diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index 140d39d28b..62c9c5f51a 100644
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -1,6 +1,6 @@
 # This configuration was generated by
 # `rubocop --auto-gen-config --auto-gen-only-exclude --no-offense-counts --no-auto-gen-timestamp`
-# using RuboCop version 1.75.7.
+# using RuboCop version 1.75.8.
 # The point is for the user to remove these configuration records
 # one by one as the offenses are removed from the code base.
 # Note that changes in the inspected code, or installation of new
@@ -37,7 +37,6 @@ Style/FetchEnvVar:
   Exclude:
     - 'config/initializers/2_limited_federation_mode.rb'
     - 'config/initializers/3_omniauth.rb'
-    - 'config/initializers/cache_buster.rb'
     - 'config/initializers/paperclip.rb'
     - 'lib/tasks/repo.rake'
 
diff --git a/app/models/media_attachment.rb b/app/models/media_attachment.rb
index 72c8cf9fb8..2f51da0255 100644
--- a/app/models/media_attachment.rb
+++ b/app/models/media_attachment.rb
@@ -417,7 +417,7 @@ class MediaAttachment < ApplicationRecord
 
   # Record the cache keys to burst before the file get actually deleted
   def prepare_cache_bust!
-    return unless Rails.configuration.x.cache_buster_enabled
+    return unless Rails.configuration.x.cache_buster.enabled
 
     @paths_to_cache_bust = MediaAttachment.attachment_definitions.keys.flat_map do |attachment_name|
       attachment = public_send(attachment_name)
@@ -434,7 +434,7 @@ class MediaAttachment < ApplicationRecord
   # Once Paperclip has deleted the files, we can't recover the cache keys,
   # so use the previously-saved ones
   def bust_cache!
-    return unless Rails.configuration.x.cache_buster_enabled
+    return unless Rails.configuration.x.cache_buster.enabled
 
     CacheBusterWorker.push_bulk(@paths_to_cache_bust) { |path| [path] }
   rescue => e
diff --git a/app/services/suspend_account_service.rb b/app/services/suspend_account_service.rb
index 3934a738f7..2de9cd250f 100644
--- a/app/services/suspend_account_service.rb
+++ b/app/services/suspend_account_service.rb
@@ -95,7 +95,7 @@ class SuspendAccountService < BaseService
             end
           end
 
-          CacheBusterWorker.perform_async(attachment.url(style)) if Rails.configuration.x.cache_buster_enabled
+          CacheBusterWorker.perform_async(attachment.url(style)) if Rails.configuration.x.cache_buster.enabled
         end
       end
     end
diff --git a/app/services/unsuspend_account_service.rb b/app/services/unsuspend_account_service.rb
index 7d3bb806a6..8ad01737ae 100644
--- a/app/services/unsuspend_account_service.rb
+++ b/app/services/unsuspend_account_service.rb
@@ -91,7 +91,7 @@ class UnsuspendAccountService < BaseService
             end
           end
 
-          CacheBusterWorker.perform_async(attachment.url(style)) if Rails.configuration.x.cache_buster_enabled
+          CacheBusterWorker.perform_async(attachment.url(style)) if Rails.configuration.x.cache_buster.enabled
         end
       end
     end
diff --git a/config/application.rb b/config/application.rb
index 0ae34282c9..1195b9215c 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -103,6 +103,7 @@ module Mastodon
       end
     end
 
+    config.x.cache_buster = config_for(:cache_buster)
     config.x.captcha = config_for(:captcha)
     config.x.mastodon = config_for(:mastodon)
     config.x.translation = config_for(:translation)
diff --git a/config/cache_buster.yml b/config/cache_buster.yml
new file mode 100644
index 0000000000..709c0eba88
--- /dev/null
+++ b/config/cache_buster.yml
@@ -0,0 +1,5 @@
+shared:
+  enabled: <%= ENV.fetch('CACHE_BUSTER_ENABLED', 'false') == 'true' %>
+  secret_header: <%= ENV.fetch('CACHE_BUSTER_SECRET_HEADER', nil) %>
+  secret: <%= ENV.fetch('CACHE_BUSTER_SECRET', nil) %>
+  http_method: <%= ENV.fetch('CACHE_BUSTER_HTTP_METHOD', 'GET') %>
diff --git a/config/initializers/cache_buster.rb b/config/initializers/cache_buster.rb
deleted file mode 100644
index a49fba671b..0000000000
--- a/config/initializers/cache_buster.rb
+++ /dev/null
@@ -1,11 +0,0 @@
-# frozen_string_literal: true
-
-Rails.application.configure do
-  config.x.cache_buster_enabled = ENV['CACHE_BUSTER_ENABLED'] == 'true'
-
-  config.x.cache_buster = {
-    secret_header: ENV['CACHE_BUSTER_SECRET_HEADER'],
-    secret: ENV['CACHE_BUSTER_SECRET'],
-    http_method: ENV['CACHE_BUSTER_HTTP_METHOD'] || 'GET',
-  }
-end
diff --git a/spec/models/media_attachment_spec.rb b/spec/models/media_attachment_spec.rb
index 43e9ed087b..910eac4e9a 100644
--- a/spec/models/media_attachment_spec.rb
+++ b/spec/models/media_attachment_spec.rb
@@ -291,7 +291,7 @@ RSpec.describe MediaAttachment, :attachment_processing do
     let(:media) { Fabricate(:media_attachment) }
 
     before do
-      allow(Rails.configuration.x).to receive(:cache_buster_enabled).and_return(true)
+      allow(Rails.configuration.x.cache_buster).to receive(:enabled).and_return(true)
     end
 
     it 'queues CacheBusterWorker jobs' do
diff --git a/spec/services/suspend_account_service_spec.rb b/spec/services/suspend_account_service_spec.rb
index 2b1455e9a8..f4578128cc 100644
--- a/spec/services/suspend_account_service_spec.rb
+++ b/spec/services/suspend_account_service_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe SuspendAccountService do
 
     before do
       allow(FeedManager.instance).to receive_messages(unmerge_from_home: nil, unmerge_from_list: nil)
-      allow(Rails.configuration.x).to receive(:cache_buster_enabled).and_return(true)
+      allow(Rails.configuration.x.cache_buster).to receive(:enabled).and_return(true)
 
       local_follower.follow!(account)
       list.accounts << account