diff --git a/internal/config/config.go b/internal/config/config.go
index add4f38..fc9682c 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -9,6 +9,11 @@ type Config struct {
 	Tools      ToolsSection      `toml:"tools"`
 	RateLimits RateLimitSection  `toml:"rate_limits"`
 	Security   SecuritySection   `toml:"security"`
+	Session    SessionSection    `toml:"session"`
+}
+
+type SessionSection struct {
+	MaxKeep int `toml:"max_keep"`
 }
 
 // SecuritySection configures the secret scanner and firewall.
diff --git a/internal/config/defaults.go b/internal/config/defaults.go
index cf5ae4c..646760b 100644
--- a/internal/config/defaults.go
+++ b/internal/config/defaults.go
@@ -18,5 +18,6 @@ func Defaults() Config {
 			BashTimeout: Duration(30 * time.Second),
 			MaxFileSize: 1 << 20, // 1MB
 		},
+		Session: SessionSection{MaxKeep: 20},
 	}
 }