diff --git a/config-verify.c b/config-verify.c
index 63efef3..eef8059 100644
--- a/config-verify.c
+++ b/config-verify.c
@@ -50,6 +50,17 @@ conf_verify_int(keychain_t *chain, const struct yml_node *node)
     return false;
 }
 
+bool
+conf_verify_unsigned(keychain_t *chain, const struct yml_node *node)
+{
+    if (yml_value_is_int(node) && yml_value_as_int(node) >= 0)
+        return true;
+
+    LOG_ERR("%s: value is not a positive integer: '%s'",
+            conf_err_prefix(chain, node), yml_value_as_string(node));
+    return false;
+}
+
 bool
 conf_verify_bool(keychain_t *chain, const struct yml_node *node)
 {
diff --git a/config-verify.h b/config-verify.h
index 5afe3f6..8e5ab29 100644
--- a/config-verify.h
+++ b/config-verify.h
@@ -32,6 +32,7 @@ const char *conf_err_prefix(
 
 bool conf_verify_string(keychain_t *chain, const struct yml_node *node);
 bool conf_verify_int(keychain_t *chain, const struct yml_node *node);
+bool conf_verify_unsigned(keychain_t *chain, const struct yml_node *node);
 bool conf_verify_bool(keychain_t *chain, const struct yml_node *node);
 
 bool conf_verify_enum(keychain_t *chain, const struct yml_node *node,