diff --git a/.gitignore b/.gitignore
index 4e54622..179c4f3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
 *.sig
+/local.mk
diff --git a/Makefile b/Makefile
index d2ed59b..c2ea18b 100644
--- a/Makefile
+++ b/Makefile
@@ -6,7 +6,7 @@ check: $(patsubst %.zone,%.check,$(wildcard *.zone))
 sign: $(patsubst %,%.sig,$(wildcard *.zone))
 
 %.sig: %
-	gpg -o $@ --batch --yes --detach-sign $<
+	gpg $(GPG_FLAGS) -o $@ --batch --yes --detach-sign $<
 
 .PHONY: check-clean
 check-clean:
@@ -23,3 +23,5 @@ clean:
 
 FORCE:
 .PHONY: FORCE
+
+-include local.mk
diff --git a/README b/README
index bd88a0b..e09007e 100644
--- a/README
+++ b/README
@@ -18,3 +18,14 @@ SOA for the update to be applied sucessfully on the server side. Emacs does
 this by default, just say'in.
 
 Note: Knot handles DNSSEC signing on the server side.
+
+
+Using a non-default GPG key
+---------------------------
+
+Create a file `local.mk` and specify GPG_FLAGS as follows:
+
+```
+# local.mk
+GPG_FLAGS=--default-key=<YOUR KEY FINGERPRINT>
+```