diff --git a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
index b0f1648d..fec85315 100644
--- a/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
+++ b/spring-ws-security/src/main/java/org/springframework/ws/soap/security/wss4j2/Wss4jSecurityInterceptor.java
@@ -199,6 +199,8 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 
 	private CallbackHandler samlCallbackHandler;
 
+	private CallbackHandler attachmentCallbackHandler;
+
 	// Allow RSA 15 to maintain default behavior
 	private boolean allowRSA15KeyTransportAlgorithm = true;
 
@@ -458,6 +460,15 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 		this.samlCallbackHandler = samlCallbackHandler;
 	}
 
+	/**
+	 * Set the {@link CallbackHandler} to use to sign/encrypt attachments.
+	 * @param attachmentCallbackHandler the attachment callback handler
+	 * @since 4.1.0
+	 */
+	public void setAttachmentCallbackHandler(CallbackHandler attachmentCallbackHandler) {
+		this.attachmentCallbackHandler = attachmentCallbackHandler;
+	}
+
 	/**
 	 * Sets the server-side time to live.
 	 */
@@ -710,6 +721,9 @@ public class Wss4jSecurityInterceptor extends AbstractWsSecurityInterceptor impl
 		if (this.samlCallbackHandler != null) {
 			messageContext.setProperty(WSHandlerConstants.SAML_CALLBACK_REF, this.samlCallbackHandler);
 		}
+		if (this.attachmentCallbackHandler != null) {
+			requestData.setAttachmentCallbackHandler(this.attachmentCallbackHandler);
+		}
 
 		// allow for qualified password types for .Net interoperability
 		requestData.setAllowNamespaceQualifiedPasswordTypes(true);