diff --git a/config/config.go b/config/config.go
index 6b137a388d4e9e97c3a91d9bc607c7875c648f3f..b3e1b0f0b1d39cd691ad1da17f7cab394ea46e52 100644
--- a/config/config.go
+++ b/config/config.go
@@ -565,6 +565,11 @@ func LoadConfig() (*Config, error) {
 			POP3Port:           rawAcc.POP3Port,
 		}
 
+		// Validate PGPKeySource
+		if acc.PGPKeySource != "" && acc.PGPKeySource != "file" && acc.PGPKeySource != "yubikey" {
+			return nil, fmt.Errorf("account %q: invalid pgp_key_source %q (must be \"file\" or \"yubikey\")", acc.Name, acc.PGPKeySource)
+		}
+
 		if secureMode {
 			// In secure mode, passwords and PINs are stored in the encrypted config JSON
 			acc.Password = rawAcc.Password