diff --git a/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xrootd-cta.cfg b/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xrootd-cta.cfg
index abdeb293c96af4721cabaab37f03b36eb1f37fad..99448de17d5c3c3418df33df2522e8e66d5a177d 100644
--- a/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xrootd-cta.cfg
+++ b/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xrootd-cta.cfg
@@ -1,5 +1,20 @@
-# Load the plugin XrdCtaOfs
-xrootd.fslib libXrdCtaOfs.so
+# Load the CTA SSI and OFS plugins
+xrootd.fslib libXrdSsi.so libXrdCtaOfs.so
+
+# Specify which paths should be routed to the OFS plugin
+#
+# The "old" cta command will continue to use OFS. The "new" eoscta_stub and
+# cta_admin binaries use SSI.
+#
+# Y3Rh is the Base64 encoding of cta, so this string appears at the beginning
+# of all cta admin commands
+ssi.fspath /Y3Rh
+# L3Vzci9iaW4vY3Rh is Base64 encoding of /usr/bin/cta which appears at the
+# beginning of commands called from the EOS WFE bash script
+ssi.fspath /L3Vzci9iaW4vY3Rh
+
+# Load the SSI module
+ssi.svclib libXrdSsiCta.so
 
 # Use the security module
 xrootd.seclib libXrdSec.so
@@ -14,8 +29,16 @@ sec.protocol unix
 #sec.protbind * only sss
 sec.protbind 172.17.0* only unix
 
-# Allow copying from absolute paths
-all.export /
+# Export the SSI resource
+all.export /ctafrontend nolock r/w
+
+# Export the OFS resources, specified in ssi.fspath above.
+#
+# There can be more than one of these; anything that starts with the prefix
+# will go to the the underlying file system. Note that this prefix cannot be
+# a substring of '/ctafrontend', so it is not possible to simply export '/'.
+all.export /Y3Rh
+all.export /L3Vzci9iaW4vY3Rh
 
 # Turn off asynchronous i/o
 xrootd.async off
diff --git a/eos_wfe_scripts/delete_archive_file b/eos_wfe_scripts/delete_archive_file
index b3bee123d4d1b110d856e41879b293d484985550..b4241d83987f81104fe3a578f001cabe89f20916 100755
--- a/eos_wfe_scripts/delete_archive_file
+++ b/eos_wfe_scripts/delete_archive_file
@@ -16,7 +16,7 @@ if test $# -ne 5; then
   exit ${EINVAL}
 fi
 
-CTA_BIN=/usr/bin/cta
+CTA_BIN=/usr/bin/eoscta_stub
 
 WF_TAG="$1"
 RUSERNAME="$2"