diff --git a/CHANGELOG b/CHANGELOG
index ae4c2e96ad..2781a67ba8 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -3,6 +3,7 @@ git-annex (7.20190731) UNRELEASED; urgency=medium
   * Use the same optimisation for --in=here as has always been
     used for --in=. rather than the slow code path that unncessarily
     queries the git-annex branch.
+  * Allow setting up a gcrypt special remote with encryption=shared.
 
  -- Joey Hess <id@joeyh.name>  Thu, 01 Aug 2019 00:11:56 -0400
 
diff --git a/Remote/GCrypt.hs b/Remote/GCrypt.hs
index 22a88cd6b9..83ab5c3b8a 100644
--- a/Remote/GCrypt.hs
+++ b/Remote/GCrypt.hs
@@ -318,16 +318,18 @@ shellOrRsync r ashell arsync
 setGcryptEncryption :: RemoteConfig -> String -> Annex ()
 setGcryptEncryption c remotename = do
 	let participants = remoteconfig Git.GCrypt.remoteParticipantConfigKey
-	case cipherKeyIds =<< extractCipher c of
+	case extractCipher c of
 		Nothing -> noCrypto
-		Just (KeyIds { keyIds = ks}) -> do
-			setConfig participants (unwords ks)
-			let signingkey = ConfigKey $ Git.GCrypt.remoteSigningKey remotename
-			cmd <- gpgCmd <$> Annex.getGitConfig
-			skeys <- M.keys <$> liftIO (secretKeys cmd)
-			case filter (`elem` ks) skeys of
-				[] -> noop
-				(k:_) -> setConfig signingkey k
+		Just cip -> case cipherKeyIds cip of
+			Nothing -> noop
+			Just (KeyIds { keyIds = ks}) -> do
+				setConfig participants (unwords ks)
+				let signingkey = ConfigKey $ Git.GCrypt.remoteSigningKey remotename
+				cmd <- gpgCmd <$> Annex.getGitConfig
+				skeys <- M.keys <$> liftIO (secretKeys cmd)
+				case filter (`elem` ks) skeys of
+					[] -> noop
+					(k:_) -> setConfig signingkey k
 	setConfig (remoteconfig Git.GCrypt.remotePublishParticipantConfigKey)
 		(Git.Config.boolConfig True)
   where