diff --git a/java/google/registry/config/RegistryConfig.java b/java/google/registry/config/RegistryConfig.java
index 557f7e8a4..5c09bd72e 100644
--- a/java/google/registry/config/RegistryConfig.java
+++ b/java/google/registry/config/RegistryConfig.java
@@ -19,6 +19,7 @@ import static google.registry.config.ConfigUtils.makeUrl;
 import static google.registry.config.YamlUtils.getConfigSettings;
 import static java.lang.annotation.RetentionPolicy.RUNTIME;
 
+import com.google.common.annotations.VisibleForTesting;
 import com.google.common.base.Optional;
 import com.google.common.base.Supplier;
 import com.google.common.collect.ImmutableList;
@@ -974,6 +975,17 @@ public final class RegistryConfig {
       return "/tos";
     }
 
+    /**
+     * Returns the name of the OAuth2 client secrets file.
+     *
+     * <p>This is the name of a resource relative to the root of the class tree.
+     */
+    @Provides
+    @Config("clientSecretFilename")
+    public static String provideClientSecretFilename(RegistryConfigSettings config) {
+      return config.registryTool.clientSecretFilename;
+    }
+
     /**
      * Returns the help text to be used by RDAP.
      *
@@ -1174,6 +1186,12 @@ public final class RegistryConfig {
     return Duration.standardDays(CONFIG_SETTINGS.get().registryPolicy.contactAutomaticTransferDays);
   }
 
+  /** Provided for testing. */
+  @VisibleForTesting
+  public static String getClientSecretFilename() {
+    return CONFIG_SETTINGS.get().registryTool.clientSecretFilename;
+  }
+
   /**
    * Memoizes loading of the {@link RegistryConfigSettings} POJO.
    *
diff --git a/java/google/registry/config/RegistryConfigSettings.java b/java/google/registry/config/RegistryConfigSettings.java
index c735cfc7b..0c62df131 100644
--- a/java/google/registry/config/RegistryConfigSettings.java
+++ b/java/google/registry/config/RegistryConfigSettings.java
@@ -32,6 +32,7 @@ public class RegistryConfigSettings {
   public Rdap rdap;
   public Braintree braintree;
   public Kms kms;
+  public RegistryTool registryTool;
 
   /** Configuration options that apply to the entire App Engine project. */
   public static class AppEngine {
@@ -132,4 +133,9 @@ public class RegistryConfigSettings {
     public String publicKey;
     public Map<String, String> merchantAccountIdsMap;
   }
+
+  /** Configuration options for the registry tool. */
+  public static class RegistryTool {
+    public String clientSecretFilename;
+  }
 }
diff --git a/java/google/registry/config/files/default-config.yaml b/java/google/registry/config/files/default-config.yaml
index e286f0aad..0509489c0 100644
--- a/java/google/registry/config/files/default-config.yaml
+++ b/java/google/registry/config/files/default-config.yaml
@@ -190,3 +190,8 @@ kms:
   # The name to use for the Cloud KMS KeyRing which will store encryption keys
   # for Nomulus secrets.
   keyringName: nomulus
+
+# Configuration options relevant to the "nomulus" registry tool.
+registryTool:
+  # Name of the client secret file used for authenticating with App Engine.
+  clientSecretFilename: /google/registry/tools/resources/client_secret.json
diff --git a/java/google/registry/tools/DefaultRequestFactoryModule.java b/java/google/registry/tools/DefaultRequestFactoryModule.java
index dfad274d3..b8f265200 100644
--- a/java/google/registry/tools/DefaultRequestFactoryModule.java
+++ b/java/google/registry/tools/DefaultRequestFactoryModule.java
@@ -41,11 +41,9 @@ import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InputStreamReader;
-import java.lang.annotation.Documented;
 import java.util.Collection;
 import javax.inject.Named;
 import javax.inject.Provider;
-import javax.inject.Qualifier;
 import javax.inject.Singleton;
 
 /**
@@ -68,22 +66,12 @@ class DefaultRequestFactoryModule {
   private static final File DATA_STORE_DIR =
       new File(System.getProperty("user.home"), ".config/nomulus/credentials");
 
-  // TODO(mmuller): replace with a config parameter.
-  private static final String CLIENT_SECRET_FILENAME =
-      "/google/registry/tools/resources/client_secret.json";
-
-  @Provides
-  @ClientSecretFilename
-  String provideClientSecretFilename() {
-    return CLIENT_SECRET_FILENAME;
-  }
-
   /** Returns the credential object for the user. */
   @Provides
   Credential provideCredential(
       AbstractDataStoreFactory dataStoreFactory,
       Authorizer authorizer,
-      @ClientSecretFilename String clientSecretFilename) {
+      @Config("clientSecretFilename") String clientSecretFilename) {
     try {
       // Load the client secrets file.
       JacksonFactory jsonFactory = new JacksonFactory();
@@ -197,12 +185,4 @@ class DefaultRequestFactoryModule {
   interface Authorizer {
     Credential authorize(GoogleClientSecrets clientSecrets);
   }
-
-  /** Dagger qualifier for the client secret filename.
-   *
-   * <p>TODO(mmuller): move this to config.
-   */
-  @Qualifier
-  @Documented
-  public @interface ClientSecretFilename {}
 }
diff --git a/javatests/google/registry/config/RegistryConfigTest.java b/javatests/google/registry/config/RegistryConfigTest.java
new file mode 100644
index 000000000..cb33c38d8
--- /dev/null
+++ b/javatests/google/registry/config/RegistryConfigTest.java
@@ -0,0 +1,35 @@
+// Copyright 2017 The Nomulus Authors. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package google.registry.config;
+
+import static com.google.common.truth.Truth.assertThat;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.JUnit4;
+
+@RunWith(JUnit4.class)
+public class RegistryConfigTest {
+
+  public RegistryConfigTest() {}
+
+  @Test
+  public void test_clientSecretFilename() {
+    RegistryConfigSettings config = YamlUtils.getConfigSettings();
+    // Verify that we're pulling this from the default.
+    assertThat(RegistryConfig.getClientSecretFilename()).isEqualTo(
+        "/google/registry/tools/resources/client_secret.json");
+  }
+}
\ No newline at end of file