diff --git a/config/pkcs11config/config.go b/config/pkcs11config/config.go
index 77734b5..b8f4649 100644
--- a/config/pkcs11config/config.go
+++ b/config/pkcs11config/config.go
@@ -111,7 +111,6 @@ func getDefaultCryptoConfigOpts() (*OcicryptConfig, error) {
 // GetUserPkcs11Config gets the user's Pkcs11Conig either from a configuration file or if none is
 // found the default ones are returned
 func GetUserPkcs11Config() (*pkcs11.Pkcs11Config, error) {
-	fmt.Print("Note: pkcs11 support is currently experimental\n")
 	ic, err := getConfiguration()
 	if err != nil {
 		return &pkcs11.Pkcs11Config{}, err
diff --git a/utils/utils.go b/utils/utils.go
index f653f2e..04f3f70 100644
--- a/utils/utils.go
+++ b/utils/utils.go
@@ -25,8 +25,10 @@ import (
 	"fmt"
 	"strings"
 
+	"github.com/containers/ocicrypt/config/pkcs11config"
 	"github.com/containers/ocicrypt/crypto/pkcs11"
 	"github.com/go-jose/go-jose/v4"
+	"go.yaml.in/yaml/v3"
 	"golang.org/x/crypto/openpgp"
 )
 
@@ -216,22 +218,37 @@ func SortDecryptionKeys(b64ItemList string) (map[string][][]byte, error) {
 				return nil, errors.New("Could not base64 decode a passed decryption key password")
 			}
 		}
+
 		var key string
-		isPrivKey, err := IsPrivateKey(keyData, password)
-		if IsPasswordError(err) {
-			return nil, err
-		}
-		if isPrivKey {
-			key = "privkeys"
-			if _, ok := dcparameters["privkeys-passwords"]; !ok {
-				dcparameters["privkeys-passwords"] = [][]byte{password}
-			} else {
-				dcparameters["privkeys-passwords"] = append(dcparameters["privkeys-passwords"], password)
+		if IsPkcs11PrivateKey(keyData) {
+			p11conf, err := pkcs11config.GetUserPkcs11Config()
+			if err != nil {
+				return nil, err
+			}
+			p11ConfYaml, err := yaml.Marshal(p11conf)
+			if err != nil {
+				return nil, fmt.Errorf("Could not marshal Pkcs11Config to Yaml: %w", err)
+			}
+			dcparameters["pkcs11-config"] = [][]byte{p11ConfYaml}
+
+			key = "pkcs11-yamls"
+		} else {
+			isPrivKey, err := IsPrivateKey(keyData, password)
+			if IsPasswordError(err) {
+				return nil, err
+			}
+			if isPrivKey {
+				key = "privkeys"
+				if _, ok := dcparameters["privkeys-passwords"]; !ok {
+					dcparameters["privkeys-passwords"] = [][]byte{password}
+				} else {
+					dcparameters["privkeys-passwords"] = append(dcparameters["privkeys-passwords"], password)
+				}
+			} else if IsCertificate(keyData) {
+				key = "x509s"
+			} else if IsGPGPrivateKeyRing(keyData) {
+				key = "gpg-privatekeys"
 			}
-		} else if IsCertificate(keyData) {
-			key = "x509s"
-		} else if IsGPGPrivateKeyRing(keyData) {
-			key = "gpg-privatekeys"
 		}
 		if key != "" {
 			values := dcparameters[key]