diff --git a/cmd/notary-server/main.go b/cmd/notary-server/main.go
index 109956b347..8d028e7481 100644
--- a/cmd/notary-server/main.go
+++ b/cmd/notary-server/main.go
@@ -31,12 +31,15 @@ import (
 // DebugAddress is the debug server address to listen on
 const DebugAddress = "localhost:8080"
 
-var debug bool
-var configFile string
+var (
+	debug      bool
+	configFile string
+	mainViper  = viper.New()
+)
 
 func init() {
 	// set default log level to Error
-	viper.SetDefault("logging", map[string]interface{}{"level": 2})
+	mainViper.SetDefault("logging", map[string]interface{}{"level": 2})
 
 	// Setup flags
 	flag.StringVar(&configFile, "config", "", "Path to configuration file")
@@ -60,22 +63,22 @@ func main() {
 	ext := filepath.Ext(configFile)
 	configPath := filepath.Dir(configFile)
 
-	viper.SetConfigType(strings.TrimPrefix(ext, "."))
-	viper.SetConfigName(strings.TrimSuffix(filename, ext))
-	viper.AddConfigPath(configPath)
+	mainViper.SetConfigType(strings.TrimPrefix(ext, "."))
+	mainViper.SetConfigName(strings.TrimSuffix(filename, ext))
+	mainViper.AddConfigPath(configPath)
 
 	// Automatically accept configuration options from the environment
-	viper.SetEnvPrefix("NOTARY_SERVER")
-	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
-	viper.AutomaticEnv()
+	mainViper.SetEnvPrefix("NOTARY_SERVER")
+	mainViper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	mainViper.AutomaticEnv()
 
-	err := viper.ReadInConfig()
+	err := mainViper.ReadInConfig()
 	if err != nil {
 		logrus.Error("Viper Error: ", err.Error())
 		logrus.Error("Could not read config at ", configFile)
 		os.Exit(1)
 	}
-	lvl, err := logrus.ParseLevel(viper.GetString("logging.level"))
+	lvl, err := logrus.ParseLevel(mainViper.GetString("logging.level"))
 	if err != nil {
 		lvl = logrus.ErrorLevel
 		logrus.Error("Could not parse log level from config. Defaulting to ErrorLevel")
@@ -83,10 +86,10 @@ func main() {
 	logrus.SetLevel(lvl)
 
 	// set up bugsnag and attach to logrus
-	bugs := viper.GetString("reporting.bugsnag")
+	bugs := mainViper.GetString("reporting.bugsnag")
 	if bugs != "" {
-		apiKey := viper.GetString("reporting.bugsnag_api_key")
-		releaseStage := viper.GetString("reporting.bugsnag_release_stage")
+		apiKey := mainViper.GetString("reporting.bugsnag_api_key")
+		releaseStage := mainViper.GetString("reporting.bugsnag_release_stage")
 		bugsnag.Configure(bugsnag.Configuration{
 			APIKey:       apiKey,
 			ReleaseStage: releaseStage,
@@ -98,7 +101,7 @@ func main() {
 			logrus.AddHook(hook)
 		}
 	}
-	keyAlgo := viper.GetString("trust_service.key_algorithm")
+	keyAlgo := mainViper.GetString("trust_service.key_algorithm")
 	if keyAlgo == "" {
 		logrus.Fatal("no key algorithm configured.")
 		os.Exit(1)
@@ -106,12 +109,12 @@ func main() {
 	ctx = context.WithValue(ctx, "keyAlgorithm", keyAlgo)
 
 	var trust signed.CryptoService
-	if viper.GetString("trust_service.type") == "remote" {
+	if mainViper.GetString("trust_service.type") == "remote" {
 		logrus.Info("Using remote signing service")
 		notarySigner := signer.NewNotarySigner(
-			viper.GetString("trust_service.hostname"),
-			viper.GetString("trust_service.port"),
-			viper.GetString("trust_service.tls_ca_file"),
+			mainViper.GetString("trust_service.hostname"),
+			mainViper.GetString("trust_service.port"),
+			mainViper.GetString("trust_service.tls_ca_file"),
 		)
 		trust = notarySigner
 		minute := 1 * time.Minute
@@ -133,9 +136,9 @@ func main() {
 		trust = signed.NewEd25519()
 	}
 
-	if viper.GetString("storage.backend") == "mysql" {
+	if mainViper.GetString("storage.backend") == "mysql" {
 		logrus.Info("Using mysql backend")
-		dbURL := viper.GetString("storage.db_url")
+		dbURL := mainViper.GetString("storage.db_url")
 		store, err := storage.NewSQLStorage("mysql", dbURL)
 		if err != nil {
 			logrus.Fatal("Error starting DB driver: ", err.Error())
@@ -151,12 +154,12 @@ func main() {
 	logrus.Info("Starting Server")
 	err = server.Run(
 		ctx,
-		viper.GetString("server.addr"),
-		viper.GetString("server.tls_cert_file"),
-		viper.GetString("server.tls_key_file"),
+		mainViper.GetString("server.addr"),
+		mainViper.GetString("server.tls_cert_file"),
+		mainViper.GetString("server.tls_key_file"),
 		trust,
-		viper.GetString("auth.type"),
-		viper.Get("auth.options"),
+		mainViper.GetString("auth.type"),
+		mainViper.Get("auth.options"),
 	)
 
 	logrus.Error(err.Error())
diff --git a/cmd/notary-signer/main.go b/cmd/notary-signer/main.go
index e28c72ad96..83dc413c2b 100644
--- a/cmd/notary-signer/main.go
+++ b/cmd/notary-signer/main.go
@@ -26,10 +26,10 @@ import (
 	"github.com/endophage/gotuf/data"
 	_ "github.com/go-sql-driver/mysql"
 	"github.com/miekg/pkcs11"
+	"github.com/spf13/viper"
 
 	"github.com/Sirupsen/logrus"
 	pb "github.com/docker/notary/proto"
-	"github.com/spf13/viper"
 )
 
 const (
@@ -40,16 +40,19 @@ const (
 	pinCode         = "PIN"
 )
 
-var debug bool
-var configFile string
+var (
+	debug      bool
+	configFile string
+	mainViper  = viper.New()
+)
 
 func init() {
 	// set default log level to Error
-	viper.SetDefault("logging", map[string]interface{}{"level": 2})
+	mainViper.SetDefault("logging", map[string]interface{}{"level": 2})
 
-	viper.SetEnvPrefix(envPrefix)
-	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
-	viper.AutomaticEnv()
+	mainViper.SetEnvPrefix(envPrefix)
+	mainViper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
+	mainViper.AutomaticEnv()
 
 	// Setup flags
 	flag.StringVar(&configFile, "config", "", "Path to configuration file")
@@ -57,7 +60,7 @@ func init() {
 }
 
 func passphraseRetriever(keyName, alias string, createNew bool, attempts int) (passphrase string, giveup bool, err error) {
-	passphrase = viper.GetString(strings.ToUpper(alias))
+	passphrase = mainViper.GetString(strings.ToUpper(alias))
 
 	if passphrase == "" {
 		return "", false, errors.New("expected env variable to not be empty: " + alias)
@@ -81,20 +84,20 @@ func main() {
 	ext := filepath.Ext(configFile)
 	configPath := filepath.Dir(configFile)
 
-	viper.SetConfigType(strings.TrimPrefix(ext, "."))
-	viper.SetConfigName(strings.TrimSuffix(filename, ext))
-	viper.AddConfigPath(configPath)
-	err := viper.ReadInConfig()
+	mainViper.SetConfigType(strings.TrimPrefix(ext, "."))
+	mainViper.SetConfigName(strings.TrimSuffix(filename, ext))
+	mainViper.AddConfigPath(configPath)
+	err := mainViper.ReadInConfig()
 	if err != nil {
 		logrus.Error("Viper Error: ", err.Error())
 		logrus.Error("Could not read config at ", configFile)
 		os.Exit(1)
 	}
 
-	logrus.SetLevel(logrus.Level(viper.GetInt("logging.level")))
+	logrus.SetLevel(logrus.Level(mainViper.GetInt("logging.level")))
 
-	certFile := viper.GetString("server.cert_file")
-	keyFile := viper.GetString("server.key_file")
+	certFile := mainViper.GetString("server.cert_file")
+	keyFile := mainViper.GetString("server.key_file")
 	if certFile == "" || keyFile == "" {
 		usage()
 		log.Fatalf("Certificate and key are mandatory")
@@ -117,8 +120,8 @@ func main() {
 
 	cryptoServices := make(signer.CryptoServiceIndex)
 
-	pin := viper.GetString(pinCode)
-	pkcs11Lib := viper.GetString("crypto.pkcs11lib")
+	pin := mainViper.GetString(pinCode)
+	pkcs11Lib := mainViper.GetString("crypto.pkcs11lib")
 	if pkcs11Lib != "" {
 		if pin == "" {
 			log.Fatalf("Using PIN is mandatory with pkcs11")
@@ -131,8 +134,8 @@ func main() {
 		cryptoServices[data.RSAKey] = api.NewRSAHardwareCryptoService(ctx, session)
 	}
 
-	configDBType := strings.ToLower(viper.GetString("storage.backend"))
-	dbURL := viper.GetString("storage.db_url")
+	configDBType := strings.ToLower(mainViper.GetString("storage.backend"))
+	dbURL := mainViper.GetString("storage.db_url")
 	if configDBType != dbType || dbURL == "" {
 		usage()
 		log.Fatalf("Currently only a MySQL database backend is supported.")
@@ -142,7 +145,7 @@ func main() {
 		log.Fatalf("failed to open the database: %s, %v", dbURL, err)
 	}
 
-	defaultAlias := viper.GetString(defaultAliasEnv)
+	defaultAlias := mainViper.GetString(defaultAliasEnv)
 	logrus.Debug("Default Alias: ", defaultAlias)
 	keyStore, err := signer.NewKeyDBStore(passphraseRetriever, defaultAlias, configDBType, dbSQL)
 	if err != nil {
@@ -163,7 +166,7 @@ func main() {
 	ss := &api.SignerServer{CryptoServices: cryptoServices,
 		HealthChecker: health.CheckStatus}
 
-	rpcAddr := viper.GetString("server.grpc_addr")
+	rpcAddr := mainViper.GetString("server.grpc_addr")
 	lis, err := net.Listen("tcp", rpcAddr)
 	if err != nil {
 		log.Fatalf("failed to listen %v", err)
@@ -180,7 +183,7 @@ func main() {
 
 	go grpcServer.Serve(lis)
 
-	httpAddr := viper.GetString("server.http_addr")
+	httpAddr := mainViper.GetString("server.http_addr")
 	if httpAddr == "" {
 		log.Fatalf("Server address is required")
 	}
diff --git a/cmd/notary/main.go b/cmd/notary/main.go
index a19440d7c4..4311f7d9a4 100644
--- a/cmd/notary/main.go
+++ b/cmd/notary/main.go
@@ -30,6 +30,7 @@ var (
 	configFileName    = "config"
 	configFileExt     = "json"
 	retriever         passphrase.Retriever
+	mainViper         = viper.New()
 )
 
 func init() {
@@ -69,12 +70,12 @@ func parseConfig() {
 	}
 
 	// Setup the configuration details into viper
-	viper.SetConfigName(configFileName)
-	viper.SetConfigType(configFileExt)
-	viper.AddConfigPath(configPath)
+	mainViper.SetConfigName(configFileName)
+	mainViper.SetConfigType(configFileExt)
+	mainViper.AddConfigPath(configPath)
 
 	// Find and read the config file
-	err := viper.ReadInConfig()
+	err := mainViper.ReadInConfig()
 	if err != nil {
 		logrus.Debugf("configuration file not found, using defaults")
 		// Ignore if the configuration file doesn't exist, we can use the defaults
diff --git a/cmd/notary/tuf.go b/cmd/notary/tuf.go
index 6e61d77e81..40f5191ca5 100644
--- a/cmd/notary/tuf.go
+++ b/cmd/notary/tuf.go
@@ -24,7 +24,6 @@ import (
 	notaryclient "github.com/docker/notary/client"
 	"github.com/docker/notary/trustmanager"
 	"github.com/spf13/cobra"
-	"github.com/spf13/viper"
 )
 
 var cmdTufList = &cobra.Command{
@@ -362,7 +361,7 @@ func (ps passwordStore) Basic(u *url.URL) (string, string) {
 func getTransport(gun string, readOnly bool) http.RoundTripper {
 	// Attempt to get a root CA from the config file. Nil is the host defaults.
 	rootPool := x509.NewCertPool()
-	rootCAFile := viper.GetString("remote_server.root_ca")
+	rootCAFile := mainViper.GetString("remote_server.root_ca")
 	if rootCAFile != "" {
 		// If we haven't been given an Absolute path, we assume it's relative
 		// from the configuration directory (~/.notary by default)
@@ -379,7 +378,7 @@ func getTransport(gun string, readOnly bool) http.RoundTripper {
 	// skipTLSVerify is false by default so verification will
 	// be performed.
 	tlsConfig := &tls.Config{
-		InsecureSkipVerify: viper.GetBool("remote_server.skipTLSVerify"),
+		InsecureSkipVerify: mainViper.GetBool("remote_server.skipTLSVerify"),
 		MinVersion:         tls.VersionTLS10,
 		RootCAs:            rootPool,
 	}
@@ -443,7 +442,7 @@ func tokenAuth(baseTransport *http.Transport, gun string, readOnly bool) http.Ro
 
 func getRemoteTrustServer() string {
 	if remoteTrustServer == "" {
-		configRemote := viper.GetString("remote_server.url")
+		configRemote := mainViper.GetString("remote_server.url")
 		if configRemote != "" {
 			remoteTrustServer = configRemote
 		} else {