diff --git a/lib/td/command/workflow.rb b/lib/td/command/workflow.rb
index 8a7f7c86..e183e332 100644
--- a/lib/td/command/workflow.rb
+++ b/lib/td/command/workflow.rb
@@ -43,6 +43,10 @@ def workflow(op, capture_output=false, check_prereqs=true)
           cmd << '-Dio.digdag.standards.td.client-configurator.enabled=true'
         end
 
+        # Provide the digdag cli with a directory that can be used to e.g. store local secrets
+        FileUtils.mkdir_p digdag_config_dir
+        env['DIGDAG_CONFIG_HOME'] = digdag_config_dir
+
         cmd << '-jar' << digdag_cli_path
         unless op.argv.empty?
           cmd << '--config' << digdag_config_path
@@ -53,16 +57,7 @@ def workflow(op, capture_output=false, check_prereqs=true)
           $stderr.puts cmd.to_s
         end
 
-        if capture_output
-          # TODO: use popen3 instead?
-          stdout_str, stderr_str, status = Open3.capture3(env, *cmd)
-          $stdout.write(stdout_str)
-          $stderr.write(stderr_str)
-          return status.exitstatus
-        else
-          Kernel::system(env, *cmd)
-          return $?.exitstatus
-        end
+        execute(capture_output, env, cmd)
       }
     end
 
@@ -96,6 +91,20 @@ def workflow_version(op)
       workflow(version_op, capture_output=true, check_prereqs=false)
     end
 
+    private
+    def execute(capture_output, env, cmd)
+      if capture_output
+        # TODO: use popen3 instead?
+        stdout_str, stderr_str, status = Open3.capture3(env, *cmd)
+        $stdout.write(stdout_str)
+        $stderr.write(stderr_str)
+        return status.exitstatus
+      else
+        Kernel::system(env, *cmd)
+        return $?.exitstatus
+      end
+    end
+
     private
     def system_java_cmd
       if td_wf_java.nil? or td_wf_java.empty?
@@ -139,6 +148,11 @@ def digdag_dir
       File.join(home_directory, '.td', 'digdag')
     end
 
+    private
+    def digdag_config_dir
+      File.join(home_directory, '.td', 'digdag', 'config')
+    end
+
     private
     def digdag_tmp_dir
       File.join(home_directory, '.td', 'digdag', 'tmp')
diff --git a/spec/td/command/workflow_spec.rb b/spec/td/command/workflow_spec.rb
index fa05cf71..07591ce4 100644
--- a/spec/td/command/workflow_spec.rb
+++ b/spec/td/command/workflow_spec.rb
@@ -282,6 +282,14 @@ def with_env(name, var)
         }
       end
 
+      it 'provides a config directory' do
+        allow(TreasureData::Config).to receive(:cl_apikey) { true }
+        expect(command).to receive(:execute).with(true, hash_including('DIGDAG_CONFIG_HOME'), anything()) { |_, env, _|
+          expect(File.directory?(env['DIGDAG_CONFIG_HOME'])).to be true
+        }
+        command.workflow(init_option, capture_output=true, check_prereqs=false)
+      end
+
       it 'complains if there is no apikey' do
           allow(TreasureData::Config).to receive(:apikey) { nil}
           expect{command.workflow(version_option)}.to raise_error(TreasureData::ConfigError)