diff --git a/debian/aptly.conf b/debian/aptly.conf
index ead467ec..03a644c3 100644
--- a/debian/aptly.conf
+++ b/debian/aptly.conf
@@ -32,6 +32,17 @@ database_open_attempts: -1
 architectures:
 #    - amd64
 
+# Hash algorithms to write Acquire-By-Hash entries for, when a publish
+# has Acquire-By-Hash enabled. Each algorithm costs a full set of index
+# copies on every publish, which is felt most on S3-like storage where
+# every write is a round trip. An empty list defaults to all four.
+# Modern apt uses SHA256; MD5Sum and SHA1 are deprecated.
+acquire_by_hash_algorithms:
+    - MD5Sum
+    - SHA1
+    - SHA256
+    - SHA512
+
 # OBSOLETE
 # in aptly up to version 1.0.0, package files were stored in internal package pool
 # with MD5-dervied path, since 1.1.0 package pool layout was changed;
@@ -146,6 +157,10 @@ gpg_disable_sign: false
 # Disable signature verification of remote repositories
 gpg_disable_verify: false
 
+# GPG key IDs to sign with when a publish does not name one itself
+# (the -gpg-key flag, or GpgKey in the API's signing options)
+gpg_keys: []
+
 
 # Publishing
 #############
diff --git a/man/aptly.1 b/man/aptly.1
index e5edadaf..2a9b9a0a 100644
--- a/man/aptly.1
+++ b/man/aptly.1
@@ -100,6 +100,9 @@ The legacy json configuration is still supported (and also supports comments):
   // Codename for short PPA url expansion
   "ppaCodename": "",
 
+  // PPA Base URL
+  "ppaBaseURL": "http://ppa.launchpad.net",
+
   // OBSOLETE
   // in aptly up to version 1\.0\.0, package files were stored in internal package pool
   // with MD5\-dervied path, since 1\.1\.0 package pool layout was changed;
@@ -121,6 +124,9 @@ The legacy json configuration is still supported (and also supports comments):
   // Enable API documentation on /docs
   "enableSwaggerEndpoint": false,
 
+  // Enable pprof profiling endpoints on /api/debug/pprof/*
+  "enablePprofEndpoint": false,
+
   // OBSOLETE: use via url param ?_async=true
   "AsyncAPI": false,
 
@@ -181,6 +187,10 @@ The legacy json configuration is still supported (and also supports comments):
   // Disable signature verification of remote repositories
   "gpgDisableVerify": false,
 
+  // GPG key IDs to sign with when a publish does not name one itself
+  // (the \-gpg\-key flag, or GpgKey in the API's signing options)
+  "gpgKeys": [],
+
 
 // Publishing
 //////////////
diff --git a/man/aptly.1.ronn.tmpl b/man/aptly.1.ronn.tmpl
index 95173bcf..86c84070 100644
--- a/man/aptly.1.ronn.tmpl
+++ b/man/aptly.1.ronn.tmpl
@@ -89,6 +89,9 @@ The legacy json configuration is still supported (and also supports comments):
       // Codename for short PPA url expansion
       "ppaCodename": "",
 
+      // PPA Base URL
+      "ppaBaseURL": "http://ppa.launchpad.net",
+
       // OBSOLETE
       // in aptly up to version 1.0.0, package files were stored in internal package pool
       // with MD5-dervied path, since 1.1.0 package pool layout was changed;
@@ -110,6 +113,9 @@ The legacy json configuration is still supported (and also supports comments):
       // Enable API documentation on /docs
       "enableSwaggerEndpoint": false,
 
+      // Enable pprof profiling endpoints on /api/debug/pprof/*
+      "enablePprofEndpoint": false,
+
       // OBSOLETE: use via url param ?_async=true
       "AsyncAPI": false,
 
@@ -170,6 +176,10 @@ The legacy json configuration is still supported (and also supports comments):
       // Disable signature verification of remote repositories
       "gpgDisableVerify": false,
 
+      // GPG key IDs to sign with when a publish does not name one itself
+      // (the -gpg-key flag, or GpgKey in the API's signing options)
+      "gpgKeys": [],
+
 
     // Publishing
     //////////////
diff --git a/system/t02_config/CreateConfigTest_gold b/system/t02_config/CreateConfigTest_gold
index ead467ec..03a644c3 100644
--- a/system/t02_config/CreateConfigTest_gold
+++ b/system/t02_config/CreateConfigTest_gold
@@ -32,6 +32,17 @@ database_open_attempts: -1
 architectures:
 #    - amd64
 
+# Hash algorithms to write Acquire-By-Hash entries for, when a publish
+# has Acquire-By-Hash enabled. Each algorithm costs a full set of index
+# copies on every publish, which is felt most on S3-like storage where
+# every write is a round trip. An empty list defaults to all four.
+# Modern apt uses SHA256; MD5Sum and SHA1 are deprecated.
+acquire_by_hash_algorithms:
+    - MD5Sum
+    - SHA1
+    - SHA256
+    - SHA512
+
 # OBSOLETE
 # in aptly up to version 1.0.0, package files were stored in internal package pool
 # with MD5-dervied path, since 1.1.0 package pool layout was changed;
@@ -146,6 +157,10 @@ gpg_disable_sign: false
 # Disable signature verification of remote repositories
 gpg_disable_verify: false
 
+# GPG key IDs to sign with when a publish does not name one itself
+# (the -gpg-key flag, or GpgKey in the API's signing options)
+gpg_keys: []
+
 
 # Publishing
 #############