diff --git a/config.TEMPLATE.inc.php b/config.TEMPLATE.inc.php
index 463435724ac..ec58d6d174b 100644
--- a/config.TEMPLATE.inc.php
+++ b/config.TEMPLATE.inc.php
@@ -24,6 +24,12 @@
 
 [general]
 
+[general]
+
+; An application specific key that is required for the app to run
+; Internally this is used for any encryption (specifically cookie encryption if enabled)
+app_key = 
+
 ; Set this to On once the system has been installed
 ; (This is generally done automatically by the installer)
 installed = Off
@@ -50,11 +56,6 @@
 ; To set the "Secure" attribute for the cookie see the setting force_ssl at the [security] group
 session_samesite = Lax
 
-; Enable this if want to enable cookie encryption
-; The length of the cookie encryption key must be 16 characters
-; Note that updating or removing cookie encryption key will result in logout from all devices
-; session_cookie_encryption_key = ''
-
 ; Enable support for running scheduled tasks
 ; Set this to On if you have set up the scheduled tasks script to
 ; execute periodically
@@ -260,6 +261,14 @@
 
 [security]
 
+; Specific cipher algorithm used to generate app key and encryption purpose
+; Valid and available algorithms are `aes-128-cbc`, `aes-256-cbc`, `aes-128-gcm` and `aes-256-gcm`
+; cipher = 'aes-256-cbc'
+
+; Define should the cookie at user's end need to be encrypted
+; Enabling/Disabling will force all user to re-login
+; cookie_encryption = On
+
 ; Force SSL connections site-wide and also sets the "Secure" flag for session cookies
 ; See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#secure
 force_ssl = Off
diff --git a/dbscripts/xml/upgrade.xml b/dbscripts/xml/upgrade.xml
index ad92cd9da0f..943de28a7e6 100644
--- a/dbscripts/xml/upgrade.xml
+++ b/dbscripts/xml/upgrade.xml
@@ -124,6 +124,7 @@
 
 	<upgrade minversion="3.1.0.0" maxversion="3.4.9.9">
 		<migration class="PKP\migration\upgrade\v3_5_0\PreflightCheckMigration" fallback="3.4.9.9" />
+		<migration class="PKP\migration\upgrade\v3_5_0\I9895_AddAppKeyToConfigFile"/>
 		<migration class="PKP\migration\upgrade\v3_5_0\InstallEmailTemplates"/>
 		<migration class="PKP\migration\upgrade\v3_5_0\I9197_MigrateAccessKeys"/>
 		<migration class="PKP\migration\upgrade\v3_5_0\I9253_SiteAnnouncements"/>
diff --git a/docs/release-notes/README-3.5.0 b/docs/release-notes/README-3.5.0
index a74aa52de98..e2a1829ed49 100644
--- a/docs/release-notes/README-3.5.0
+++ b/docs/release-notes/README-3.5.0
@@ -11,9 +11,15 @@ See config.TEMPLATE.inc.php for a description and examples of all supported
 configuration parameters.
 
 New config.inc.php parameters added for general:
-    - session_cookie_enctyption_key (default value: ''), allow cookie encryption when set
+    - app_key (default value: ''), application specific key will used internally for encryption/decryption. This will be automatically added at upgrade.
+
+New config.inc.php parameters added for security:
+    - cipher (default value: ''), cipher algorithm used to generate app key and encryption purpose
+    - cookie_encryption (default value: ''), allow cookie encryption when set
+
 
 New Features
 ------------
     #9566 : Convert session and cookie management to Laravel
+    #9895 : Introduce APP KEY feature of Laravel
 
diff --git a/lib/pkp b/lib/pkp
index bee9547b491..4d85c0feee9 160000
--- a/lib/pkp
+++ b/lib/pkp
@@ -1 +1 @@
-Subproject commit bee9547b491353e92e53e5ed2da2d197a24be972
+Subproject commit 4d85c0feee944902581c69d645cc59c5602dc714