so far, genkernel doesn't support this. Right now I use a script manually every boot from a rescue shell and this script. read -s -p "Password: " password echo "" for disk in a b c d e f g h i j k l m n o p; do echo -n ${password} | gpg -q -d --no-tty --passphrase-fd 0 /mnt/key/decrypt.gpg | cryptsetup -q --key-file=- luksOpen /dev/sd${disk}2 crypt${disk}2 done unset password Reproducible: Always