diff --git a/app/api/translate/route.ts b/app/api/translate/route.ts
index 9493a16e4..511965bd0 100644
--- a/app/api/translate/route.ts
+++ b/app/api/translate/route.ts
@@ -1,4 +1,5 @@
 import { NextRequest, NextResponse } from 'next/server';
+import { readFileEnv } from "@/lib/read-file-env";
 import { getStalwartCredentials } from '@/lib/stalwart/credentials';
 
 // Host-side proxy backing the "Translate" plugin (manifest apiPostPaths:
@@ -11,7 +12,7 @@ import { getStalwartCredentials } from '@/lib/stalwart/credentials';
 //                       langpair needs an explicit source language, so when the
 //                       plugin asks for "auto" we detect it locally first.
 //   - "libretranslate" — only available when the host sets LIBRETRANSLATE_URL
-//                       (and optionally LIBRETRANSLATE_API_KEY). Supports native
+//                       (and optionally LIBRETRANSLATE_API_KEY or LIBRETRANSLATE_API_KEY_FILE). Supports native
 //                       source auto-detection.
 
 export const runtime = 'nodejs';
@@ -225,7 +226,9 @@ async function translateLibre(
   if (!endpoint) {
     throw new Error('LibreTranslate is not configured on this server');
   }
-  const apiKey = process.env.LIBRETRANSLATE_API_KEY;
+  const apiKey =
+    process.env.LIBRETRANSLATE_API_KEY ||
+    readFileEnv(process.env.LIBRETRANSLATE_API_KEY_FILE);
   const url = endpoint.replace(/\/+$/, '') + '/translate';
   const res = await fetch(url, {
     method: 'POST',
diff --git a/lib/impersonation/master-config.ts b/lib/impersonation/master-config.ts
index 392d3d151..f93bad1e1 100644
--- a/lib/impersonation/master-config.ts
+++ b/lib/impersonation/master-config.ts
@@ -1,4 +1,5 @@
 import { configManager } from '@/lib/admin/config-manager';
+import { readFileEnv } from "@/lib/read-file-env";
 
 export interface ImpersonationConfig {
   jwtSecret: string;
@@ -16,13 +17,27 @@ export interface ImpersonationConfig {
  *   BULWARK_STALWART_MASTER_USER   master account address (e.g. master@example.com)
  *   BULWARK_STALWART_MASTER_PASSWORD
  *
+ * Alternatively the file-based env:
+ *   BULWARK_JWT_AUTH_SECRET_FILE
+ *   BULWARK_STALWART_MASTER_USER_FILE
+ *   BULWARK_STALWART_MASTER_PASSWORD_FILE
+ *
  * Optional env:
  *   BULWARK_JWT_AUTH_ISSUER        (default: "platform-api/webmail")
  */
 export function readImpersonationConfig(): ImpersonationConfig | null {
-  const jwtSecret = process.env.BULWARK_JWT_AUTH_SECRET ?? '';
-  const masterUser = process.env.BULWARK_STALWART_MASTER_USER ?? '';
-  const masterPassword = process.env.BULWARK_STALWART_MASTER_PASSWORD ?? '';
+  const jwtSecret =
+    process.env.BULWARK_JWT_AUTH_SECRET ??
+    readFileEnv(process.env.BULWARK_JWT_AUTH_SECRET_FILE) ??
+    "";
+  const masterUser =
+    process.env.BULWARK_STALWART_MASTER_USER ??
+    readFileEnv(process.env.BULWARK_STALWART_MASTER_USER_FILE) ??
+    "";
+  const masterPassword =
+    process.env.BULWARK_STALWART_MASTER_PASSWORD ??
+    readFileEnv(process.env.BULWARK_STALWART_MASTER_PASSWORD_FILE) ??
+    "";
   if (!jwtSecret || !masterUser || !masterPassword) return null;
   return {
     jwtSecret,