diff --git a/README.md b/README.md
index 81c2d7b..c797488 100644
--- a/README.md
+++ b/README.md
@@ -123,6 +123,8 @@ This image can be configured by means of environment variables, that one can set
 * [MEMORY_LOCK](https://www.elastic.co/guide/en/elasticsearch/reference/current/important-settings.html#bootstrap.memory_lock) - memory locking control - enable to prevent swap (default = `true`) .
 * [REPO_LOCATIONS](https://www.elastic.co/guide/en/elasticsearch/reference/current/modules-snapshots.html#_shared_file_system_repository) - list of registered repository locations. For example `["/backup"]` (default = `[]`).
 * [PROCESSORS](https://github.com/elastic/elasticsearch-definitive-guide/pull/679/files) - allow elasticsearch to optimize for the actual number of available cpus (must be an integer - default = 1)
+* ES_CONFIG_* - add any entries to elasticsearch.yml by prodiving multiple variables. Double underscore will be replaced with dots, e.g. ES_CONFIG_S3__CLIENT__MINIO__PROTOCOL='http' ends up as s3.client.minio.protocol: http
+* [ES_KEYSTORE_*](https://www.elastic.co/guide/en/elasticsearch/reference/current/secure-settings.html) - add any ES Keystore items by adding a new environment variable. Double underscore will be replaced with dots, e.g. ES_KEYSTORE_S3__CLIENT__DEFAULT__ACCESS_KEY ends up as s3.client.default.access_key
 
 ### Backup
 Mount a shared folder (for example via NFS) to `/backup` and make sure the `elasticsearch` user
diff --git a/run.sh b/run.sh
index ffeda38..4133c34 100755
--- a/run.sh
+++ b/run.sh
@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 BASE=/elasticsearch
 
@@ -40,7 +40,28 @@ if [ ! -z "${SHARD_ALLOCATION_AWARENESS_ATTR}" ]; then
     fi
 fi
 
+for item in ${!ES_CONFIG_*}; do
+    value=${!item}
+    item=${item##ES_CONFIG_}   # Strip away prefix
+    item=${item,,}             # Lowercase
+    item=${item//__/.}         # Replace double underscore with dot
+    echo "${item}: ${value}" >> $BASE/config/elasticsearch.yml
+done
+
 # run
 chown -R elasticsearch:elasticsearch $BASE
+
+for item in ${!ES_KEYSTORE_*}; do
+    value=${!item}
+    item=${item##ES_KEYSTORE_} # Strip away prefix
+    item=${item,,}             # Lowercase
+    item=${item//__/.}         # Replace double underscore with dot
+
+    if [ ! -f  $BASE/config/elasticsearch.keystore ]; then
+        su-exec elasticsearch $BASE/bin/elasticsearch-keystore create
+    fi
+    su-exec elasticsearch $BASE/bin/elasticsearch-keystore add -x $item <<< ${value}
+done
+
 chown -R elasticsearch:elasticsearch /data
 exec su-exec elasticsearch $BASE/bin/elasticsearch