--- a/doc/hgrc.5.txt
+++ b/doc/hgrc.5.txt
@@ -452,6 +452,9 @@ ui::
     Reduce the amount of output printed.  True or False.  Default is False.
   remotecmd;;
     remote command to use for clone/push/pull operations. Default is 'hg'.
+  report_untrusted;;
+    Warn if a .hg/hgrc file is ignored due to not being owned by a
+    trusted user or group.  True or False.  Default is True.
   slash;;
     Display paths using a slash ("/") as the path separator.  This only
     makes a difference on systems where the default path separator is not

--- a/mercurial/cmdutil.py
+++ b/mercurial/cmdutil.py
@@ -275,7 +275,13 @@ def dispatch(ui, args, argv0=None):
     # remember how to call 'hg' before changing the working dir
     util.set_hgexecutable(argv0)
 
-    # check for cwd first
+    # read --config before doing anything else
+    # (e.g. to change trust settings for reading .hg/hgrc)
+    config = earlygetopt(['--config'], args)
+    if config:
+        ui.updateopts(config=parseconfig(config))
+
+    # check for cwd
     cwd = earlygetopt(['--cwd'], args)
     if cwd:
         os.chdir(cwd[-1])
@@ -325,8 +331,7 @@ def dispatch(ui, args, argv0=None):
         atexit.register(print_time)
 
     ui.updateopts(options["verbose"], options["debug"], options["quiet"],
-                 not options["noninteractive"], options["traceback"],
-                 parseconfig(options["config"]))
+                 not options["noninteractive"], options["traceback"])
 
     if options['help']:
         return commands.help_(ui, cmd, options['version'])

--- a/mercurial/ui.py
+++ b/mercurial/ui.py
@@ -199,13 +199,15 @@ class ui(object):
                     if path and "://" not in path and not os.path.isabs(path):
                         cdata.set("paths", n, os.path.join(root, path))
 
-        # update quiet/verbose/debug and interactive status
+        # update verbosity/interactive/report_untrusted settings
         if section is None or section == 'ui':
             if name is None or name in ('quiet', 'verbose', 'debug'):
                 self.verbosity_constraints()
-
             if name is None or name == 'interactive':
                 self.interactive = self.configbool("ui", "interactive", True)
+            if name is None or name == 'report_untrusted':
+                self.report_untrusted = (
+                    self.configbool("ui", "report_untrusted", True))
 
         # update trust information
         if (section is None or section == 'trusted') and self.trusted_users: