY_LOCK](https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html#bootstrap.memory_lock) - memory locking control - enable to prevent swap (default = `true`) .
 * [REPO_LOCATIONS](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-snapshots.html#_shared_file_system_repository) - list of registered repository locations. For example `["/backup"]` (default = `[]`).
 * [PROCESSORS](https://github.com/elastic/elasticsearch-definitive-guide/pull/679/files) - allow elasticsearch to optimize for the actual number of available cpus (must be an integer - default = 1)
+* [ES_KEYSTORE_*](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html) - add any ES Keystore items by adding a new environment variable. Double underscore will be replaced with dots, e.g. ES_KEYSTORE_S3__CLIENT__DEFAULT__ACCESS_KEY ends up as s3.client.default.access_key
 
 ### Backup
 Mount a shared folder (for example via NFS) to `/backup` and make sure the `elasticsearch` user
diff --git a/run.sh b/run.sh
index 7cd6206..56ef3d9 100755
--- a/run.sh
+++ b/run.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 BASE=/elasticsearch
 
@@ -47,13 +47,26 @@ if [ ! -z "${SHARD_ALLOCATION_AWARENESS_ATTR}" ]; then
     fi
 fi
 
+# add keystore entries
+for item in ${!ES_KEYSTORE_*}; do
+    value=${!item}
+    item=${item##ES_KEYSTORE_} # Strip away prefix
+    item=${item,,}             # Lowercase
+    item=${item//__/.}         # Replace double underscore with dot
+
+    if [ ! -f  $BASE/config/elasticsearch.keystore ]; then
+        su-exec elasticsearch $BASE/bin/elasticsearch-keystore create
+    fi
+    su-exec elasticsearch $BASE/bin/elasticsearch-keystore add -x $item <<< ${value}
+done
+
 # run
 if [[ $(whoami) == "root" ]]; then
     chown -R elasticsearch:elasticsearch $BASE
     chown -R elasticsearch:elasticsearch /data
     exec su-exec elasticsearch $BASE/bin/elasticsearch $ES_EXTRA_ARGS
 else
-    # the container's first process is not running as 'root', 
+    # the container's first process is not running as 'root',
     # it does not have the rights to chown. however, we may
     # assume that it is being ran as 'elasticsearch', and that
     # the volumes already have the right permissions. this is