@@ -39,13 +39,50 @@ const (
 	SSHKeyType      KeyType = "ssh"
 )
 
-func getRecipient(k KeyType, encryptionKey string) (age.Recipient, error) {
+// MaxScryptWorkFactor is the largest scrypt work factor (2^logN) that may be
+// used when encrypting a password-protected secret. It matches the default
+// maximum work factor accepted by age when decrypting, so files written at or
+// below this value remain decryptable by standard age tooling.
+const MaxScryptWorkFactor = 22
+
+type recipientOptions struct {
+	// scryptWorkFactor is the scrypt work factor (2^logN). A zero value means
+	// the age default is used.
+	scryptWorkFactor int
+}
+
+// RecipientOption configures how recipients are built by [GetRecipients].
+type RecipientOption func(*recipientOptions)
+
+// WithScryptWorkFactor sets the scrypt work factor (2^logN) used for
+// [PasswordKeyType] recipients. It is a no-op for age and ssh key types.
+//
+// A zero value leaves the age default in place. Non-zero values are validated
+// by [GetRecipients], which returns an error when logN is outside 1..[MaxScryptWorkFactor].
+//
+// See the posixage.WithScryptWorkFactor option for a cost/security table and
+// guidance on choosing a value.
+func WithScryptWorkFactor(logN int) RecipientOption {
+	return func(o *recipientOptions) {
+		o.scryptWorkFactor = logN
+	}
+}
+
+func getRecipient(k KeyType, encryptionKey string, o *recipientOptions) (age.Recipient, error) {
 	var recipient age.Recipient
 	var err error
 
 	switch k {
 	case PasswordKeyType:
-		recipient, err = age.NewScryptRecipient(encryptionKey)
+		var scryptRecipient *age.ScryptRecipient
+		scryptRecipient, err = age.NewScryptRecipient(encryptionKey)
+		if err == nil && o.scryptWorkFactor != 0 {
+			if o.scryptWorkFactor < 1 || o.scryptWorkFactor > MaxScryptWorkFactor {
+				return nil, fmt.Errorf("scrypt work factor out of range (1..%d): %d", MaxScryptWorkFactor, o.scryptWorkFactor)
+			}
+			scryptRecipient.SetWorkFactor(o.scryptWorkFactor)
+		}
+		recipient = scryptRecipient
 	case AgeKeyType:
 		recipient, err = age.ParseX25519Recipient(encryptionKey)
 	case SSHKeyType:
@@ -69,12 +106,20 @@ func getRecipient(k KeyType, encryptionKey string) (age.Recipient, error) {
 //   - ageKeyType      → [age.ParseX25519Recipient]
 //   - sshKeyType      → [agessh.ParseRecipient]
 //
-// An error is returned if the key cannot be parsed or the key type is
-// unsupported.
-func GetRecipients(k KeyType, encryptionKeys []string) ([]age.Recipient, error) {
+// Optional [RecipientOption] values tune recipient creation; see
+// [WithScryptWorkFactor].
+//
+// An error is returned if the key cannot be parsed, an option is invalid, or
+// the key type is unsupported.
+func GetRecipients(k KeyType, encryptionKeys []string, opts ...RecipientOption) ([]age.Recipient, error) {
+	o := &recipientOptions{}
+	for _, opt := range opts {
+		opt(o)
+	}
+
 	var recipients []age.Recipient
 	for _, encryptionKey := range encryptionKeys {
-		recipient, err := getRecipient(k, encryptionKey)
+		recipient, err := getRecipient(k, encryptionKey, o)
 		if err != nil {
 			return nil, err
 		}
 
@@ -357,7 +357,7 @@ func (f *fileStore[T]) Save(ctx context.Context, id store.ID, s store.Secret) er
 	// (e.g., age + password). However, multiple keys of the same type are
 	// allowed (e.g., password + password).
 	for k, encryptionKeys := range keyGroups {
-		recipients, err := secretfile.GetRecipients(k, encryptionKeys)
+		recipients, err := secretfile.GetRecipients(k, encryptionKeys, secretfile.WithScryptWorkFactor(f.scryptWorkFactor))
 		if err != nil {
 			return err
 		}
@@ -394,6 +394,9 @@ type config struct {
 	logger                    logging.Logger
 	registeredDecryptionFunc  []promptCaller
 	registeredEncryptionFuncs []promptCaller
+	// scryptWorkFactor is the scrypt work factor (2^logN) applied to
+	// password-protected secrets. A zero value uses the age default.
+	scryptWorkFactor int
 }
 
 type Options func(c *config) error
@@ -407,6 +410,68 @@ func WithLogger(l logging.Logger) Options {
 	}
 }
 
+// WithScryptWorkFactor sets the scrypt work factor (2^logN) used when
+// encrypting password-protected secrets. A higher value increases the cost of
+// brute-forcing the passphrase at the expense of encryption and decryption
+// time.
+//
+// age fixes the other scrypt parameters at r=8, p=1, so only N=2^logN varies.
+// Each increment of logN doubles both the derivation time and the memory
+// required: derivation time is roughly linear in N (age calibrates logN=18 at
+// about one second on a modern machine), and memory usage is exactly 2^logN
+// KiB. The following table is anchored to age's own calibration; absolute times
+// are approximate and vary by CPU, but the ratios are exact powers of two:
+//
+//	logN  memory    ~time/unlock  attacker cost vs. 18
+//	----  --------  ------------  --------------------
+//	 8    256 KiB   ~1 ms         1024x cheaper
+//	10    1 MiB     ~4 ms         256x cheaper
+//	12    4 MiB     ~16 ms        64x cheaper
+//	14    16 MiB    ~60 ms        16x cheaper
+//	15    32 MiB    ~125 ms       8x cheaper
+//	16    64 MiB    ~250 ms       4x cheaper
+//	17    128 MiB   ~500 ms       2x cheaper  (OWASP minimum)
+//	18    256 MiB   ~1 s          baseline    (age default)
+//	20    1 GiB     ~4 s          4x dearer
+//	22    4 GiB     ~16 s         16x dearer   (MaxScryptWorkFactor)
+//
+// Guidance on choosing a value:
+//
+//   - The work factor is only a linear multiplier on the attacker's cost per
+//     guess; the passphrase's own entropy dominates security. A low-entropy,
+//     guessable passphrase is not rescued by a high work factor, and genuinely
+//     high-entropy random key material is safe even at a low one.
+//   - OWASP's Password Storage guidance recommends a minimum of N=2^17 (logN
+//     17) with r=8, p=1 for human-chosen passphrases. Values at or below logN
+//     12 fit in CPU cache, lose scrypt's memory-hardness, and degrade toward a
+//     plain fast hash that GPUs and ASICs can attack in parallel; reserve them
+//     for high-entropy key material or tests.
+//   - Pick the highest logN whose derivation time is tolerable on the weakest
+//     device that must unlock a secret (each unlock pays the cost once). Note
+//     that memory is consumed per concurrent derivation, so logN=20 costs 1 GiB
+//     per in-flight unlock and can exhaust constrained hosts.
+//   - Lowering the work factor is a deliberate security downgrade; make sure the
+//     inputs are high-entropy before doing so.
+//
+// Valid values are 1..[secretfile.MaxScryptWorkFactor]. Values above the
+// maximum are rejected because the default age decryption work-factor ceiling
+// is 22; files written with a higher factor could not be decrypted by standard
+// age tooling. If unset, the age default (logN=18) is used.
+//
+// This option only affects password keys; it is a no-op for age and ssh keys.
+// Because the work factor is recorded in each file's header, changing it does
+// not affect the ability to decrypt secrets written with a previous value; the
+// new factor applies only to secrets written after the change.
+func WithScryptWorkFactor(logN int) Options {
+	return func(c *config) error {
+		if logN < 1 || logN > secretfile.MaxScryptWorkFactor {
+			return fmt.Errorf("scrypt work factor out of range (1..%d): %d", secretfile.MaxScryptWorkFactor, logN)
+		}
+		c.scryptWorkFactor = logN
+		return nil
+	}
+}
+
 type encryptionFuncs interface {
 	EncryptionPassword | EncryptionSSH | EncryptionAgeX25519
 }
 
@@ -25,6 +25,8 @@ import (
 	"errors"
 	"io/fs"
 	"os"
+	"strconv"
+	"strings"
 	"testing"
 
 	"filippo.io/age"
@@ -799,3 +801,204 @@ func TestPOSIXAge(t *testing.T) {
 		assert.ErrorIs(t, err, decryptError)
 	})
 }
+
+// scryptStanzaWorkFactor extracts the logN work factor recorded in the scrypt
+// stanza of an age file header. The header is ASCII; the scrypt stanza has the
+// form "-> scrypt <base64 salt> <logN>".
+func scryptStanzaWorkFactor(t *testing.T, ageFile []byte) int {
+	t.Helper()
+	for line := range strings.SplitSeq(string(ageFile), "\n") {
+		if !strings.HasPrefix(line, "-> scrypt ") {
+			continue
+		}
+		fields := strings.Fields(line)
+		logN, err := strconv.Atoi(fields[len(fields)-1])
+		require.NoError(t, err)
+		return logN
+	}
+	t.Fatal("no scrypt stanza found in age header")
+	return 0
+}
+
+// newTempRoot opens an os.Root over a per-test temporary directory and closes
+// it on cleanup.
+func newTempRoot(t *testing.T) *os.Root {
+	t.Helper()
+	root, err := os.OpenRoot(t.TempDir())
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, root.Close())
+	})
+	return root
+}
+
+// newPasswordStore builds a posixage store over root that encrypts and decrypts
+// with a single password, plus any extra options.
+func newPasswordStore(t *testing.T, root *os.Root, password string, opts ...Options) store.Store {
+	t.Helper()
+	base := []Options{
+		WithLogger(&testLogger{t}),
+		WithEncryptionCallbackFunc[EncryptionPassword](func(_ context.Context) ([]byte, error) {
+			return []byte(password), nil
+		}),
+		WithDecryptionCallbackFunc[DecryptionPassword](func(_ context.Context) ([]byte, error) {
+			return []byte(password), nil
+		}),
+	}
+	s, err := New(root,
+		func(_ context.Context, _ store.ID) *mocks.MockCredential {
+			return &mocks.MockCredential{}
+		},
+		append(base, opts...)...,
+	)
+	require.NoError(t, err)
+	return s
+}
+
+// readPassSecret reads the raw password-encrypted age file for id.
+func readPassSecret(t *testing.T, root *os.Root, id store.ID) []byte {
+	t.Helper()
+	encodedID := base64.StdEncoding.EncodeToString([]byte(id.String()))
+	secretRoot, err := root.OpenRoot(encodedID)
+	require.NoError(t, err)
+	t.Cleanup(func() {
+		assert.NoError(t, secretRoot.Close())
+	})
+	data, err := secretRoot.ReadFile(secretfile.SecretFileName + "pass")
+	require.NoError(t, err)
+	return data
+}
+
+func TestScryptWorkFactor(t *testing.T) {
+	// Use a low work factor so the KDF stays fast in tests; the default (18) is
+	// tuned to take ~1s per operation.
+	const workFactor = 10
+
+	t.Run("records the configured work factor in the header", func(t *testing.T) {
+		password := uuid.NewString()
+		root := newTempRoot(t)
+		s := newPasswordStore(t, root, password, WithScryptWorkFactor(workFactor))
+
+		secret := &mocks.MockCredential{Username: uuid.NewString(), Password: uuid.NewString()}
+		id := secrets.MustParseID("test/something/" + uuid.NewString())
+		require.NoError(t, s.Save(t.Context(), id, secret))
+
+		encryptedFile := readPassSecret(t, root, id)
+		assert.Equal(t, workFactor, scryptStanzaWorkFactor(t, encryptedFile))
+
+		// Round-trips with the same store.
+		got, err := s.Get(t.Context(), id)
+		require.NoError(t, err)
+		assert.EqualValues(t, secret, got)
+	})
+
+	t.Run("defaults to the age work factor when unset", func(t *testing.T) {
+		password := uuid.NewString()
+		root := newTempRoot(t)
+		s := newPasswordStore(t, root, password)
+
+		secret := &mocks.MockCredential{Username: uuid.NewString(), Password: uuid.NewString()}
+		id := secrets.MustParseID("test/something/" + uuid.NewString())
+		require.NoError(t, s.Save(t.Context(), id, secret))
+
+		encryptedFile := readPassSecret(t, root, id)
+		// age's NewScryptRecipient default is logN=18.
+		assert.Equal(t, 18, scryptStanzaWorkFactor(t, encryptedFile))
+	})
+
+	t.Run("work factor is self-describing across stores", func(t *testing.T) {
+		// A file written with a custom work factor must decrypt on a store that
+		// has no work-factor option configured: the factor is read from the
+		// header, not from store configuration.
+		password := uuid.NewString()
+		root := newTempRoot(t)
+		writer := newPasswordStore(t, root, password, WithScryptWorkFactor(workFactor))
+
+		secret := &mocks.MockCredential{Username: uuid.NewString(), Password: uuid.NewString()}
+		id := secrets.MustParseID("test/something/" + uuid.NewString())
+		require.NoError(t, writer.Save(t.Context(), id, secret))
+
+		// A separate store with no work-factor option configured.
+		reader := newPasswordStore(t, root, password)
+
+		got, err := reader.Get(t.Context(), id)
+		require.NoError(t, err)
+		assert.EqualValues(t, secret, got)
+	})
+
+	t.Run("rejects out-of-range work factors", func(t *testing.T) {
+		root := newTempRoot(t)
+
+		for _, logN := range []int{0, -1, secretfile.MaxScryptWorkFactor + 1} {
+			_, err := New(root,
+				func(_ context.Context, _ store.ID) *mocks.MockCredential {
+					return &mocks.MockCredential{}
+				},
+				WithEncryptionCallbackFunc[EncryptionPassword](func(_ context.Context) ([]byte, error) {
+					return []byte("a-password"), nil
+				}),
+				WithDecryptionCallbackFunc[DecryptionPassword](func(_ context.Context) ([]byte, error) {
+					return []byte("a-password"), nil
+				}),
+				WithScryptWorkFactor(logN),
+			)
+			assert.Error(t, err, "logN=%d should be rejected", logN)
+		}
+	})
+}
+
+// TestScryptWorkFactorMigration documents how an existing secret's scrypt work
+// factor is migrated: there is no transparent on-read migration, but because
+// Save/Upsert re-encrypts the whole secret, re-writing a secret with a store
+// configured for a different work factor migrates the stored file to that
+// factor while preserving the plaintext. The factor moves in both directions.
+func TestScryptWorkFactorMigration(t *testing.T) {
+	password := uuid.NewString()
+	root := newTempRoot(t)
+
+	secret := &mocks.MockCredential{
+		Username: uuid.NewString(),
+		Password: uuid.NewString(),
+		Attributes: map[string]string{
+			"val1": uuid.NewString(),
+		},
+	}
+	id := secrets.MustParseID("test/something/" + uuid.NewString())
+
+	// Seed the secret with the age default (logN=18), simulating data written
+	// by a build that never configured a work factor.
+	initial := newPasswordStore(t, root, password)
+	require.NoError(t, initial.Save(t.Context(), id, secret))
+	require.Equal(t, 18, scryptStanzaWorkFactor(t, readPassSecret(t, root, id)))
+
+	// Each step re-writes the same secret with a store configured for a
+	// different work factor: default -> lower -> higher.
+	steps := []struct {
+		name       string
+		workFactor int
+	}{
+		{"migrate to a lower work factor", 8},
+		{"migrate to a higher work factor", 14},
+	}
+
+	for _, step := range steps {
+		t.Run(step.name, func(t *testing.T) {
+			s := newPasswordStore(t, root, password, WithScryptWorkFactor(step.workFactor))
+
+			// The old file (written with the previous factor) must still decrypt
+			// on this store, since the factor is read from the file header.
+			got, err := s.Get(t.Context(), id)
+			require.NoError(t, err)
+			assert.EqualValues(t, secret, got)
+
+			// Re-writing migrates the stored file to the new work factor.
+			require.NoError(t, s.Upsert(t.Context(), id, secret))
+			assert.Equal(t, step.workFactor, scryptStanzaWorkFactor(t, readPassSecret(t, root, id)))
+
+			// The migrated file still decrypts to the same plaintext.
+			got, err = s.Get(t.Context(), id)
+			require.NoError(t, err)
+			assert.EqualValues(t, secret, got)
+		})
+	}
+}