diff --git a/README.md b/README.md
index 202b51e..ba9f84d 100644
--- a/README.md
+++ b/README.md
@@ -58,6 +58,13 @@ Once the server is running, you should be able to connect to it on `localhost:90
 
 If you don't define otherwise in the environments or a custom configuration, the login username is **Foo bar** and the password is **password**.
 
+## Secrets
+
+The following variables can be set via Docker secrets:
+
+* `mysql_password` via `MYSQL_PASSWORD_FILE`
+* `estate_owner_password` via `ESTATE_OWNER_PASSWORD_FILE`
+
 ## Custom Configurations
 
 The environment list is not inclusive to the incredible range of options that OpenSimulator can be configured, and just covers a subset of the most popular settings. If you specify your own custom configuration file, it will be used instead of the image-generated configuration (you can define it as readonly (`:ro`) for assurance).
diff --git a/build/latest/docker-entrypoint.sh b/build/latest/docker-entrypoint.sh
index 9248fef..5f2f019 100755
--- a/build/latest/docker-entrypoint.sh
+++ b/build/latest/docker-entrypoint.sh
@@ -1,6 +1,34 @@
 #!/usr/bin/env sh
 set -eu
 
+# Reads a Docker secret from /run/secrets/<name> if the _FILE variant is set.
+# _FILE takes priority over the plain environment variable.
+file_env() {
+	var="$1"
+	# Check it's a valid variable and not just a vibed-in donut.
+	case "$var" in
+		*[!A-Z0-9_]*) printf '%s\n' "ERROR: Invalid variable name passed to file_env: $var" >&2; exit 1 ;;
+	esac
+	file_var="${var}_FILE"
+	eval val="\${$var:-}"
+	eval file_val="\${$file_var:-}"
+
+	if [ -n "$file_val" ]; then
+		if [ -r "$file_val" ]; then
+			val="$(cat "$file_val")"
+		else
+			printf '%s\n' "ERROR: Secret file '$file_val' (from ${file_var}) is not readable." >&2
+			exit 1
+		fi
+	fi
+
+	export "$var"="$val"
+	unset "$file_var" 2>/dev/null || true
+}
+
+file_env MYSQL_PASSWORD
+file_env ESTATE_OWNER_PASSWORD
+
 chown -R "$(id -u):$(id -g)" defaults
 
 if [ ! -e OpenSim.ini ]; then