diff --git a/README.md b/README.md
index 3beac53..03cd3f3 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,8 @@ Here's a few useful flags:
  - `--db_path`: Path to the SQLite database. The default is `switchifier.db` in the current working directory.
  - `--bind_address`: Host/port to bind to. By default `:8080`, so port 8080 on all interfaces.
  - `--secret`: The preshared secret used to authenticate the client.
+ - `--secret_path`: A file to load the preshared secret from (`--secret` is ignored).
+ - `--logtostderr`: Log program output to stderr.
 
 
 Future work
diff --git a/main.go b/main.go
index 084e10e..66c685d 100644
--- a/main.go
+++ b/main.go
@@ -29,7 +29,9 @@ import (
 	"database/sql"
 	"encoding/json"
 	"flag"
+	"io/ioutil"
 	"net/http"
+	"os"
 	"strings"
 	"time"
 
@@ -190,16 +192,30 @@ var (
 	dbPath      string
 	bindAddress string
 	secret      string
+	secret_path string
 )
 
 func main() {
 	flag.StringVar(&dbPath, "db_path", "./switchifier.db", "Path to the SQlite3 database.")
 	flag.StringVar(&bindAddress, "bind_address", ":8080", "Address to bind HTTP server to.")
 	flag.StringVar(&secret, "secret", "changeme", "Secret for state updates.")
+	flag.StringVar(&secret_path, "secret_path", "", "File with secret for state updates.")
 	flag.Parse()
 	if dbPath == "" {
 		glog.Exit("Please provide a database path.")
 	}
+	if secret_path != "" {
+		file, err := os.Open(secret_path)
+		if err != nil {
+			glog.Exit(err)
+		}
+		secretData, err := ioutil.ReadAll(file)
+		if err != nil {
+			glog.Exit(err)
+		}
+		secretParts := strings.Split(string(secretData), "\n")
+		secret = secretParts[0]
+	}
 	glog.Infof("Starting switchifier...")
 
 	db, err := sql.Open("sqlite3", dbPath)