diff --git a/README.md b/README.md
index a24b27f..c73df20 100644
--- a/README.md
+++ b/README.md
@@ -313,6 +313,7 @@ Once registered you can define the dockerfile to use with `-f Dockerfile.aarch64
 
 ## Versions
 
+* **23.04.22:** - Add pre-shared key support. Automatically added to all new peer confs generated, existing ones are left without to ensure no breaking changes.
 * **10.04.22:** - Rebase to Ubuntu Focal. Add `LOG_CONFS` env var. Remove deprecated `add-peer` command.
 * **28.10.21:** - Add site-to-site vpn support.
 * **11.02.21:** - Fix bug related to changing internal subnet and named peer confs not updating.
diff --git a/readme-vars.yml b/readme-vars.yml
index 7d29cc0..3c8fab0 100644
--- a/readme-vars.yml
+++ b/readme-vars.yml
@@ -121,6 +121,7 @@ app_setup_block: |
 
 # changelog
 changelogs:
+  - { date: "23.04.22:", desc: "Add pre-shared key support. Automatically added to all new peer confs generated, existing ones are left without to ensure no breaking changes." }
   - { date: "10.04.22:", desc: "Rebase to Ubuntu Focal. Add `LOG_CONFS` env var. Remove deprecated `add-peer` command." }
   - { date: "28.10.21:", desc: "Add site-to-site vpn support." }
   - { date: "11.02.21:", desc: "Fix bug related to changing internal subnet and named peer confs not updating." }
diff --git a/root/defaults/peer.conf b/root/defaults/peer.conf
index 205a1bd..cd6e3ae 100644
--- a/root/defaults/peer.conf
+++ b/root/defaults/peer.conf
@@ -6,5 +6,6 @@ DNS = ${PEERDNS}
 
 [Peer]
 PublicKey = $(cat /config/server/publickey-server)
+PresharedKey = $(cat /config/${PEER_ID}/presharedkey-${PEER_ID})
 Endpoint = ${SERVERURL}:${SERVERPORT}
 AllowedIPs = ${ALLOWEDIPS}
\ No newline at end of file
diff --git a/root/etc/cont-init.d/40-confs b/root/etc/cont-init.d/40-confs
index 556b6aa..a3df72d 100644
--- a/root/etc/cont-init.d/40-confs
+++ b/root/etc/cont-init.d/40-confs
@@ -9,6 +9,10 @@ ln -s /config/wg0.conf /etc/wireguard/wg0.conf
   cp /defaults/server.conf /config/templates/server.conf
 [[ ! -f /config/templates/peer.conf ]] && \
   cp /defaults/peer.conf /config/templates/peer.conf
+# add preshared key to user templates (backwards compatibility)
+if ! grep -q 'PresharedKey' /config/templates/peer.conf; then
+  sed -i 's|^Endpoint|PresharedKey = \$\(cat /config/\${PEER_ID}/presharedkey-\${PEER_ID}\)\nEndpoint|' /config/templates/peer.conf
+fi
 
 generate_confs () {
   mkdir -p /config/server
@@ -31,6 +35,7 @@ DUDE"
     if [ ! -f "/config/${PEER_ID}/privatekey-${PEER_ID}" ]; then
       umask 077
       wg genkey | tee /config/${PEER_ID}/privatekey-${PEER_ID} | wg pubkey > /config/${PEER_ID}/publickey-${PEER_ID}
+      wg genpsk > /config/${PEER_ID}/presharedkey-${PEER_ID}
     fi
     if [ -f "/config/${PEER_ID}/${PEER_ID}.conf" ]; then
       CLIENT_IP=$(cat /config/${PEER_ID}/${PEER_ID}.conf | grep "Address" | awk '{print $NF}')
@@ -46,25 +51,43 @@ DUDE"
         fi
       done
     fi
-    eval "`printf %s`
-    cat <<DUDE > /config/${PEER_ID}/${PEER_ID}.conf
+    if [ -f "/config/${PEER_ID}/presharedkey-${PEER_ID}" ]; then
+      # create peer conf with presharedkey
+      eval "`printf %s`
+      cat <<DUDE > /config/${PEER_ID}/${PEER_ID}.conf
 `cat /config/templates/peer.conf`
 DUDE"
-    SERVER_ALLOWEDIPS=SERVER_ALLOWEDIPS_PEER_${i}
-    if [ -n "${!SERVER_ALLOWEDIPS}" ]; then
-      echo "Adding ${!SERVER_ALLOWEDIPS} to wg0.conf's AllowedIPs for peer ${i}"
+      # add peer info to server conf with presharedkey
       cat <<DUDE >> /config/wg0.conf
 [Peer]
 # ${PEER_ID}
 PublicKey = $(cat /config/${PEER_ID}/publickey-${PEER_ID})
+PresharedKey = $(cat /config/${PEER_ID}/presharedkey-${PEER_ID})
+DUDE
+    else
+      echo "**** Existing keys with no preshared key found for ${PEER_ID}, creating confs without preshared key for backwards compatibility ****"
+      # create peer conf without presharedkey
+      eval "`printf %s`
+      cat <<DUDE > /config/${PEER_ID}/${PEER_ID}.conf
+`cat /config/templates/peer.conf | sed '/PresharedKey/d'`
+DUDE"
+      # add peer info to server conf without presharedkey
+      cat <<DUDE >> /config/wg0.conf
+[Peer]
+# ${PEER_ID}
+PublicKey = $(cat /config/${PEER_ID}/publickey-${PEER_ID})
+DUDE
+    fi
+    SERVER_ALLOWEDIPS=SERVER_ALLOWEDIPS_PEER_${i}
+    # add peer's allowedips to server conf
+    if [ -n "${!SERVER_ALLOWEDIPS}" ]; then
+      echo "Adding ${!SERVER_ALLOWEDIPS} to wg0.conf's AllowedIPs for peer ${i}"
+      cat <<DUDE >> /config/wg0.conf
 AllowedIPs = ${CLIENT_IP}/32,${!SERVER_ALLOWEDIPS}
 
 DUDE
     else
       cat <<DUDE >> /config/wg0.conf
-[Peer]
-# ${PEER_ID}
-PublicKey = $(cat /config/${PEER_ID}/publickey-${PEER_ID})
 AllowedIPs = ${CLIENT_IP}/32
 
 DUDE