diff --git a/app.go b/app.go
index cf491630..a67031e8 100644
--- a/app.go
+++ b/app.go
@@ -72,6 +72,7 @@ const (
 type Config struct {
 	ServerURL                      string
 	Addr                           string
+	MetricsEnabled                 bool
 	MetricsAddr                    string
 	GRPCAddr                       string
 	GRPCAllowInsecure              bool
@@ -655,27 +656,29 @@ func (h *Headscale) Serve() error {
 	log.Info().
 		Msgf("listening and serving HTTP on: %s", h.cfg.Addr)
 
-	promRouter := h.createPrometheusRouter()
+	if h.cfg.MetricsEnabled {
+		promRouter := h.createPrometheusRouter()
 
-	promHTTPServer := &http.Server{
-		Addr:         h.cfg.MetricsAddr,
-		Handler:      promRouter,
-		ReadTimeout:  HTTPReadTimeout,
-		WriteTimeout: 0,
+		promHTTPServer := &http.Server{
+			Addr:         h.cfg.MetricsAddr,
+			Handler:      promRouter,
+			ReadTimeout:  HTTPReadTimeout,
+			WriteTimeout: 0,
+		}
+
+		var promHTTPListener net.Listener
+		promHTTPListener, err = net.Listen("tcp", h.cfg.MetricsAddr)
+
+		if err != nil {
+			return fmt.Errorf("failed to bind to TCP address: %w", err)
+		}
+
+		errorGroup.Go(func() error { return promHTTPServer.Serve(promHTTPListener) })
+
+		log.Info().
+			Msgf("listening and serving metrics on: %s", h.cfg.MetricsAddr)
 	}
 
-	var promHTTPListener net.Listener
-	promHTTPListener, err = net.Listen("tcp", h.cfg.MetricsAddr)
-
-	if err != nil {
-		return fmt.Errorf("failed to bind to TCP address: %w", err)
-	}
-
-	errorGroup.Go(func() error { return promHTTPServer.Serve(promHTTPListener) })
-
-	log.Info().
-		Msgf("listening and serving metrics on: %s", h.cfg.MetricsAddr)
-
 	return errorGroup.Wait()
 }
 
diff --git a/cmd/headscale/cli/utils.go b/cmd/headscale/cli/utils.go
index fa4a0b7a..f287cd4a 100644
--- a/cmd/headscale/cli/utils.go
+++ b/cmd/headscale/cli/utils.go
@@ -303,6 +303,7 @@ func getHeadscaleConfig() headscale.Config {
 	return headscale.Config{
 		ServerURL:         viper.GetString("server_url"),
 		Addr:              viper.GetString("listen_addr"),
+		MetricsEnabled:    viper.GetBool("metrics_enabled"),
 		MetricsAddr:       viper.GetString("metrics_listen_addr"),
 		GRPCAddr:          viper.GetString("grpc_listen_addr"),
 		GRPCAllowInsecure: viper.GetBool("grpc_allow_insecure"),
diff --git a/cmd/headscale/headscale_test.go b/cmd/headscale/headscale_test.go
index 551cf056..d75e6e66 100644
--- a/cmd/headscale/headscale_test.go
+++ b/cmd/headscale/headscale_test.go
@@ -56,6 +56,7 @@ func (*Suite) TestConfigLoading(c *check.C) {
 	c.Assert(viper.GetString("server_url"), check.Equals, "http://127.0.0.1:8080")
 	c.Assert(viper.GetString("listen_addr"), check.Equals, "0.0.0.0:8080")
 	c.Assert(viper.GetString("metrics_listen_addr"), check.Equals, "127.0.0.1:9915")
+	c.Assert(viper.GetString("metrics_enabled"), check.Equals, "true")
 	c.Assert(viper.GetString("db_type"), check.Equals, "sqlite3")
 	c.Assert(viper.GetString("db_path"), check.Equals, "/var/lib/headscale/db.sqlite")
 	c.Assert(viper.GetString("tls_letsencrypt_hostname"), check.Equals, "")
diff --git a/config-example.yaml b/config-example.yaml
index 2053e125..8b028dba 100644
--- a/config-example.yaml
+++ b/config-example.yaml
@@ -16,6 +16,9 @@ server_url: http://127.0.0.1:8080
 #
 listen_addr: 0.0.0.0:8080
 
+# Enable Prometheus metrics endpoint
+metrics_enabled: true
+
 # Address to listen to /metrics, you may want
 # to keep this endpoint private to your internal
 # network
diff --git a/docs/examples/kustomize/base/configmap.yaml b/docs/examples/kustomize/base/configmap.yaml
index b60c685f..a8287c64 100644
--- a/docs/examples/kustomize/base/configmap.yaml
+++ b/docs/examples/kustomize/base/configmap.yaml
@@ -5,5 +5,6 @@ metadata:
 data:
   server_url: $(PUBLIC_PROTO)://$(PUBLIC_HOSTNAME)
   listen_addr: "0.0.0.0:8080"
+  metrics_enabled: "true"
   metrics_listen_addr: "127.0.0.1:9915"
   ephemeral_node_inactivity_timeout: "30m"
diff --git a/docs/examples/kustomize/postgres/deployment.yaml b/docs/examples/kustomize/postgres/deployment.yaml
index 1dd88b41..3d380ac6 100644
--- a/docs/examples/kustomize/postgres/deployment.yaml
+++ b/docs/examples/kustomize/postgres/deployment.yaml
@@ -30,6 +30,11 @@ spec:
                 configMapKeyRef:
                   name: headscale-config
                   key: metrics_listen_addr
+            - name: METRICS_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: headscale-config
+                  key: metrics_enabled
             - name: DERP_MAP_PATH
               value: /vol/config/derp.yaml
             - name: EPHEMERAL_NODE_INACTIVITY_TIMEOUT
diff --git a/docs/examples/kustomize/sqlite/statefulset.yaml b/docs/examples/kustomize/sqlite/statefulset.yaml
index 2321d39d..5b3b9089 100644
--- a/docs/examples/kustomize/sqlite/statefulset.yaml
+++ b/docs/examples/kustomize/sqlite/statefulset.yaml
@@ -31,6 +31,11 @@ spec:
                 configMapKeyRef:
                   name: headscale-config
                   key: metrics_listen_addr
+            - name: METRICS_ENABLED
+              valueFrom:
+                configMapKeyRef:
+                  name: headscale-config
+                  key: metrics_enabled
             - name: DERP_MAP_PATH
               value: /vol/config/derp.yaml
             - name: EPHEMERAL_NODE_INACTIVITY_TIMEOUT
diff --git a/integration_test/etc/config.yaml b/integration_test/etc/config.yaml
index 223fab2f..128722f4 100644
--- a/integration_test/etc/config.yaml
+++ b/integration_test/etc/config.yaml
@@ -14,6 +14,7 @@ dns_config:
 db_path: /tmp/integration_test_db.sqlite3
 private_key_path: private.key
 listen_addr: 0.0.0.0:8080
+metrics_enabled: true
 metrics_listen_addr: 127.0.0.1:9915
 server_url: http://headscale:8080