diff --git a/blobs.go b/blobs.go
index 9f572bfa..d1253301 100644
--- a/blobs.go
+++ b/blobs.go
@@ -127,6 +127,11 @@ type BlobDescriptorService interface {
 	Clear(ctx context.Context, dgst digest.Digest) error
 }
 
+// BlobDescriptorServiceFactory creates middleware for BlobDescriptorService.
+type BlobDescriptorServiceFactory interface {
+	BlobAccessController(svc BlobDescriptorService) BlobDescriptorService
+}
+
 // ReadSeekCloser is the primary reader type for blob data, combining
 // io.ReadSeeker with io.Closer.
 type ReadSeekCloser interface {
diff --git a/registry/handlers/app.go b/registry/handlers/app.go
index 3c3e50d0..c65441c6 100644
--- a/registry/handlers/app.go
+++ b/registry/handlers/app.go
@@ -177,7 +177,7 @@ func NewApp(ctx context.Context, config *configuration.Configuration) *App {
 		app.httpHost = *u
 	}
 
-	options := []storage.RegistryOption{}
+	options := registrymiddleware.GetRegistryOptions()
 
 	if app.isCache {
 		options = append(options, storage.DisableDigestResumption)
diff --git a/registry/middleware/registry/middleware.go b/registry/middleware/registry/middleware.go
index 7535c6db..3e6e5cc7 100644
--- a/registry/middleware/registry/middleware.go
+++ b/registry/middleware/registry/middleware.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/docker/distribution"
 	"github.com/docker/distribution/context"
+	"github.com/docker/distribution/registry/storage"
 )
 
 // InitFunc is the type of a RegistryMiddleware factory function and is
@@ -12,6 +13,7 @@ import (
 type InitFunc func(ctx context.Context, registry distribution.Namespace, options map[string]interface{}) (distribution.Namespace, error)
 
 var middlewares map[string]InitFunc
+var registryoptions []storage.RegistryOption
 
 // Register is used to register an InitFunc for
 // a RegistryMiddleware backend with the given name.
@@ -38,3 +40,15 @@ func Get(ctx context.Context, name string, options map[string]interface{}, regis
 
 	return nil, fmt.Errorf("no registry middleware registered with name: %s", name)
 }
+
+// RegisterOptions adds more options to RegistryOption list. Options get applied before
+// any other configuration-based options.
+func RegisterOptions(options ...storage.RegistryOption) error {
+	registryoptions = append(registryoptions, options...)
+	return nil
+}
+
+// GetRegistryOptions returns list of RegistryOption.
+func GetRegistryOptions() []storage.RegistryOption {
+	return registryoptions
+}
diff --git a/registry/storage/registry.go b/registry/storage/registry.go
index a1128b4a..3fe4ac68 100644
--- a/registry/storage/registry.go
+++ b/registry/storage/registry.go
@@ -12,14 +12,15 @@ import (
 // registry is the top-level implementation of Registry for use in the storage
 // package. All instances should descend from this object.
 type registry struct {
-	blobStore                   *blobStore
-	blobServer                  *blobServer
-	statter                     *blobStatter // global statter service.
-	blobDescriptorCacheProvider cache.BlobDescriptorCacheProvider
-	deleteEnabled               bool
-	resumableDigestEnabled      bool
-	schema1SignaturesEnabled    bool
-	schema1SigningKey           libtrust.PrivateKey
+	blobStore                    *blobStore
+	blobServer                   *blobServer
+	statter                      *blobStatter // global statter service.
+	blobDescriptorCacheProvider  cache.BlobDescriptorCacheProvider
+	deleteEnabled                bool
+	resumableDigestEnabled       bool
+	schema1SignaturesEnabled     bool
+	schema1SigningKey            libtrust.PrivateKey
+	blobDescriptorServiceFactory distribution.BlobDescriptorServiceFactory
 }
 
 // RegistryOption is the type used for functional options for NewRegistry.
@@ -64,6 +65,15 @@ func Schema1SigningKey(key libtrust.PrivateKey) RegistryOption {
 	}
 }
 
+// BlobDescriptorServiceFactory returns a functional option for NewRegistry. It sets the
+// factory to create BlobDescriptorServiceFactory middleware.
+func BlobDescriptorServiceFactory(factory distribution.BlobDescriptorServiceFactory) RegistryOption {
+	return func(registry *registry) error {
+		registry.blobDescriptorServiceFactory = factory
+		return nil
+	}
+}
+
 // BlobDescriptorCacheProvider returns a functional option for
 // NewRegistry. It creates a cached blob statter for use by the
 // registry.
@@ -190,16 +200,22 @@ func (repo *repository) Manifests(ctx context.Context, options ...distribution.M
 
 	manifestDirectoryPathSpec := manifestRevisionsPathSpec{name: repo.name.Name()}
 
+	var statter distribution.BlobDescriptorService = &linkedBlobStatter{
+		blobStore:   repo.blobStore,
+		repository:  repo,
+		linkPathFns: manifestLinkPathFns,
+	}
+
+	if repo.registry.blobDescriptorServiceFactory != nil {
+		statter = repo.registry.blobDescriptorServiceFactory.BlobAccessController(statter)
+	}
+
 	blobStore := &linkedBlobStore{
-		ctx:           ctx,
-		blobStore:     repo.blobStore,
-		repository:    repo,
-		deleteEnabled: repo.registry.deleteEnabled,
-		blobAccessController: &linkedBlobStatter{
-			blobStore:   repo.blobStore,
-			repository:  repo,
-			linkPathFns: manifestLinkPathFns,
-		},
+		ctx:                  ctx,
+		blobStore:            repo.blobStore,
+		repository:           repo,
+		deleteEnabled:        repo.registry.deleteEnabled,
+		blobAccessController: statter,
 
 		// TODO(stevvooe): linkPath limits this blob store to only
 		// manifests. This instance cannot be used for blob checks.
@@ -258,6 +274,10 @@ func (repo *repository) Blobs(ctx context.Context) distribution.BlobStore {
 		statter = cache.NewCachedBlobStatter(repo.descriptorCache, statter)
 	}
 
+	if repo.registry.blobDescriptorServiceFactory != nil {
+		statter = repo.registry.blobDescriptorServiceFactory.BlobAccessController(statter)
+	}
+
 	return &linkedBlobStore{
 		registry:             repo.registry,
 		blobStore:            repo.blobStore,