diff --git a/lib/make-disk-image.nix b/lib/make-disk-image.nix
index d1d8ba01..ca337c4c 100644
--- a/lib/make-disk-image.nix
+++ b/lib/make-disk-image.nix
@@ -56,12 +56,17 @@ let
     }
   );
   cleanedConfig = diskoLib.testLib.prepareDiskoConfig config diskoLib.testLib.devices;
+  # Merge any disko.devices settings from extraConfig into the cleaned config
+  # This allows tests.extraConfig to override disko settings like settings.keyFile
+  mergedDiskoDevices = lib.recursiveUpdate cleanedConfig.disko.devices (
+    cfg.extraConfig.disko.devices or { }
+  );
   systemToInstall = extendModules {
     modules = [
       cfg.extraConfig
       {
         disko.testMode = true;
-        disko.devices = lib.mkForce cleanedConfig.disko.devices;
+        disko.devices = lib.mkForce mergedDiskoDevices;
         boot.loader.grub.devices = lib.mkForce cleanedConfig.boot.loader.grub.devices;
       }
     ];
@@ -73,7 +78,7 @@ let
           cfg.extraConfig
           {
             disko.testMode = true;
-            disko.devices = lib.mkForce cleanedConfig.disko.devices;
+            disko.devices = lib.mkForce mergedDiskoDevices;
             boot.loader.grub.devices = lib.mkForce cleanedConfig.boot.loader.grub.devices;
             boot.kernelPackages = lib.mkDefault cfg.kernelPackages;
             nixpkgs.hostPlatform = lib.mkForce pkgs.stdenv.hostPlatform;
diff --git a/lib/tests.nix b/lib/tests.nix
index 9edd8d36..26c68f07 100644
--- a/lib/tests.nix
+++ b/lib/tests.nix
@@ -165,7 +165,11 @@ let
                           (modulesPath + "/testing/test-instrumentation.nix") # we need these 2 modules always to be able to run the tests
                           (modulesPath + "/profiles/qemu-guest.nix")
                         ];
-                        disko.devices = lib.mkForce testConfigBooted.disko.devices;
+                        # Merge extraSystemConfig's disko.devices settings into testConfigBooted
+                        # This allows tests.extraConfig to override disko settings like settings.keyFile
+                        disko.devices = lib.mkForce (
+                          lib.recursiveUpdate testConfigBooted.disko.devices (extraSystemConfig.disko.devices or { })
+                        );
                       }
                     )
                   ];