diff --git a/fdroidserver/common.py b/fdroidserver/common.py
index 893b14da..bda93d65 100644
--- a/fdroidserver/common.py
+++ b/fdroidserver/common.py
@@ -126,6 +126,7 @@ CONFIG_NAMES = (
     RELEASECHANNELS_CONFIG_NAME,
 )
 
+CONFIG_FILE = 'config.yml'
 
 config = None
 options = None
@@ -525,7 +526,7 @@ def config_type_check(path, data):
 def read_config():
     """Read the repository config.
 
-    The config is read from config_file, which is in the current
+    The config is read from config.yml, which is in the current
     directory when any of the repo management commands are used. If
     there is a local metadata file in the git repo, then the config is
     not required, just use defaults.
@@ -546,21 +547,20 @@ def read_config():
         return config
 
     config = {}
-    config_file = 'config.yml'
-    old_config_file = 'config.py'
 
-    if os.path.exists(config_file):
-        logging.debug(_("Reading '{config_file}'").format(config_file=config_file))
-        with open(config_file, encoding='utf-8') as fp:
+    if os.path.exists(CONFIG_FILE):
+        logging.debug(_("Reading '{config_file}'").format(config_file=CONFIG_FILE))
+        with open(CONFIG_FILE, encoding='utf-8') as fp:
             config = yaml.safe_load(fp)
         if not config:
             config = {}
-        config_type_check(config_file, config)
+        config_type_check(CONFIG_FILE, config)
 
+    old_config_file = 'config.py'
     if os.path.exists(old_config_file):
         logging.warning(
             _("""Ignoring deprecated {oldfile}, use {newfile}!""").format(
-                oldfile=old_config_file, newfile=config_file
+                oldfile=old_config_file, newfile=CONFIG_FILE
             )
         )
 
@@ -577,14 +577,13 @@ def read_config():
                                       '-providerArg', 'opensc-fdroid.cfg']
 
     if any(k in config for k in ["keystore", "keystorepass", "keypass"]):
-        if os.path.exists(config_file):
-            f = config_file
-        elif os.path.exists(old_config_file):
-            f = old_config_file
-        st = os.stat(f)
+        st = os.stat(CONFIG_FILE)
         if st.st_mode & stat.S_IRWXG or st.st_mode & stat.S_IRWXO:
-            logging.warning(_("unsafe permissions on '{config_file}' (should be 0600)!")
-                            .format(config_file=f))
+            logging.warning(
+                _("unsafe permissions on '{config_file}' (should be 0600)!").format(
+                    config_file=CONFIG_FILE
+                )
+            )
 
     fill_config_defaults(config)
 
@@ -4191,9 +4190,17 @@ def load_stats_fdroid_signing_key_fingerprints():
         return json.loads(str(f.read('publishsigkeys.json'), 'utf-8'))
 
 
-def write_to_config(thisconfig, key, value=None, config_file=None):
+def write_config_file(config):
+    """Write the provided string to config.yml with the right path and encoding."""
+    Path(CONFIG_FILE).write_text(config, encoding='utf-8')
+
+
+def write_to_config(thisconfig, key, value=None):
     """Write a key/value to the local config.yml.
 
+    The config.yml is defined as YAML 1.2 in UTF-8 encoding on all
+    platforms.
+
     NOTE: only supports writing string variables.
 
     Parameters
@@ -4205,21 +4212,18 @@ def write_to_config(thisconfig, key, value=None, config_file=None):
     value
         optional value to be written, instead of fetched
         from 'thisconfig' dictionary.
+
     """
     if value is None:
         origkey = key + '_orig'
         value = thisconfig[origkey] if origkey in thisconfig else thisconfig[key]
-    if config_file:
-        cfg = config_file
-    else:
-        cfg = 'config.yml'
 
     # load config file, create one if it doesn't exist
-    if not os.path.exists(cfg):
-        open(cfg, 'a').close()
-        logging.info("Creating empty " + cfg)
-    with open(cfg, 'r') as f:
-        lines = f.readlines()
+    if not os.path.exists(CONFIG_FILE):
+        write_config_file('')
+        logging.info(_("Creating empty {config_file}").format(config_file=CONFIG_FILE))
+    with open(CONFIG_FILE) as fp:
+        lines = fp.readlines()
 
     # make sure the file ends with a carraige return
     if len(lines) > 0:
@@ -4233,7 +4237,7 @@ def write_to_config(thisconfig, key, value=None, config_file=None):
     # second instance of this line for this key in the document.
     didRepl = False
     # edit config file
-    with open(cfg, 'w') as f:
+    with open(CONFIG_FILE, 'w', encoding='utf-8') as f:
         for line in lines:
             if pattern.match(line):
                 if not didRepl:
diff --git a/fdroidserver/init.py b/fdroidserver/init.py
index 326ecf4c..a5575fea 100644
--- a/fdroidserver/init.py
+++ b/fdroidserver/init.py
@@ -38,13 +38,13 @@ def disable_in_config(key, value):
     """Write a key/value to the local config.yml, then comment it out."""
     import yaml
 
-    with open('config.yml') as f:
-        data = f.read()
+    with open(common.CONFIG_FILE) as fp:
+        data = fp.read()
     pattern = r'\n[\s#]*' + key + r':.*'
     repl = '\n#' + yaml.dump({key: value}, default_flow_style=False)
     data = re.sub(pattern, repl, data)
-    with open('config.yml', 'w') as f:
-        f.writelines(data)
+    with open(common.CONFIG_FILE, 'w') as fp:
+        fp.writelines(data)
 
 
 def main():
@@ -138,24 +138,24 @@ def main():
             _("Android SDK not found at {path}!").format(path=test_config['sdk_path'])
         )
 
-    if not os.path.exists('config.yml'):
+    if not os.path.exists(common.CONFIG_FILE):
         # 'metadata' and 'tmp' are created in fdroid
         if not os.path.exists('repo'):
             os.mkdir('repo')
-        example_config_yml = os.path.join(examplesdir, 'config.yml')
+        example_config_yml = os.path.join(examplesdir, common.CONFIG_FILE)
         if os.path.exists(example_config_yml):
-            shutil.copyfile(example_config_yml, 'config.yml')
+            shutil.copyfile(example_config_yml, common.CONFIG_FILE)
         else:
             from pkg_resources import get_distribution
 
             versionstr = get_distribution('fdroidserver').version
             if not versionstr:
                 versionstr = 'master'
-            with open('config.yml', 'w') as fp:
+            with open(common.CONFIG_FILE, 'w') as fp:
                 fp.write('# see https://gitlab.com/fdroid/fdroidserver/blob/')
                 fp.write(versionstr)
-                fp.write('/examples/config.yml\n')
-        os.chmod('config.yml', 0o0600)
+                fp.write(f'/examples/{common.CONFIG_FILE}\n')
+        os.chmod(common.CONFIG_FILE, 0o0600)
         # If android_home is None, test_config['sdk_path'] will be used and
         # "$ANDROID_HOME" may be used if the env var is set up correctly.
         # If android_home is not None, the path given from the command line
diff --git a/fdroidserver/lint.py b/fdroidserver/lint.py
index f8589897..64770476 100644
--- a/fdroidserver/lint.py
+++ b/fdroidserver/lint.py
@@ -976,7 +976,7 @@ def main():
     paths = list()
     for arg in options.appid:
         if (
-            arg == 'config.yml'
+            arg == common.CONFIG_FILE
             or Path(arg).parent.name == 'config'
             or Path(arg).parent.parent.name == 'config'  # localized
         ):
diff --git a/fdroidserver/nightly.py b/fdroidserver/nightly.py
index 84c2da2e..5b8983e9 100644
--- a/fdroidserver/nightly.py
+++ b/fdroidserver/nightly.py
@@ -423,9 +423,9 @@ Last updated: {date}'''.format(repo_git_base=repo_git_base,
             'keydname': DISTINGUISHED_NAME,
             'make_current_version_link': False,
         }
-        with open('config.yml', 'w') as fp:
+        with open(common.CONFIG_FILE, 'w', encoding='utf-8') as fp:
             yaml.dump(config, fp, default_flow_style=False)
-        os.chmod('config.yml', 0o600)
+        os.chmod(common.CONFIG_FILE, 0o600)
         config = common.read_config()
         common.assert_config_keystore(config)
 
diff --git a/tests/test_build.py b/tests/test_build.py
index 83e33eb2..5290552e 100755
--- a/tests/test_build.py
+++ b/tests/test_build.py
@@ -593,9 +593,9 @@ class BuildTest(unittest.TestCase):
         os.chdir(self.testdir)
         sdk_path = os.path.join(self.testdir, 'android-sdk')
         self.create_fake_android_home(sdk_path)
-        with open('config.yml', 'w') as fp:
+        with open(fdroidserver.common.CONFIG_FILE, 'w') as fp:
             yaml.dump({'sdk_path': sdk_path, 'keep_when_not_allowed': True}, fp)
-        os.chmod('config.yml', 0o600)
+        os.chmod(fdroidserver.common.CONFIG_FILE, 0o600)
         fdroidserver.build.config = fdroidserver.common.read_config()
 
         os.mkdir('metadata')
diff --git a/tests/test_common.py b/tests/test_common.py
index 34f83773..17690f59 100755
--- a/tests/test_common.py
+++ b/tests/test_common.py
@@ -653,8 +653,7 @@ class CommonTest(unittest.TestCase):
 
         """
         os.chdir(self.testdir)
-        config_yml = 'config.yml'
-        Path(config_yml).write_text(
+        fdroidserver.common.write_config_file(
             textwrap.dedent(
                 """\
                 # abc
@@ -670,18 +669,12 @@ class CommonTest(unittest.TestCase):
         )
 
         config = {'key': 111, 'a_path_orig': '~/android-sdk'}
-        fdroidserver.common.write_to_config(config, 'key', config_file=config_yml)
-        fdroidserver.common.write_to_config(
-            config, 'a_path', config_file=config_yml
-        )
-        fdroidserver.common.write_to_config(
-            config, 'test', value='test value', config_file=config_yml
-        )
-        fdroidserver.common.write_to_config(
-            config, 'new_key', value='new', config_file=config_yml
-        )
+        fdroidserver.common.write_to_config(config, 'key')
+        fdroidserver.common.write_to_config(config, 'a_path')
+        fdroidserver.common.write_to_config(config, 'test', value='test value')
+        fdroidserver.common.write_to_config(config, 'new_key', value='new')
 
-        with open(config_yml) as fp:
+        with open(fdroidserver.common.CONFIG_FILE) as fp:
             self.assertEqual(
                 fp.read(),
                 textwrap.dedent(
@@ -700,9 +693,10 @@ class CommonTest(unittest.TestCase):
             )
 
     def test_write_to_config_when_empty(self):
-        config_yml = Path(self.testdir) / 'config.yml'
-        config_yml.write_text('')
-        fdroidserver.common.write_to_config({}, 'key', 'val', config_yml)
+        os.chdir(self.testdir)
+        config_yml = Path(fdroidserver.common.CONFIG_FILE)
+        config_yml.write_text('', encoding='utf-8')
+        fdroidserver.common.write_to_config({}, 'key', 'val')
         self.assertEqual(config_yml.read_text(), 'key: val\n')
 
     def test_apk_name_regex(self):
@@ -1885,24 +1879,23 @@ class CommonTest(unittest.TestCase):
     def test_with_no_config(self):
         """It should set defaults if no config file is found"""
         os.chdir(self.tmpdir)
-        self.assertFalse(os.path.exists('config.yml'))
+        self.assertFalse(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
         self.assertIsNotNone(config.get('char_limits'))
 
     def test_with_zero_size_config(self):
         """It should set defaults if config file has nothing in it"""
         os.chdir(self.tmpdir)
-        open('config.yml', 'w').close()
-        self.assertTrue(os.path.exists('config.yml'))
+        fdroidserver.common.write_config_file('')
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
         self.assertIsNotNone(config.get('char_limits'))
 
     def test_with_config_yml(self):
         """Make sure it is possible to use config.yml alone."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('apksigner: yml')
-        self.assertTrue(os.path.exists('config.yml'))
+        fdroidserver.common.write_config_file('apksigner: yml')
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
         self.assertEqual('yml', config.get('apksigner'))
 
@@ -1910,9 +1903,8 @@ class CommonTest(unittest.TestCase):
         """Make sure it is possible to use config.yml in UTF-8 encoding."""
         os.chdir(self.tmpdir)
         teststr = '/πÇÇ现代通用字-български-عربي1/ö/yml'
-        with open('config.yml', 'w', encoding='utf-8') as fp:
-            fp.write('apksigner: ' + teststr)
-        self.assertTrue(os.path.exists('config.yml'))
+        fdroidserver.common.write_config_file('apksigner: ' + teststr)
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
         self.assertEqual(teststr, config.get('apksigner'))
 
@@ -1920,9 +1912,9 @@ class CommonTest(unittest.TestCase):
         """Make sure it is possible to use config.yml Unicode encoded as ASCII."""
         os.chdir(self.tmpdir)
         teststr = '/πÇÇ现代通用字-български-عربي1/ö/yml'
-        with open('config.yml', 'w') as fp:
+        with open(fdroidserver.common.CONFIG_FILE, 'w', encoding='utf-8') as fp:
             yaml.dump({'apksigner': teststr}, fp)
-        self.assertTrue(os.path.exists('config.yml'))
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
         self.assertEqual(teststr, config.get('apksigner'))
 
@@ -1931,83 +1923,85 @@ class CommonTest(unittest.TestCase):
         os.chdir(self.tmpdir)
         with mock.patch.dict(os.environ):
             os.environ['SECRET'] = 'mysecretpassword'  # nosec B105
-            with open('config.yml', 'w') as fp:
-                fp.write("""keypass: {'env': 'SECRET'}""")
-            self.assertTrue(os.path.exists('config.yml'))
+            fdroidserver.common.write_config_file("""keypass: {'env': 'SECRET'}\n""")
+            self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
             config = fdroidserver.common.read_config()
             self.assertEqual(os.getenv('SECRET', 'fail'), config.get('keypass'))
 
     def test_with_config_yml_is_dict(self):
         os.chdir(self.tmpdir)
-        Path('config.yml').write_text('apksigner = /placeholder/path')
+        Path(fdroidserver.common.CONFIG_FILE).write_text('apksigner = /bin/apksigner')
         with self.assertRaises(TypeError):
             fdroidserver.common.read_config()
 
     def test_with_config_yml_is_not_mixed_type(self):
         os.chdir(self.tmpdir)
-        Path('config.yml').write_text('k: v\napksigner = /placeholder/path')
+        Path(fdroidserver.common.CONFIG_FILE).write_text('k: v\napksigner = /bin/apk')
         with self.assertRaises(yaml.scanner.ScannerError):
             fdroidserver.common.read_config()
 
     def test_config_perm_warning(self):
         """Exercise the code path that issues a warning about unsafe permissions."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('keystore: foo.jks')
-        self.assertTrue(os.path.exists(fp.name))
-        os.chmod(fp.name, 0o666)  # nosec B103
+        fdroidserver.common.write_config_file('keystore: foo.jks')
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
+        os.chmod(fdroidserver.common.CONFIG_FILE, 0o666)  # nosec B103
         fdroidserver.common.read_config()
-        os.remove(fp.name)
+        os.remove(fdroidserver.common.CONFIG_FILE)
         fdroidserver.common.config = None
 
     def test_config_repo_url(self):
         """repo_url ends in /repo, archive_url ends in /archive."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('repo_url: https://MyFirstFDroidRepo.org/fdroid/repo\n')
-            fp.write('archive_url: https://MyFirstFDroidRepo.org/fdroid/archive')
+        fdroidserver.common.write_config_file(
+            textwrap.dedent(
+                """\
+                repo_url: https://MyFirstFDroidRepo.org/fdroid/repo
+                archive_url: https://MyFirstFDroidRepo.org/fdroid/archive
+                """
+            )
+        )
         config = fdroidserver.common.read_config()
-        self.assertEqual('https://MyFirstFDroidRepo.org/fdroid/repo', config.get('repo_url'))
-        self.assertEqual('https://MyFirstFDroidRepo.org/fdroid/archive', config.get('archive_url'))
+        self.assertEqual(
+            'https://MyFirstFDroidRepo.org/fdroid/repo', config.get('repo_url')
+        )
+        self.assertEqual(
+            'https://MyFirstFDroidRepo.org/fdroid/archive', config.get('archive_url')
+        )
 
     def test_config_repo_url_extra_slash(self):
         """repo_url ends in /repo, archive_url ends in /archive."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('repo_url: https://MyFirstFDroidRepo.org/fdroid/repo/')
+        fdroidserver.common.write_config_file('repo_url: https://MyFirstFDroidRepo.org/fdroid/repo/')
         with self.assertRaises(FDroidException):
             fdroidserver.common.read_config()
 
     def test_config_repo_url_not_repo(self):
         """repo_url ends in /repo, archive_url ends in /archive."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('repo_url: https://MyFirstFDroidRepo.org/fdroid/foo')
+        fdroidserver.common.write_config_file('repo_url: https://MyFirstFDroidRepo.org/fdroid/foo')
         with self.assertRaises(FDroidException):
             fdroidserver.common.read_config()
 
     def test_config_archive_url_extra_slash(self):
         """repo_url ends in /repo, archive_url ends in /archive."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('archive_url: https://MyFirstFDroidRepo.org/fdroid/archive/')
+        fdroidserver.common.write_config_file('archive_url: https://MyFirstFDroidRepo.org/fdroid/archive/')
         with self.assertRaises(FDroidException):
             fdroidserver.common.read_config()
 
     def test_config_archive_url_not_repo(self):
         """repo_url ends in /repo, archive_url ends in /archive."""
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('archive_url: https://MyFirstFDroidRepo.org/fdroid/foo')
+        fdroidserver.common.write_config_file('archive_url: https://MyFirstFDroidRepo.org/fdroid/foo')
         with self.assertRaises(FDroidException):
             fdroidserver.common.read_config()
 
     def test_write_to_config_yml(self):
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('apksigner: yml')
-        os.chmod('config.yml', 0o0600)
-        self.assertTrue(os.path.exists(fp.name))
+        fdroidserver.common.write_config_file('apksigner: yml')
+        os.chmod(fdroidserver.common.CONFIG_FILE, 0o0600)
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
         self.assertFalse('keypass' in config)
         self.assertEqual('yml', config.get('apksigner'))
@@ -2018,11 +2012,17 @@ class CommonTest(unittest.TestCase):
 
     def test_config_dict_with_int_keys(self):
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write('java_paths:\n  8: /usr/lib/jvm/java-8-openjdk\n')
-        self.assertTrue(os.path.exists(fp.name))
+        fdroidserver.common.write_config_file(
+            textwrap.dedent(
+                """
+                java_paths:
+                  8: /usr/lib/jvm/java-8-openjdk
+                """
+            )
+        )
+        self.assertTrue(os.path.exists(fdroidserver.common.CONFIG_FILE))
         config = fdroidserver.common.read_config()
-        self.assertEqual('/usr/lib/jvm/java-8-openjdk', config.get('java_paths', {}).get('8'))
+        self.assertEqual('/usr/lib/jvm/java-8-openjdk', config['java_paths']['8'])
 
     @mock.patch.dict(os.environ, {'PATH': os.getenv('PATH')}, clear=True)
     def test_test_sdk_exists_fails_on_bad_sdk_path(self):
@@ -2098,7 +2098,7 @@ class CommonTest(unittest.TestCase):
         os.chdir(self.testdir)
         shutil.copy(
             os.path.join(basedir, '..', 'buildserver', 'config.buildserver.yml'),
-            'config.yml',
+            fdroidserver.common.CONFIG_FILE,
         )
         fdroidserver.common.read_config()
 
@@ -2606,7 +2606,7 @@ class CommonTest(unittest.TestCase):
 
     def test_get_apksigner_smartcardoptions(self):
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
+        with open(fdroidserver.common.CONFIG_FILE, 'w', encoding='utf-8') as fp:
             d = {
                 'smartcardoptions': '-storetype PKCS11'
                 ' -providerName SunPKCS11-OpenSC'
@@ -2634,10 +2634,9 @@ class CommonTest(unittest.TestCase):
 
     def test_get_smartcardoptions_list(self):
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write(
-                textwrap.dedent(
-                    """
+        fdroidserver.common.write_config_file(
+            textwrap.dedent(
+                """
                     smartcardoptions:
                       - -storetype
                       -  PKCS11
@@ -2647,9 +2646,9 @@ class CommonTest(unittest.TestCase):
                       -  sun.security.pkcs11.SunPKCS11
                       - -providerArg
                       -  opensc-fdroid.cfg
-                    """
-                )
+                """
             )
+        )
         config = fdroidserver.common.read_config()
         fdroidserver.common.config = config
         self.assertTrue(isinstance(config['smartcardoptions'], list))
@@ -2669,17 +2668,16 @@ class CommonTest(unittest.TestCase):
 
     def test_get_smartcardoptions_spaces(self):
         os.chdir(self.tmpdir)
-        with open('config.yml', 'w') as fp:
-            fp.write(
-                textwrap.dedent(
-                    """smartcardoptions: |
-                         -storetype      PKCS11
-                         -providerClass  sun.security.pkcs11.SunPKCS11
-                         -providerArg    /etc/pkcs11_java.cfg
-
-                    """
-                )
+        fdroidserver.common.write_config_file(
+            textwrap.dedent(
+                """
+                smartcardoptions: |
+                  -storetype      PKCS11
+                  -providerClass  sun.security.pkcs11.SunPKCS11
+                  -providerArg    /etc/pkcs11_java.cfg
+                """
             )
+        )
         config = fdroidserver.common.read_config()
         fdroidserver.common.config = config
         self.assertTrue(isinstance(config['smartcardoptions'], list))
@@ -2801,7 +2799,9 @@ class CommonTest(unittest.TestCase):
 
     def test_config_serverwebroot_str(self):
         os.chdir(self.testdir)
-        Path('config.yml').write_text("""serverwebroot: 'foo@example.com:/var/www'""")
+        fdroidserver.common.write_config_file(
+            """serverwebroot: 'foo@example.com:/var/www'"""
+        )
         self.assertEqual(
             [{'url': 'foo@example.com:/var/www/'}],
             fdroidserver.common.read_config()['serverwebroot'],
@@ -2809,7 +2809,9 @@ class CommonTest(unittest.TestCase):
 
     def test_config_serverwebroot_list(self):
         os.chdir(self.testdir)
-        Path('config.yml').write_text("""serverwebroot:\n  - foo@example.com:/var/www""")
+        fdroidserver.common.write_config_file(
+            """serverwebroot:\n  - foo@example.com:/var/www"""
+        )
         self.assertEqual(
             [{'url': 'foo@example.com:/var/www/'}],
             fdroidserver.common.read_config()['serverwebroot'],
@@ -2817,7 +2819,9 @@ class CommonTest(unittest.TestCase):
 
     def test_config_serverwebroot_dict(self):
         os.chdir(self.testdir)
-        Path('config.yml').write_text("""serverwebroot:\n  - url: 'foo@example.com:/var/www'""")
+        fdroidserver.common.write_config_file(
+            """serverwebroot:\n  - url: 'foo@example.com:/var/www'"""
+        )
         self.assertEqual(
             [{'url': 'foo@example.com:/var/www/'}],
             fdroidserver.common.read_config()['serverwebroot'],
diff --git a/tests/test_index.py b/tests/test_index.py
index 8f1b1e86..059386fb 100755
--- a/tests/test_index.py
+++ b/tests/test_index.py
@@ -38,7 +38,7 @@ class IndexTest(unittest.TestCase):
         cls.index_v1_jar = basedir / 'repo' / 'index-v1.jar'
 
     def setUp(self):
-        (basedir / 'config.yml').chmod(0o600)
+        (basedir / common.CONFIG_FILE).chmod(0o600)
         os.chdir(basedir)  # so read_config() can find config.yml
 
         common.config = None
@@ -380,7 +380,7 @@ class IndexTest(unittest.TestCase):
             with zipfile.ZipFile(jarfile, 'w', zipfile.ZIP_DEFLATED) as jar:
                 jar.writestr('publishsigkeys.json', json.dumps(sigkeyfps))
             publish.sign_sig_key_fingerprint_list(jarfile)
-            Path('config.yml').write_text('')
+            common.write_config_file('')
 
             index.v1_sort_packages(
                 i, common.load_stats_fdroid_signing_key_fingerprints()
@@ -717,7 +717,7 @@ class IndexTest(unittest.TestCase):
         os.chdir(self.testdir)
         repo_url = 'https://example.com/fdroid/repo'
         c = {'repo_url': repo_url, 'mirrors': ['http://one/fdroid']}
-        with open('config.yml', 'w') as fp:
+        with open(common.CONFIG_FILE, 'w', encoding='utf-8') as fp:
             yaml.dump(c, fp)
         common.config = None
         common.read_config()
diff --git a/tests/test_init.py b/tests/test_init.py
index b448192f..179f06c7 100755
--- a/tests/test_init.py
+++ b/tests/test_init.py
@@ -28,12 +28,13 @@ class InitTest(unittest.TestCase):
         self._td.cleanup()
 
     def test_disable_in_config(self):
-        configfile = pathlib.Path('config.yml')
-        configfile.write_text('keystore: NONE\nkeypass: mysupersecrets\n')
+        test = 'mysupersecrets'
+        configfile = pathlib.Path(fdroidserver.common.CONFIG_FILE)
+        configfile.write_text(f'keystore: NONE\nkeypass: {test}\n', encoding='utf-8')
         configfile.chmod(0o600)
         config = fdroidserver.common.read_config()
         self.assertEqual('NONE', config['keystore'])
-        self.assertEqual('mysupersecrets', config['keypass'])
+        self.assertEqual(test, config['keypass'])
         fdroidserver.init.disable_in_config('keypass', 'comment')
         self.assertIn('#keypass:', configfile.read_text())
         fdroidserver.common.config = None
diff --git a/tests/test_integration.py b/tests/test_integration.py
index d7f1231d..7c527b57 100755
--- a/tests/test_integration.py
+++ b/tests/test_integration.py
@@ -148,7 +148,7 @@ class IntegrationTest(unittest.TestCase):
             + ["init", "--keystore", keystore_path, "--repo-keyalias", "sova"]
         )
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "keystorepass": "r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=",
                 "keypass": "r9aquRHYoI8+dYz6jKrLntQ5/NJNASFBacJh7Jv2BlI=",
@@ -160,7 +160,7 @@ class IntegrationTest(unittest.TestCase):
         shutil.copy(FILES / "keystore.jks", "keystore.jks")
         self.fdroid_init_with_prebuilt_keystore("keystore.jks")
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "make_current_version_link": True,
                 "keydname": "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US",
@@ -193,7 +193,7 @@ class IntegrationTest(unittest.TestCase):
     def test_utf8_metadata(self):
         self.fdroid_init_with_prebuilt_keystore()
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "repo_description": "获取已安装在您的设备上的应用的",
                 "mirrors": ["https://foo.bar/fdroid", "http://secret.onion/fdroid"],
@@ -247,7 +247,7 @@ class IntegrationTest(unittest.TestCase):
         shutil.copytree(FILES / "gnupghome", gnupghome)
         os.chmod(gnupghome, 0o700)
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "install_list": "org.adaway",
                 "uninstall_list": ["com.android.vending", "com.facebook.orca"],
@@ -334,7 +334,7 @@ class IntegrationTest(unittest.TestCase):
             FILES.glob("repo/obb.main.twoversions_110161[357].apk"),
         ):
             shutil.copy(f, "repo")
-        self.update_yaml("config.yml", {"archive_older": 3})
+        self.update_yaml(common.CONFIG_FILE, {"archive_older": 3})
 
         self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
         with open("archive/index.xml") as f:
@@ -356,7 +356,7 @@ class IntegrationTest(unittest.TestCase):
         shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
         for f in FILES.glob("repo/com.politedroid_[0-9].apk"):
             shutil.copy(f, "repo")
-        self.update_yaml("config.yml", {"archive_older": 3})
+        self.update_yaml(common.CONFIG_FILE, {"archive_older": 3})
 
         self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
         repo = Path("repo/index.xml").read_text()
@@ -456,7 +456,7 @@ class IntegrationTest(unittest.TestCase):
         self.remove_lines("metadata/com.politedroid.yml", ["ArchivePolicy:"])
         for f in FILES.glob("repo/com.politedroid_[0-9].apk"):
             shutil.copy(f, "repo")
-        self.update_yaml("config.yml", {"archive_older": 3})
+        self.update_yaml(common.CONFIG_FILE, {"archive_older": 3})
 
         self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
         repo = Path("repo/index.xml").read_text()
@@ -474,7 +474,7 @@ class IntegrationTest(unittest.TestCase):
         self.assertIn("com.politedroid_3.apk", archive)
         self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
 
-        self.update_yaml("config.yml", {"archive_older": 1})
+        self.update_yaml(common.CONFIG_FILE, {"archive_older": 1})
         self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
         repo = Path("repo/index.xml").read_text()
         repo_cnt = sum(1 for line in repo.splitlines() if "<package>" in line)
@@ -555,7 +555,7 @@ class IntegrationTest(unittest.TestCase):
     def test_allowing_disabled_signatures_in_repo_and_archive(self):
         self.fdroid_init_with_prebuilt_keystore()
         self.update_yaml(
-            "config.yml", {"allow_disabled_algorithms": True, "archive_older": 3}
+            common.CONFIG_FILE, {"allow_disabled_algorithms": True, "archive_older": 3}
         )
         Path("metadata").mkdir()
         shutil.copy(FILES / "metadata/com.politedroid.yml", "metadata")
@@ -650,7 +650,7 @@ class IntegrationTest(unittest.TestCase):
             self.assertTrue(Path("archive/urzip-badsig.apk").is_file())
 
         # test unarchiving when disabled_algorithms are allowed again
-        self.update_yaml("config.yml", {"allow_disabled_algorithms": True})
+        self.update_yaml(common.CONFIG_FILE, {"allow_disabled_algorithms": True})
         self.assert_run(self.fdroid_cmd + ["update", "--pretty", "--nosign"])
         with open("archive/index.xml") as f:
             archive_cnt = sum(1 for line in f if "<package>" in line)
@@ -689,7 +689,7 @@ class IntegrationTest(unittest.TestCase):
     def test_rename_apks_with_fdroid_update_rename_apks_opt_nosign_opt_for_speed(self):
         self.fdroid_init_with_prebuilt_keystore()
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "keydname": "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"
             },
@@ -744,7 +744,7 @@ class IntegrationTest(unittest.TestCase):
 
     def test_for_added_date_being_set_correctly_for_repo_and_archive(self):
         self.fdroid_init_with_prebuilt_keystore()
-        self.update_yaml("config.yml", {"archive_older": 3})
+        self.update_yaml(common.CONFIG_FILE, {"archive_older": 3})
         Path("metadata").mkdir()
         Path("archive").mkdir()
         Path("stats").mkdir()
@@ -803,12 +803,14 @@ class IntegrationTest(unittest.TestCase):
         )
         # fake that no JDKs are available
         self.update_yaml(
-            "config.yml", {"categories": ["Internet"], "java_paths": {}}, replace=True
+            common.CONFIG_FILE,
+            {"categories": ["Internet"], "java_paths": {}},
+            replace=True,
         )
         local_copy_dir = self.testdir / "local_copy_dir/fdroid"
         (local_copy_dir / "repo").mkdir(parents=True)
         self.update_yaml(
-            "config.yml", {"local_copy_dir": str(local_copy_dir.resolve())}
+            common.CONFIG_FILE, {"local_copy_dir": str(local_copy_dir.resolve())}
         )
 
         subprocess.run(self.fdroid_cmd + ["checkupdates", "--allow-dirty"])
@@ -879,7 +881,7 @@ class IntegrationTest(unittest.TestCase):
         new_tmp_repo.mkdir()
         os.chdir(new_tmp_repo)
         self.fdroid_init_with_prebuilt_keystore()
-        self.update_yaml("config.yml", {"sync_from_local_copy_dir": True})
+        self.update_yaml(common.CONFIG_FILE, {"sync_from_local_copy_dir": True})
         self.assert_run(
             self.fdroid_cmd + ["deploy", "--local-copy-dir", local_copy_dir]
         )
@@ -946,7 +948,7 @@ class IntegrationTest(unittest.TestCase):
             ]
         )
         # the value set in --android-home should override $ANDROID_HOME
-        self.assertIn(str(fake_android_home), Path("config.yml").read_text())
+        self.assertIn(str(fake_android_home), Path(common.CONFIG_FILE).read_text())
 
     @unittest.skipUnless(
         "ANDROID_HOME" in os.environ, "runs only with ANDROID_HOME set"
@@ -1097,7 +1099,7 @@ class IntegrationTest(unittest.TestCase):
         # now set up fake, non-working keystore setup
         Path("keystore.p12").touch()
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "keystore": "keystore.p12",
                 "repo_keyalias": "foo",
@@ -1115,7 +1117,9 @@ class IntegrationTest(unittest.TestCase):
         shutil.copytree(FILES / "repo", "repo", dirs_exist_ok=True)
         shutil.copytree(FILES / "metadata", "metadata")
         git_remote = self.testdir / "git_remote"
-        self.update_yaml("config.yml", {"binary_transparency_remote": str(git_remote)})
+        self.update_yaml(
+            common.CONFIG_FILE, {"binary_transparency_remote": str(git_remote)}
+        )
         self.assert_run(self.fdroid_cmd + ["update", "--verbose"])
         self.assert_run(self.fdroid_cmd + ["deploy", "--verbose"])
         self.assertIn("<application id=", Path("repo/index.xml").read_text())
@@ -1146,7 +1150,7 @@ class IntegrationTest(unittest.TestCase):
         self.assertTrue(apkcache.stat().st_size > 0)
 
         # now set fake repo_keyalias
-        self.update_yaml("config.yml", {"repo_keyalias": "fake"})
+        self.update_yaml(common.CONFIG_FILE, {"repo_keyalias": "fake"})
         # this should fail because this repo has a bad repo_keyalias
         self.assert_run_fail(self.fdroid_cmd + ["update"])
 
@@ -1179,7 +1183,7 @@ class IntegrationTest(unittest.TestCase):
 
         self.fdroid_init_with_prebuilt_keystore()
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {"archive_older": 3, "servergitmirrors": str(server_git_mirror)},
         )
         for f in FILES.glob("repo/com.politedroid_[345].apk"):
@@ -1226,7 +1230,7 @@ class IntegrationTest(unittest.TestCase):
             f.stat().st_size for f in (git_mirror / ".git").glob("**/*") if f.is_file()
         )
 
-        self.update_yaml("config.yml", {"git_mirror_size_limit": "60kb"})
+        self.update_yaml(common.CONFIG_FILE, {"git_mirror_size_limit": "60kb"})
         self.assert_run(self.fdroid_cmd + ["update"])
         self.assert_run(self.fdroid_cmd + ["deploy"])
         self.assertTrue(Path("archive/com.politedroid_3.apk").is_file())
@@ -1274,7 +1278,7 @@ class IntegrationTest(unittest.TestCase):
         Path("unsigned").mkdir()
         shutil.copy(FILES / "urzip-release-unsigned.apk", "unsigned")
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "archive_older": 3,
                 "mirrors": [
@@ -1312,7 +1316,7 @@ class IntegrationTest(unittest.TestCase):
         )
         os.chdir(online_root)
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "local_copy_dir": str(local_copy_dir),
                 "sync_from_local_copy_dir": True,
@@ -1344,7 +1348,7 @@ class IntegrationTest(unittest.TestCase):
     def test_extracting_and_publishing_with_developer_signature(self):
         self.fdroid_init_with_prebuilt_keystore()
         self.update_yaml(
-            "config.yml",
+            common.CONFIG_FILE,
             {
                 "keydname": "CN=Birdman, OU=Cell, O=Alcatraz, L=Alcatraz, S=California, C=US"
             },
diff --git a/tests/test_lint.py b/tests/test_lint.py
index ff6c2247..6816ab69 100755
--- a/tests/test_lint.py
+++ b/tests/test_lint.py
@@ -345,7 +345,7 @@ class LintTest(unittest.TestCase):
     def test_check_categories_from_config_yml(self):
         """In config.yml, categories is a list."""
         os.chdir(self.testdir)
-        Path('config.yml').write_text('categories: [foo, bar]\n')
+        fdroidserver.common.write_config_file('categories: [foo, bar]\n')
         fdroidserver.lint.config = fdroidserver.common.read_config()
         fdroidserver.lint.load_categories_config()
         self.assertEqual(fdroidserver.lint.CATEGORIES_KEYS, ['foo', 'bar'])
@@ -434,9 +434,11 @@ class LintTest(unittest.TestCase):
 
     def test_lint_invalid_config_keys(self):
         os.chdir(self.testdir)
-        Path('config').mkdir()
-        Path('config/config.yml').write_text('repo:\n  invalid_key: test\n')
-        self.assertFalse(fdroidserver.lint.lint_config('config/config.yml'))
+        os.mkdir('config')
+        config_yml = fdroidserver.common.CONFIG_FILE
+        with open(f'config/{config_yml}', 'w', encoding='utf-8') as fp:
+            fp.write('repo:\n  invalid_key: test\n')
+        self.assertFalse(fdroidserver.lint.lint_config(f'config/{config_yml}'))
 
     def test_lint_invalid_localized_config_keys(self):
         os.chdir(self.testdir)
@@ -534,7 +536,7 @@ class LintAntiFeaturesTest(unittest.TestCase):
 class ConfigYmlTest(LintTest):
     def setUp(self):
         super().setUp()
-        self.config_yml = Path(self.testdir) / 'config.yml'
+        self.config_yml = Path(self.testdir) / fdroidserver.common.CONFIG_FILE
 
     def test_config_yml_int(self):
         self.config_yml.write_text('repo_maxage: 1\n')
diff --git a/tests/test_nightly.py b/tests/test_nightly.py
index bc2567e2..750a22fc 100755
--- a/tests/test_nightly.py
+++ b/tests/test_nightly.py
@@ -268,7 +268,7 @@ class NightlyTest(unittest.TestCase):
             'repo_url': mirror_url + '/repo',
             'servergitmirrors': [{"url": git_url}],
         }
-        with open('config.yml') as fp:
+        with open(common.CONFIG_FILE) as fp:
             config = yaml.safe_load(fp)
             # .ssh is random tmpdir set in nightly.py, so test basename only
             self.assertEqual(
@@ -339,7 +339,7 @@ class NightlyTest(unittest.TestCase):
             'repo_url': 'https://gitlab.com/fdroid/test-nightly/-/raw/master/fdroid/repo',
             'servergitmirrors': [{"url": 'git@gitlab.com:fdroid/test-nightly'}],
         }
-        with open('config.yml') as fp:
+        with open(common.CONFIG_FILE) as fp:
             config = yaml.safe_load(fp)
             # .ssh is random tmpdir set in nightly.py, so test basename only
             self.assertEqual(
diff --git a/tests/test_publish.py b/tests/test_publish.py
index eaf2f542..099c4188 100755
--- a/tests/test_publish.py
+++ b/tests/test_publish.py
@@ -18,7 +18,6 @@ import shutil
 import sys
 import unittest
 import tempfile
-from pathlib import Path
 from unittest import mock
 
 from fdroidserver import publish
@@ -96,7 +95,7 @@ class PublishTest(unittest.TestCase):
         ]
 
         os.chdir(self.testdir)
-        Path('config.yml').write_text('')
+        common.write_config_file('')
 
         publish.store_stats_fdroid_signing_key_fingerprints(appids, indent=2)
 
@@ -118,7 +117,7 @@ class PublishTest(unittest.TestCase):
         self.assertEqual(expected, common.load_stats_fdroid_signing_key_fingerprints())
 
         yaml = ruamel.yaml.YAML(typ='safe')
-        with open('config.yml') as fp:
+        with open(common.CONFIG_FILE) as fp:
             config = yaml.load(fp)
         self.assertEqual(
             'c58460800c7b250a619c30c13b07b7359a43e5af71a4352d86c58ae18c9f6d41',
diff --git a/tests/test_scanner.py b/tests/test_scanner.py
index 592680ef..4899a219 100755
--- a/tests/test_scanner.py
+++ b/tests/test_scanner.py
@@ -800,7 +800,7 @@ class Test_ScannerTool(unittest.TestCase):
 
     def test_refresh_from_config(self):
         os.chdir(self.testdir)
-        pathlib.Path('config.yml').write_text('refresh_scanner: true')
+        fdroidserver.common.write_config_file('refresh_scanner: true\n')
         with mock.patch('fdroidserver.scanner.ScannerTool.refresh') as refresh:
             fdroidserver.scanner.ScannerTool()
             refresh.assert_called_once()
@@ -809,7 +809,7 @@ class Test_ScannerTool(unittest.TestCase):
         fdroidserver.common.options = mock.Mock()
         fdroidserver.common.options.refresh_scanner = True
         os.chdir(self.testdir)
-        pathlib.Path('config.yml').write_text('refresh_scanner: false')
+        fdroidserver.common.write_config_file('refresh_scanner: false\n')
         with mock.patch('fdroidserver.scanner.ScannerTool.refresh') as refresh:
             fdroidserver.scanner.ScannerTool()
             refresh.assert_called_once()
diff --git a/tests/test_update.py b/tests/test_update.py
index 28dd27f9..6c551694 100755
--- a/tests/test_update.py
+++ b/tests/test_update.py
@@ -1787,7 +1787,9 @@ class UpdateTest(unittest.TestCase):
     def test_categories_txt_is_removed_by_delete_unknown(self):
         """categories.txt used to be a part of this system, now its nothing."""
         os.chdir(self.testdir)
-        Path('config.yml').write_text('repo_pubkey: ffffffffffffffffffffffffffffffffffffffff')
+        fdroidserver.common.write_config_file(
+            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff\n'
+        )
 
         categories_txt = Path('repo/categories.txt')
         categories_txt.parent.mkdir()
@@ -1803,8 +1805,8 @@ class UpdateTest(unittest.TestCase):
         os.chdir(self.testdir)
         os.mkdir('metadata')
         os.mkdir('repo')
-        Path('config.yml').write_text(
-            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff'
+        fdroidserver.common.write_config_file(
+            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff\n'
         )
 
         testapk = os.path.join('repo', 'com.politedroid_6.apk')
@@ -1822,8 +1824,8 @@ class UpdateTest(unittest.TestCase):
         os.chdir(self.testdir)
         os.mkdir('metadata')
         os.mkdir('repo')
-        Path('config.yml').write_text(
-            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff'
+        fdroidserver.common.write_config_file(
+            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff\n'
         )
 
         testapk = os.path.join('repo', 'com.politedroid_6.apk')
@@ -1844,8 +1846,8 @@ class UpdateTest(unittest.TestCase):
         os.chdir(self.testdir)
         os.mkdir('metadata')
         os.mkdir('repo')
-        Path('config.yml').write_text(
-            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff'
+        fdroidserver.common.write_config_file(
+            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff\n'
         )
 
         testapk = os.path.join('repo', 'com.politedroid_6.apk')
@@ -1871,8 +1873,8 @@ class UpdateTest(unittest.TestCase):
         Path('config/categories.yml').write_text('System: {name: System Apps}')
         os.mkdir('metadata')
         os.mkdir('repo')
-        Path('config.yml').write_text(
-            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff'
+        fdroidserver.common.write_config_file(
+            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff\n'
         )
 
         testapk = os.path.join('repo', 'com.politedroid_6.apk')
@@ -1901,8 +1903,8 @@ class UpdateTest(unittest.TestCase):
         Path('config/categories.yml').write_text('System: {name: S}\nTime: {name: T}\n')
         os.mkdir('metadata')
         os.mkdir('repo')
-        Path('config.yml').write_text(
-            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff'
+        fdroidserver.common.write_config_file(
+            'repo_pubkey: ffffffffffffffffffffffffffffffffffffffff\n'
         )
 
         testapk = os.path.join('repo', 'com.politedroid_6.apk')