diff --git a/system/options.nix b/system/options.nix
index 131daa14876..98362e68182 100644
--- a/system/options.nix
+++ b/system/options.nix
@@ -1891,6 +1891,22 @@
       ";
     };
 
+    seccureKeys = {
+      public = mkOption {
+        default = /var/elliptic-keys/public;
+	description = "
+	  Public key. Make it path argument, so it is copied into store and
+	  hashed.
+	";
+      };
+      private = mkOption {
+        default = "/var/elliptic-keys/private";
+	description = "
+	  Private key. Make it string argument, so it is not copied into store.
+	";
+      };
+    };
+
     sudo = {
 
       enable = mkOption {
diff --git a/upstart-jobs/gw6c.nix b/upstart-jobs/gw6c.nix
index 97b9c9da5d0..0f3d007e416 100644
--- a/upstart-jobs/gw6c.nix
+++ b/upstart-jobs/gw6c.nix
@@ -11,6 +11,8 @@ let
 		server = cfg.server;
 		keepAlive = cfg.keepAlive;
 		everPing = cfg.everPing;
+
+		seccureKeys = config.security.seccureKeys;
 	};
 in
 {