diff --git a/README.md b/README.md
index 83b5fb7ea..6dc106fdf 100644
--- a/README.md
+++ b/README.md
@@ -150,10 +150,14 @@ The default registry is Docker Hub, but you can change it using `registry/server
 ```yaml
 registry:
   server: registry.digitalocean.com
-  username: registry-user-name
-  password: <%= ENV.fetch("MRSK_REGISTRY_PASSWORD") %>
+  username:  
+    - DOCKER_REGISTRY_TOKEN
+  password: 
+    - DOCKER_REGISTRY_TOKEN
 ```
 
+A reference to secret `DOCKER_REGISTRY_TOKEN` will look for `ENV["DOCKER_REGISTRY_TOKEN"]` on the machine running MRSK.
+
 ### Using a different SSH user than root
 
 The default SSH user is root, but you can change it using `ssh/user`:
diff --git a/lib/mrsk/commands/registry.rb b/lib/mrsk/commands/registry.rb
index 033048643..1276da09a 100644
--- a/lib/mrsk/commands/registry.rb
+++ b/lib/mrsk/commands/registry.rb
@@ -2,7 +2,7 @@ class Mrsk::Commands::Registry < Mrsk::Commands::Base
   delegate :registry, to: :config
 
   def login
-    docker :login, registry["server"], "-u", redact(registry["username"]), "-p", redact(lookup_password)
+    docker :login, registry["server"], "-u", redact(lookup("username")), "-p", redact(lookup("password"))
   end
 
   def logout
@@ -10,11 +10,11 @@ def logout
   end
 
   private
-    def lookup_password
-      if registry["password"].is_a?(Array)
-        ENV.fetch(registry["password"].first).dup
+    def lookup(key)
+      if registry[key].is_a?(Array)
+        ENV.fetch(registry[key].first).dup
       else
-        registry["password"]
+        registry[key]
       end
     end
 end
diff --git a/test/commands/registry_test.rb b/test/commands/registry_test.rb
index 01be2b349..0d62de8ec 100755
--- a/test/commands/registry_test.rb
+++ b/test/commands/registry_test.rb
@@ -30,6 +30,17 @@ class CommandsRegistryTest < ActiveSupport::TestCase
     ENV.delete("MRSK_REGISTRY_PASSWORD")
   end
 
+  test "registry login with ENV username" do
+    ENV["MRSK_REGISTRY_USERNAME"] = "also-secret"
+    @config[:registry]["username"] = [ "MRSK_REGISTRY_USERNAME" ]
+
+    assert_equal \
+      "docker login hub.docker.com -u also-secret -p secret",
+      @registry.login.join(" ")
+  ensure
+    ENV.delete("MRSK_REGISTRY_USERNAME")
+  end
+
   test "registry logout" do
     assert_equal \
       "docker logout hub.docker.com",