diff --git a/sys/lib/hgrc b/sys/lib/hgrc
new file mode 100644
index 000000000..bb853b65a
--- /dev/null
+++ b/sys/lib/hgrc
@@ -0,0 +1,4 @@
+[extensions]
+# always use hgwebfs extension so we can use HTTPS without
+# openssl and keep keys in factotum
+hgwebfs=