diff --git a/csp_bot/config/backend/symphony_rsa.yaml b/csp_bot/config/backend/symphony_rsa.yaml
new file mode 100644
index 0000000..7871c69
--- /dev/null
+++ b/csp_bot/config/backend/symphony_rsa.yaml
@@ -0,0 +1,15 @@
+# @package modules.bot.config
+# Symphony authenticated with an RSA private key rather than a certificate.
+#
+# This is what `symphony-bdk` configurations use, and what Symphony's developer
+# sandbox issues, so it is offered alongside the certificate preset rather than
+# left to a hand-written override.
+symphony:
+  _target_: csp_bot.SymphonyConfig
+  bot_name: ${bot_name}
+  config:
+    _target_: chatom.symphony.SymphonyConfig
+    host: ${oc.env:SYMPHONY_HOST}
+    bot_username: ${oc.env:SYMPHONY_BOT_USERNAME}
+    # A path keeps long-lived key material out of the process environment.
+    bot_private_key_path: ${oc.env:SYMPHONY_BOT_PRIVATE_KEY_PATH}
diff --git a/docs/wiki/Backends.md b/docs/wiki/Backends.md
index b9bf7fa..244da72 100644
--- a/docs/wiki/Backends.md
+++ b/docs/wiki/Backends.md
@@ -20,26 +20,28 @@ pip install csp-adapter-slack csp-adapter-telegram
 
 Each backend reads its credentials from environment variables, matching the names used by the built-in `backend` configs.
 
-| Backend  | Environment variables                                          | `chatom` config field                          |
-| :------- | :------------------------------------------------------------- | :--------------------------------------------- |
-| Slack    | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN`                           | `bot_token`, `app_token`                       |
-| Discord  | `DISCORD_TOKEN`                                                | `token`                                        |
-| Symphony | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_CERT_PATH` | `host`, `bot_username`, `bot_certificate_path` |
-| Telegram | `TELEGRAM_BOT_TOKEN`                                           | `bot_token`                                    |
+| Backend        | Environment variables                                                     | `chatom` config field                          |
+| :------------- | :------------------------------------------------------------------------ | :--------------------------------------------- |
+| Slack          | `SLACK_BOT_TOKEN`, `SLACK_APP_TOKEN`                                      | `bot_token`, `app_token`                       |
+| Discord        | `DISCORD_TOKEN`                                                           | `token`                                        |
+| Symphony       | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_CERT_PATH`            | `host`, `bot_username`, `bot_certificate_path` |
+| Symphony (RSA) | `SYMPHONY_HOST`, `SYMPHONY_BOT_USERNAME`, `SYMPHONY_BOT_PRIVATE_KEY_PATH` | `host`, `bot_username`, `bot_private_key_path` |
+| Telegram       | `TELEGRAM_BOT_TOKEN`                                                      | `bot_token`                                    |
 
 Symphony needs a host, a bot username, and either a certificate or an RSA private key.
-The built-in preset uses certificate authentication with a combined certificate/key `.pem` file on disk (`bot_certificate_path`); a path keeps long-lived key material out of the process environment.
+Two presets cover both: `backend=symphony` uses certificate authentication with a combined certificate/key `.pem` file on disk (`bot_certificate_path`), and `backend=symphony_rsa` uses an RSA private key (`bot_private_key_path`), which is what `symphony-bdk` configurations and Symphony's developer sandbox use.
+Either way a path keeps long-lived key material out of the process environment.
 
 Discord's `message_content` is a [privileged intent](https://discord.com/developers/docs/topics/gateway#privileged-intents).
 The built-in preset requests it, but it must also be enabled for the bot in the Discord Developer Portal, or the bot will not receive command text in guild channels.
 
-To set a field other than the defaults — for example, to authenticate Symphony with an RSA key instead of a certificate — override it in your own config:
+To set a field neither preset covers, override it in your own config:
 
 ```yaml
 # @package modules.bot.config
 symphony:
   config:
-    bot_private_key_path: /path/to/bot-key.pem
+    key_manager_host: km.example.com
 ```
 
 For platform-specific setup of tokens and bot accounts, follow the adapter guides: