diff --git a/zkey/keystore.c b/zkey/keystore.c
index bffa180e..603b0179 100644
--- a/zkey/keystore.c
+++ b/zkey/keystore.c
@@ -3405,7 +3405,7 @@ static int _keystore_process_crypttab(struct keystore *UNUSED(keystore),
 				      size_t key_file_size,
 				      size_t sector_size,
 				      const char *volume_type,
-				      struct crypt_info *UNUSED(info))
+				      struct crypt_info *info)
 {
 	char temp[1000];
 
@@ -3428,7 +3428,18 @@ static int _keystore_process_crypttab(struct keystore *UNUSED(keystore),
 		       dmname, volume, key_file_name, cipher_spec,
 		       key_file_size * 8, sector_size > 0 ? temp : "");
 	} else if (strcasecmp(volume_type, VOLUME_TYPE_LUKS2) == 0) {
-		printf("%s\t%s\tnone\tluks\n", dmname, volume);
+		printf("%s\t%s\t%s\tluks", dmname, volume,
+		       info->keyfile != NULL ? info->keyfile : "none");
+		if (info->keyfile != NULL) {
+			if (info->keyfile_offset > 0)
+				printf(",keyfile-offset=%lu",
+				       info->keyfile_offset);
+			if (info->keyfile_size > 0)
+				printf(",keyfile-size=%lu", info->keyfile_size);
+		}
+		if (info->tries > 0)
+			printf(",tries=%lu", info->tries);
+		printf("\n");
 	} else {
 		return -EINVAL;
 	}
@@ -3677,11 +3688,17 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
  *                           for the volume filter. If not specified, the filter
  *                           checks the volume part only.
  * @param[in] volume_type    the type of volume to generate crypttab entries for
+ * @param[in] keyfile        If non-NULL, specifies the name of the file to
+ *                           read the passphrase from.
+ * @param[in] keyfile_offset the offset in bytes for reading from keyfile
+ * @param[in] keyfile_size   the size in bytes for reading from keyfile
+ * @param[in] tries          the number of tries for passphrase entry
  *
  * @returns 0 for success or a negative errno in case of an error
  */
 int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
-		      const char *volume_type)
+		      const char *volume_type, const char *keyfile,
+		      size_t keyfile_offset, size_t keyfile_size, size_t tries)
 {
 	struct crypt_info info = { 0 };
 	int rc;
@@ -3697,6 +3714,10 @@ int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
 		return -EINVAL;
 	}
 
+	info.keyfile = keyfile;
+	info.keyfile_offset = keyfile_offset;
+	info.keyfile_size = keyfile_size;
+	info.tries = tries;
 	info.volume_filter = str_list_split(volume_filter);
 	info.process_func = _keystore_process_crypttab;
 
diff --git a/zkey/keystore.h b/zkey/keystore.h
index b0d35e48..b3b846eb 100644
--- a/zkey/keystore.h
+++ b/zkey/keystore.h
@@ -73,7 +73,8 @@ int keystore_cryptsetup(struct keystore *keystore, const char *volume_filter,
 			size_t keyfile_size, size_t tries, bool batch_mode);
 
 int keystore_crypttab(struct keystore *keystore, const char *volume_filter,
-		      const char *volume_type);
+		      const char *volume_type, const char *keyfile,
+		      size_t keyfile_offset, size_t keyfile_size, size_t tries);
 
 void keystore_free(struct keystore *keystore);
 
diff --git a/zkey/zkey.1 b/zkey/zkey.1
index d61affcc..7c6b4979 100644
--- a/zkey/zkey.1
+++ b/zkey/zkey.1
@@ -519,6 +519,14 @@ volumes afterwards.
 .IR volume1[:dmname1][,volume2[:dmname2][,...]] ]
 .RB [ \-\-volume-type | \-t
 .IR type ]
+.RB [ \-\-key\-file
+.IR file-name ]
+.RB [ \-\-keyfile\-offset
+.IR bytes ]
+.RB [ \-\-keyfile\-size
+.IR bytes ]
+.RB [ \-\-tries
+.IR number ]
 .RB [ \-\-verbose | \-V ]
 .
 .PP
@@ -537,6 +545,23 @@ name are selected.
 Specify the
 .B \-\-volume-type
 option to generate crypttab entries for the specified volume type only.
+.P
+For LUKS2 volumes, a passphrase is required. You are prompted for the
+passphrase during system startup when crypttab is evaluated, unless option
+.B \-\-key\-file
+is specified. Option
+.B \-\-tries
+specifies how often a passphrase can be re-entered. When option
+.B \-\-key\-file
+is specified, the passphrase is read from the specified file. You can specify
+options
+.B \-\-keyfile\-offset
+and
+.B \-\-keyfile\-size
+to control which part of the key file is used as passphrase. These options are
+passed to the generated crypttab entries and are only available if
+.B zkey
+has been compiled with LUKS2 support enabled.
 .
 .SS "Generate cryptsetup commands for volumes associated with secure AES keys"
 .
@@ -956,6 +981,46 @@ This option is only available if
 .B zkey
 has been compiled with LUKS2 support enabled.
 This option is only used for secure keys contained in the secure key repository.
+.TP
+.BR \-\-key\-file\~\fIfile\-name\fP
+Reads the passphrase from the specified file. If this option is omitted, then
+you are prompted to enter the passphrase interactively during system startup.
+This option is passed to the generated crypttab entries for LUKS2 volumes, and
+is only available if
+.B zkey
+has been compiled with LUKS2 support enabled.
+.TP
+.BR \-\-keyfile\-offset\~\fIbytes\fP
+Specifies the number of bytes to skip before starting to read in the file
+specified with option \fB\-\-key\-file\fP. If omitted, the file is read
+from the beginning. When option \fB\-\-key\-file\fP is not specified, this
+option is ignored. This option is passed to the generated crypttab entries
+for LUKS2 volumes, and is only available if
+.B zkey
+has been compiled with LUKS2 support enabled. Not all distributions support the
+.B keyfile-offset
+option in crypttab entries.
+.TP
+.BR \-\-keyfile\-size\~\fIbytes\fP
+Specifies the number of bytes to be read from the beginning of the file
+specified with option \fB\-\-key\-file\fP. If omitted, the file is read
+until the end. When \fB\-\-keyfile\-offset\fP is also specified, reading starts
+at the offset. When option \fB\-\-key\-file\fP is not specified, this option is
+ignored. This option is passed to the generated crypttab entries for LUKS2
+volumes, and is only available if
+.B zkey
+has been compiled with LUKS2 support enabled. Not all distributions support the
+.B keyfile-size
+option in crypttab entries.
+.TP
+.BR \-\-tries\~\fInumber\fP
+Specifies how often the interactive input of the passphrase can be re-entered
+during system startup. The default is 3 times. When option \fB\-\-key\-file\fP
+is specified, this option is ignored, and the passphrase is read only once from
+the file. This option is passed to the generated crypttab entries for LUKS2
+volumes, and is only available if
+.B zkey
+has been compiled with LUKS2 support enabled.
 .
 .
 .
diff --git a/zkey/zkey.c b/zkey/zkey.c
index 6edb7f9f..120bcce0 100644
--- a/zkey/zkey.c
+++ b/zkey/zkey.c
@@ -557,6 +557,53 @@ static struct util_opt opt_vec[] = {
 			"entry is to be generated",
 		.command = COMMAND_CRYPTTAB,
 	},
+	{
+		.option = {"key-file", required_argument, NULL,
+			   OPT_CRYPTSETUP_KEYFILE},
+		.argument = "FILE-NAME",
+		.desc = "Read the passphrase from the specified file. "
+			"The specified file is passed to the generated "
+			"crypttab entry for LUKS2 volumes",
+		.command = COMMAND_CRYPTTAB,
+		.flags = UTIL_OPT_FLAG_NOSHORT,
+	},
+	{
+		.option = {"keyfile-offset", required_argument, NULL,
+			   OPT_CRYPTSETUP_KEYFILE_OFFSET},
+		.argument = "BYTES",
+		.desc = "Specifies the number of bytes to skip in the file "
+			"specified with option '--key-file'. "
+			"The specified offset is passed to the generated "
+			"crypttab entry for LUKS2 volumes. Not all "
+			"distributions support the 'keyfile-offset' option in "
+			"crypttab entries",
+		.command = COMMAND_CRYPTTAB,
+		.flags = UTIL_OPT_FLAG_NOSHORT,
+	},
+	{
+		.option = {"keyfile-size", required_argument, NULL,
+			   OPT_CRYPTSETUP_KEYFILE_SIZE},
+		.argument = "BYTES",
+		.desc = "Specifies the number of bytes to read from the file "
+			"specified with option '--key-file'. "
+			"The specified size is passed to the generated "
+			"crypttab entry for LUKS2 volumes. Not all "
+			"distributions support the 'keyfile-size' option in "
+			"crypttab entries",
+		.command = COMMAND_CRYPTTAB,
+		.flags = UTIL_OPT_FLAG_NOSHORT,
+	},
+	{
+		.option = {"tries", required_argument, NULL,
+			   OPT_CRYPTSETUP_TRIES},
+		.argument = "NUMBER",
+		.desc = "Specifies how often the interactive input of the "
+			"passphrase can be retried. "
+			"The specified number is passed to the generated "
+			"crypttab entry for LUKS2 volumes",
+		.command = COMMAND_CRYPTTAB,
+		.flags = UTIL_OPT_FLAG_NOSHORT,
+	},
 #endif
 	/***********************************************************/
 	{
@@ -1428,7 +1475,8 @@ static int command_crypttab(void)
 {
 	int rc;
 
-	rc = keystore_crypttab(g.keystore, g.volumes, g.volume_type);
+	rc = keystore_crypttab(g.keystore, g.volumes, g.volume_type, g.keyfile,
+			       g.keyfile_offset, g.keyfile_size, g.tries);
 
 	return rc != 0 ? EXIT_FAILURE : EXIT_SUCCESS;
 }