diff --git a/GitAnnex/Options.hs b/GitAnnex/Options.hs
index dc9a0be31c..235ea00e97 100644
--- a/GitAnnex/Options.hs
+++ b/GitAnnex/Options.hs
@@ -81,6 +81,8 @@ keyOptions =
 		"operate on all versions of all files"
 	, Option ['U'] ["unused"] (NoArg (Annex.setFlag "unused"))
 		"operate on files found by last run of git-annex unused"
+	, Option [] ["key"] (ReqArg (Annex.setField "key") paramKey)
+		"operate on specified key"
 	]
 
 fromOption :: Option
diff --git a/Seek.hs b/Seek.hs
index 3242dfb338..feb94627bc 100644
--- a/Seek.hs
+++ b/Seek.hs
@@ -123,6 +123,8 @@ withNothing _ _ = error "This command takes no parameters."
  - If --unused is specified, runs an action on all keys found by
  - the last git annex unused scan.
  -
+ - If --key is specified, operates only on that key.
+ -
  - Otherwise, fall back to a regular CommandSeek action on
  - whatever params were passed. -}
 withKeyOptions :: (Key -> CommandStart) -> CommandSeek -> CommandSeek
@@ -130,21 +132,24 @@ withKeyOptions keyop fallbackop params = do
 	bare <- fromRepo Git.repoIsLocalBare
 	allkeys <- Annex.getFlag "all"
 	unused <- Annex.getFlag "unused"
+	specifickey <- Annex.getField "key"
 	auto <- Annex.getState Annex.auto
-	case    (allkeys || bare , unused, auto ) of
-		(True    , False , False) -> go loggedKeys
-		(False   , True  , False) -> go unusedKeys'
-		(True    , True  , _    )
-			| bare && not allkeys -> go unusedKeys'
-			| otherwise -> error "Cannot use --all with --unused."
-		(False   , False , _    ) -> fallbackop params
-		(_       , _     , True )
-			| bare -> error "Cannot use --auto in a bare repository."
-			| otherwise -> error "Cannot use --auto with --all or --unused."
+	when (auto && bare) $
+		error "Cannot use --auto in a bare repository"
+	case	(allkeys, unused, null params, specifickey) of
+		(False  , False , True       , Nothing)
+			| bare -> go auto loggedKeys
+			| otherwise -> fallbackop params
+		(False  , False , _          , Nothing) -> fallbackop params
+		(True   , False , True       , Nothing) -> go auto loggedKeys
+		(False  , True  , True       , Nothing) -> go auto unusedKeys'
+		(False  , False , True       , Just ks) -> case file2key ks of
+			Nothing -> error "Invalid key"
+			Just k -> go auto $ return [k]
+		_ -> error "Can only specify one of file names, --all, --unused, or --key"
   where
-  	go a = do
-		unless (null params) $
-			error "Cannot mix --all or --unused with file names."
+  	go True _ = error "Cannot use --auto with --all or --unused or --key"
+	go False a = do
 		matcher <- Limit.getMatcher
 		seekActions $ map (process matcher) <$> a
 	process matcher k = ifM (matcher $ MatchingKey k)
diff --git a/debian/changelog b/debian/changelog
index 1caaf4335a..ca4c7c6dcb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -38,6 +38,8 @@ git-annex (5.20140118) UNRELEASED; urgency=medium
   * webapp: After upgrading a git repository to git-annex, fix
     bug that made it temporarily not be synced with.
   * whereis: Support --all.
+  * All commands that support --all also support a --key option,
+    which limits them to acting on a single key.
 
  -- Joey Hess <joeyh@debian.org>  Sat, 18 Jan 2014 11:54:17 -0400
 
diff --git a/doc/git-annex.mdwn b/doc/git-annex.mdwn
index 4deb715d7f..fa1175fb67 100644
--- a/doc/git-annex.mdwn
+++ b/doc/git-annex.mdwn
@@ -860,6 +860,10 @@ subdirectories).
   Operate on all data that has been determined to be unused by
   a previous run of `git-annex unused`.
 
+* `--key=key`
+
+  Operate on only the specified key.
+
 * `--quiet`
 
   Avoid the default verbose display of what is done; only show errors