diff --git a/README.md b/README.md
index de7d000c9..fc5f701e7 100644
--- a/README.md
+++ b/README.md
@@ -35,9 +35,11 @@ For use with RapidPro, you will need to configure these settings:
 - `MAILROOM_DB`: URL describing how to connect to the RapidPro database (default "postgres://temba:temba@localhost/temba?sslmode=disable")
 - `MAILROOM_READONLY_DB`: URL for an additional database connection for read-only operations (optional)
 - `MAILROOM_REDIS`: URL describing how to connect to Redis (default "redis://localhost:6379/15")
-- `MAILROOM_ELASTIC`: URL describing how to connect to ElasticSearch (default "http://localhost:9200")
 - `MAILROOM_SMTP_SERVER`: the smtp configuration for sending emails ex: smtp://user%40password@server:port/?from=foo%40gmail.com
 - `MAILROOM_FCM_KEY`: the key for Firebase Cloud Messaging used to sync Android channels
+- `MAILROOM_ELASTIC`: URL describing how to connect to ElasticSearch (default "http://localhost:9200")
+- `MAILROOM_ELASTIC_USERNAME`: ElasticSearch username for Basic Auth
+- `MAILROOM_ELASTIC_PASSWORD`: ElasticSearch password for Basic Auth
 
 For writing of message attachments, you need an S3 compatible service which you configure with:
 
diff --git a/mailroom.go b/mailroom.go
index f51e4355f..4d6d064c5 100644
--- a/mailroom.go
+++ b/mailroom.go
@@ -158,7 +158,7 @@ func (mr *Mailroom) Start() error {
 	}
 
 	// initialize our elastic client
-	mr.rt.ES, err = newElasticClient(c.Elastic)
+	mr.rt.ES, err = newElasticClient(c.Elastic, c.ElasticUsername, c.ElasticPassword)
 	if err != nil {
 		log.WithError(err).Error("elastic search not available")
 	} else {
@@ -275,7 +275,7 @@ func openAndCheckRedisPool(redisUrl string) (*redis.Pool, error) {
 	return rp, err
 }
 
-func newElasticClient(url string) (*elastic.Client, error) {
+func newElasticClient(url string, username string, password string) (*elastic.Client, error) {
 	// enable retrying
 	backoff := elastic.NewSimpleBackoff(500, 1000, 2000)
 	backoff.Jitter(true)
@@ -285,5 +285,6 @@ func newElasticClient(url string) (*elastic.Client, error) {
 		elastic.SetURL(url),
 		elastic.SetSniff(false),
 		elastic.SetRetrier(retrier),
+		elastic.SetBasicAuth(username, password),
 	)
 }
diff --git a/runtime/config.go b/runtime/config.go
index 9051a9a7d..f0d71dd23 100644
--- a/runtime/config.go
+++ b/runtime/config.go
@@ -22,9 +22,12 @@ type Config struct {
 	ReadonlyDB string `validate:"omitempty,url,startswith=postgres:" help:"URL of optional connection to readonly database instance"`
 	DBPoolSize int    `                                              help:"the size of our db pool"`
 	Redis      string `validate:"url,startswith=redis:"              help:"URL for your Redis instance"`
-	Elastic    string `validate:"url"                                help:"URL for your ElasticSearch service"`
 	SentryDSN  string `                                              help:"the DSN used for logging errors to Sentry"`
 
+	Elastic         string `validate:"url"                                help:"URL for your ElasticSearch service"`
+	ElasticUsername string `help:"Username for ElasticSearch service"`
+	ElasticPassword string `help:"Password for ElasticSearch service"`
+
 	Address          string `help:"the address to bind our web server to"`
 	Port             int    `help:"the port to bind our web server to"`
 	AuthToken        string `help:"the token clients will need to authenticate web requests"`
@@ -83,7 +86,10 @@ func NewDefaultConfig() *Config {
 		ReadonlyDB: "",
 		DBPoolSize: 36,
 		Redis:      "redis://localhost:6379/15",
-		Elastic:    "http://localhost:9200",
+
+		Elastic:         "http://localhost:9200",
+		ElasticUsername: "",
+		ElasticPassword: "",
 
 		Address: "localhost",
 		Port:    8090,