diff --git a/service/config/sample.yml b/service/config/sample.yml
index c4019eb37..dd2d07e14 100644
--- a/service/config/sample.yml
+++ b/service/config/sample.yml
@@ -419,6 +419,10 @@ registrationService:
     {
       "example": "example"
     }
+  secondaryCredentialConfigurationJson: |
+    {
+      "example": "example"
+    }
   identityTokenAudience: https://registration.example.com
   registrationCaCertificate: | # Registration service TLS certificate trust root
     -----BEGIN CERTIFICATE-----
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
index 22e9b3f7d..cf8fc727f 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
@@ -46,6 +46,7 @@ import java.util.concurrent.ThreadPoolExecutor;
 import javax.servlet.DispatcherType;
 import javax.servlet.FilterRegistration;
 import javax.servlet.ServletRegistration;
+import org.apache.commons.lang3.StringUtils;
 import org.eclipse.jetty.servlets.CrossOriginFilter;
 import org.eclipse.jetty.websocket.server.config.JettyWebSocketServletContainerInitializer;
 import org.glassfish.jersey.server.ServerProperties;
@@ -511,10 +512,15 @@ public class WhisperServerService extends Application<WhisperServerConfiguration
         registrationRecoveryPasswords);
     UsernameHashZkProofVerifier usernameHashZkProofVerifier = new UsernameHashZkProofVerifier();
 
+    final boolean useSecondaryCredentialConfiguration = StringUtils.isNotBlank(
+        System.getenv("SIGNAL_USE_SECONDARY_CREDENTIAL_CONFIGURATION"));
+
     RegistrationServiceClient registrationServiceClient = new RegistrationServiceClient(
         config.getRegistrationServiceConfiguration().host(),
         config.getRegistrationServiceConfiguration().port(),
-        config.getRegistrationServiceConfiguration().credentialConfigurationJson(),
+        useSecondaryCredentialConfiguration ? config.getRegistrationServiceConfiguration()
+            .secondaryCredentialConfigurationJson()
+            : config.getRegistrationServiceConfiguration().credentialConfigurationJson(),
         config.getRegistrationServiceConfiguration().identityTokenAudience(),
         config.getRegistrationServiceConfiguration().registrationCaCertificate(),
         registrationCallbackExecutor);
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RegistrationServiceConfiguration.java b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RegistrationServiceConfiguration.java
index cb50f6f2d..bf5247e04 100644
--- a/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RegistrationServiceConfiguration.java
+++ b/service/src/main/java/org/whispersystems/textsecuregcm/configuration/RegistrationServiceConfiguration.java
@@ -5,6 +5,7 @@ import javax.validation.constraints.NotBlank;
 public record RegistrationServiceConfiguration(@NotBlank String host,
                                                int port,
                                                @NotBlank String credentialConfigurationJson,
+                                               @NotBlank String secondaryCredentialConfigurationJson,
                                                @NotBlank String identityTokenAudience,
                                                @NotBlank String registrationCaCertificate) {
 }