diff --git a/Git/Config.hs b/Git/Config.hs
index db795b7a78..a41712addf 100644
--- a/Git/Config.hs
+++ b/Git/Config.hs
@@ -177,3 +177,14 @@ fromFile r f = fromPipe r "git"
 	, File f
 	, Param "--list"
 	]
+
+{- Changes a git config setting in the specified config file.
+ - (Creates the file if it does not already exist.) -}
+changeFile :: FilePath -> String -> String -> IO Bool
+changeFile f k v = boolSystem "git"
+	[ Param "config"
+	, Param "--file"
+	, File f
+	, Param k
+	, Param v
+	]
diff --git a/Remote/GCrypt.hs b/Remote/GCrypt.hs
index acbf3cd68a..3f2a80172a 100644
--- a/Remote/GCrypt.hs
+++ b/Remote/GCrypt.hs
@@ -191,8 +191,9 @@ gCryptSetup mu c = go $ M.lookup "gitrepo" c
  - repo, or it is accessed via rsync directly, or it is accessed over ssh
  - and git-annex-shell is available to manage it.
  -
- - The gcrypt-id is stored in the gcrypt repository for later
- - double-checking and identification. This is always done using rsync.
+ - The GCryptID is recorded in the repository's git config for later use.
+ - Also, if the git config has receive.denyNonFastForwards set, disable
+ - it; gcrypt relies on being able to fast-forward branches.
  -}
 setupRepo :: Git.GCrypt.GCryptId -> Git.Repo -> Annex AccessMethod
 setupRepo gcryptid r
@@ -208,14 +209,14 @@ setupRepo gcryptid r
 	| otherwise = localsetup r
   where
 	localsetup r' = do
-		liftIO $ Git.Command.run [Param "config", Param coreGCryptId, Param gcryptid] r'
+		let setconfig k v = liftIO $ Git.Command.run [Param "config", Param k, Param v] r'
+		setconfig coreGCryptId gcryptid
+		setconfig denyNonFastForwards (Git.Config.boolConfig False)
 		return AccessDirect
 
-	{- Download any git config file from the remote,
-	 - add the gcryptid to it, and send it back.
-	 -
-	 - At the same time, create the objectDir on the remote,
-	 - which is needed for direct rsync to work.
+	{- As well as modifying the remote's git config, 
+	 - create the objectDir on the remote,
+	 - which is needed for direct rsync of objects to work.
 	 -}
   	rsyncsetup = Remote.Rsync.withRsyncScratchDir $ \tmp -> do
 		liftIO $ createDirectoryIfMissing True $ tmp </> objectDir
@@ -225,11 +226,9 @@ setupRepo gcryptid r
 			[ Param $ rsyncurl ++ "/config"
 			, Param tmpconfig
 			]
-		liftIO $ appendFile tmpconfig $ unlines
-			[ ""
-			, "[core]"
-			, "\tgcrypt-id = " ++ gcryptid
-			]
+		liftIO $ do
+			Git.Config.changeFile tmpconfig coreGCryptId gcryptid
+			Git.Config.changeFile tmpconfig denyNonFastForwards (Git.Config.boolConfig False)
 		ok <- liftIO $ rsync $ rsynctransport ++
 			[ Params "--recursive"
 			, Param $ tmp ++ "/"
@@ -244,6 +243,8 @@ setupRepo gcryptid r
 	usablegitannexshell = either (const False) (const True)
 		<$> Ssh.onRemote r (Git.Config.fromPipe r, Left undefined) "configlist" [] []
 
+	denyNonFastForwards = "receive.denyNonFastForwards"
+
 shellOrRsync :: Remote -> Annex a -> Annex a -> Annex a
 shellOrRsync r ashell arsync = case method of
 	AccessShell -> ashell
diff --git a/debian/changelog b/debian/changelog
index 6727315c02..f7c79e6ea9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -28,6 +28,8 @@ git-annex (4.20130921) UNRELEASED; urgency=low
     written by MacGPG.
   * assistant: More robust inotify handling; avoid crashing if a directory
     cannot be read.
+  * Disable receive.denyNonFastForwards when setting up a gcrypt special
+    remote, since gcrypt needs to be able to fast-forward the master branch.
 
  -- Joey Hess <joeyh@debian.org>  Sun, 22 Sep 2013 19:42:29 -0400