diff --git a/README.md b/README.md
index a8d2e53c..da2eb0f6 100644
--- a/README.md
+++ b/README.md
@@ -13,13 +13,21 @@ servers:
   - xxx.xxx.xxx.xxx
   - xxx.xxx.xxx.xxx
 env:
-  DATABASE_URL: mysql2://username@localhost/database_name/
+  DATABASE_URL: mysql2://localhost/my-app_production/
   REDIS_URL: redis://host:6379/1
 registry:
   # No server definition needed if using Docker Hub
   server: registry.digitalocean.com
-  username: your-token
-  password: your-token
+  username: <%= Rails.application.credentials.registry["username"] %>
+  password: <%= Rails.application.credentials.registry["password"] %>
+```
+
+Then ensure your encrypted credentials have the registry username + password by editing them with `rails credentials:edit`:
+
+```
+registry:
+  username: real-user-name
+  password: real-password
 ```
 
 Now you're ready to deploy a multi-arch image (FIXME: currently you need to manually run `docker buildx create --use` once first):
diff --git a/lib/mrsk/configuration.rb b/lib/mrsk/configuration.rb
index 84a69062..318c6e6f 100644
--- a/lib/mrsk/configuration.rb
+++ b/lib/mrsk/configuration.rb
@@ -1,11 +1,12 @@
 require "active_support/ordered_options"
+require "erb"
 
 class Mrsk::Configuration
   delegate :service, :image, :env, :registry, :ssh_user, to: :config, allow_nil: true
 
   def self.load_file(file)
     if file.exist?
-      new YAML.load_file(file).symbolize_keys
+      new YAML.load(ERB.new(IO.read(file)).result).symbolize_keys
     else
       raise "Configuration file not found in #{file}"
     end
diff --git a/test/configuration_test.rb b/test/configuration_test.rb
index 5be71bb5..ac6f2f99 100644
--- a/test/configuration_test.rb
+++ b/test/configuration_test.rb
@@ -26,4 +26,9 @@ class ConfigurationTest < ActiveSupport::TestCase
     configuration = Mrsk::Configuration.new(@config.tap { |c| c[:registry].merge!({ "server" => "ghcr.io" }) })
     assert_equal "ghcr.io/dhh/app:123", configuration.absolute_image
   end
+
+  test "erb evaluation of yml config" do
+    configuration = Mrsk::Configuration.load_file Pathname.new(File.expand_path("fixtures/deploy.erb.yml", __dir__))
+    assert_equal "my-user", configuration.registry["username"]
+  end
 end
diff --git a/test/fixtures/deploy.erb.yml b/test/fixtures/deploy.erb.yml
new file mode 100644
index 00000000..a668fb3a
--- /dev/null
+++ b/test/fixtures/deploy.erb.yml
@@ -0,0 +1,11 @@
+service: app
+image: dhh/app
+servers:
+  - 1.1.1.1
+  - 1.1.1.2
+env:
+  REDIS_URL: redis://x/y
+registry:
+  server: registry.digitalocean.com
+  username: <%= "my-user" %>
+  password: <%= "my-password" %>