diff --git a/.env.example b/.env.example
index b7244d8..390fe6a 100644
--- a/.env.example
+++ b/.env.example
@@ -10,6 +10,14 @@ SMTP_DOMAIN=example.com
 SMTP_AUTH_METHOD=plain
 SMTP_ENABLE_STARTTLS=auto
 
+# S3_ENABLED=true
+# S3_ENDPOINT=https://s3.kosmos.org
+# S3_REGION=garage
+# S3_BUCKET=akkounts-production
+# S3_ALIAS_HOST=accounts.s3.kosmos.org
+# S3_ACCESS_KEY=123456abcdefg
+# S3_SECRET_KEY=123456789123456789123456789
+
 LDAP_HOST=localhost
 LDAP_PORT=389
 LDAP_ADMIN_PASSWORD=passthebutter
diff --git a/config/environments/development.rb b/config/environments/development.rb
index eecc942..1f96c8f 100644
--- a/config/environments/development.rb
+++ b/config/environments/development.rb
@@ -71,6 +71,9 @@ Rails.application.configure do
   # Allow requests from any IP
   config.web_console.whiny_requests = false
 
-  # Store attachments on the local disk (in ./storage)
-  config.active_storage.service = :local
+  if ENV["S3_ENABLED"]
+    config.active_storage.service = :s3
+  else
+    config.active_storage.service = :local
+  end
 end
diff --git a/config/environments/production.rb b/config/environments/production.rb
index bfcfecb..5adf41e 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -110,9 +110,11 @@ Rails.application.configure do
   # Set this to true and configure the email server for immediate delivery to raise delivery errors.
   config.action_mailer.raise_delivery_errors = true
 
-  # TODO make configurable
-  # Store attachments in S3-compatible back-end
-  config.active_storage.service = :local
+  if ENV["S3_ENABLED"]
+    config.active_storage.service = :s3
+  else
+    config.active_storage.service = :local
+  end
 
   # Enable locale fallbacks for I18n (makes lookups for any locale fall back to
   # the I18n.default_locale when a translation cannot be found).
diff --git a/config/environments/test.rb b/config/environments/test.rb
index 739a1ac..7d731e9 100644
--- a/config/environments/test.rb
+++ b/config/environments/test.rb
@@ -52,6 +52,10 @@ Rails.application.configure do
 
   config.active_job.queue_adapter = :test
 
-  # Store attachments on the local disk (in ./tmp)
-  config.active_storage.service = :test
+  if ENV["S3_ENABLED"]
+    config.active_storage.service = :s3
+  else
+    # Store attachments on the local disk (in ./tmp)
+    config.active_storage.service = :test
+  end
 end
diff --git a/config/storage.yml b/config/storage.yml
index 1f93f73..6b8a50a 100644
--- a/config/storage.yml
+++ b/config/storage.yml
@@ -5,3 +5,13 @@ local:
 test:
   service: Disk
   root: <%= Rails.root.join("tmp/storage") %>
+
+<% if ENV["S3_ENABLED"] %>
+s3:
+  service: S3
+  endpoint: ENV["S3_ENDPOINT"]
+  region: ENV["S3_REGION"]
+  bucket: ENV["S3_BUCKET"]
+  access_key_id: ENV["S3_ACCESS_KEY"]
+  secret_access_key: ENV["S3_SECRET_KEY"]
+<% end %>