diff --git a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
index 1d6c8b4..50d8135 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/secureconfig/SecureConfigStore.java
@@ -29,6 +29,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -38,22 +39,27 @@
 
 @Singleton
 public class SecureConfigStore extends SecureStore {
+  private static final String SECURE_CONFIG_FILE = "secure.config";
+
   private final FileBasedConfig sec;
   private final Map<String, FileBasedConfig> pluginSec;
   private final SitePaths site;
   private final Codec codec;
   private long secFileLastmodified;
+  private final Path secure_config;
 
   @Inject
   SecureConfigStore(SitePaths site, PBECodec codec) {
     this.site = site;
+    secure_config = site.etc_dir.resolve(SECURE_CONFIG_FILE);
+
     this.codec = codec;
-    sec = new FileBasedConfig(site.secure_config.toFile(), FS.DETECTED);
+    sec = new FileBasedConfig(secure_config.toFile(), FS.DETECTED);
     try {
       sec.load();
       secFileLastmodified = sec.getFile().lastModified();
     } catch (IOException | ConfigInvalidException e) {
-      throw new RuntimeException("Cannot load secure.config", e);
+      throw new RuntimeException("Cannot load " + SECURE_CONFIG_FILE, e);
     }
     this.pluginSec = new HashMap<>();
   }
@@ -72,7 +78,7 @@
     if (pluginSec.containsKey(pluginName)) {
       cfg = pluginSec.get(pluginName);
     } else {
-      String filename = pluginName + ".secure.config";
+      String filename = pluginName + "." + SECURE_CONFIG_FILE;
       File pluginConfigFile = site.etc_dir.resolve(filename).toFile();
       if (pluginConfigFile.exists()) {
         cfg = new FileBasedConfig(pluginConfigFile, FS.DETECTED);
@@ -144,7 +150,7 @@
     try {
       saveSecure(sec);
     } catch (IOException e) {
-      throw new RuntimeException("Cannot save secure.config", e);
+      throw new RuntimeException("Cannot save " + SECURE_CONFIG_FILE, e);
     }
   }