diff --git a/CHANGELOG b/CHANGELOG
index d6aa8ddf42..a30e7d4ba7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,6 +14,9 @@ git-annex (8.20210331) UNRELEASED; urgency=medium
   * directory: When cp supports reflinks, use it.
   * Avoid excess commits to the git-annex branch when stall detection is
     enabled.
+  * git-annex-config: Allow setting annex.securehashesonly, which has
+    otherwise been supported since 2019, but was missing from the list of
+    allowed repo-global configs.
   * init: Fix a crash when the repo's was cloned from a repo that had an
     adjusted branch checked out, and the origin remote is not named "origin".    
   * Fix some bugs that made git-annex not see recently recorded status
diff --git a/Types/GitConfig.hs b/Types/GitConfig.hs
index 4dbfd29ed4..702dddd354 100644
--- a/Types/GitConfig.hs
+++ b/Types/GitConfig.hs
@@ -297,13 +297,14 @@ mergeGitConfig gitconfig repoglobals = gitconfig
 {- Configs that can be set repository-global. -}
 globalConfigs :: [ConfigKey]
 globalConfigs =
-	[ annexConfig "autocommit"
-	, annexConfig "synccontent"
-	, annexConfig "synconlyannex"
-	, annexConfig "resolvemerge"
-	, annexConfig "largefiles"
+	[ annexConfig "largefiles"
 	, annexConfig "dotfiles"
 	, annexConfig "addunlocked"
+	, annexConfig "autocommit"
+	, annexConfig "resolvemerge"
+	, annexConfig "synccontent"
+	, annexConfig "synconlyannex"
+	, annexConfig "securehashesonly"
 	]
 
 {- Per-remote git-annex settings. Each setting corresponds to a git-config
diff --git a/doc/bugs/git_annex_config_annex.securehashesonly_fails.mdwn b/doc/bugs/git_annex_config_annex.securehashesonly_fails.mdwn
index 1c4db1e52b..8d368dae17 100644
--- a/doc/bugs/git_annex_config_annex.securehashesonly_fails.mdwn
+++ b/doc/bugs/git_annex_config_annex.securehashesonly_fails.mdwn
@@ -31,3 +31,7 @@ local repository version: 8
 ### Have you had any luck using git-annex before? (Sometimes we get tired of reading bug reports all day and a lil' positive end note does wonders)
 
 it's great!
+
+> Ooops, it seems I implemented everything needed for that except 
+> forgot to add it to the list of allowed configs. Fixed now, and tested to
+> work. [[done]] --[[Joey]]