diff --git a/config/gpg_key/gpg/logarchive.yaml b/config/gpg_key/gpg/logarchive.yaml
new file mode 100644
index 0000000..a39f961
--- /dev/null
+++ b/config/gpg_key/gpg/logarchive.yaml
@@ -0,0 +1,8 @@
+# config/gpg_key/gpg/logarchive.yaml
+# OpenPGP key in the gpg engine for the logarchiver service. The private key
+# stays in Vault; logarchiver reads only the exported public key
+# (gpg/keys/logarchive) to encrypt archived logs, and retrieval delegates
+# decryption back to gpg/decrypt/logarchive. Key name = "logarchive", backend = "gpg".
+algorithm: rsa-4096
+identity: "logarchive <logarchive@unkin.net>"
+exportable: false