diff --git a/pkg/wireguard/keys.go b/pkg/wireguard/keys.go
index 6e82a90..f3585c3 100644
--- a/pkg/wireguard/keys.go
+++ b/pkg/wireguard/keys.go
@@ -70,6 +70,24 @@ func encodeKeyJSON(s string) ([]byte, error) {
 	return out, nil
 }
 
+// MarshalYAML encodes the key for YAML, omiting empty.
+func (key PrivateKey) MarshalYAML() (any, error) {
+	return encodeKeyYAML(key.String())
+}
+
+// MarshalYAML encodes the key for YAML, omiting empty.
+func (pub PublicKey) MarshalYAML() (any, error) {
+	return encodeKeyYAML(pub.String())
+}
+
+func encodeKeyYAML(s string) (any, error) {
+	if s == "" {
+		return nil, nil
+	}
+
+	return s, nil
+}
+
 // IsZero tells if the key hasn't been set
 func (key PrivateKey) IsZero() bool {
 	var zero PrivateKey