diff --git a/pkg/probod/auth_config.go b/pkg/probod/auth_config.go
index 581d0ddb4..b00b8b1f3 100644
--- a/pkg/probod/auth_config.go
+++ b/pkg/probod/auth_config.go
@@ -21,8 +21,9 @@ import (
 
 type (
 	authConfig struct {
-		Cookie   cookieConfig   `json:"cookie"`
-		Password passwordConfig `json:"password"`
+		Cookie        cookieConfig   `json:"cookie"`
+		Password      passwordConfig `json:"password"`
+		DisableSignup bool           `json:"disable-signup"`
 	}
 
 	cookieConfig struct {
diff --git a/pkg/probod/probod.go b/pkg/probod/probod.go
index 20a66c557..0b17bb2fb 100644
--- a/pkg/probod/probod.go
+++ b/pkg/probod/probod.go
@@ -87,6 +87,7 @@ func New() *Implm {
 					Duration: 24,
 					Domain:   "localhost",
 				},
+				DisableSignup: false,
 			},
 			AWS: awsConfig{
 				Region: "us-east-1",
@@ -172,6 +173,7 @@ func (impl *Implm) Run(
 		hp,
 		impl.cfg.Auth.Cookie.Secret,
 		impl.cfg.Hostname,
+		impl.cfg.Auth.DisableSignup,
 	)
 	if err != nil {
 		return fmt.Errorf("cannot create usrmgr service: %w", err)
diff --git a/pkg/server/api/console/v1/sign_up_handler.go b/pkg/server/api/console/v1/sign_up_handler.go
index 690b65eaa..b7069bd6b 100644
--- a/pkg/server/api/console/v1/sign_up_handler.go
+++ b/pkg/server/api/console/v1/sign_up_handler.go
@@ -59,6 +59,12 @@ func SignUpHandler(usrmgrSvc *usrmgr.Service, authCfg AuthConfig) http.HandlerFu
 				return
 			}
 
+			var errSignupDisabled *usrmgr.ErrSignupDisabled
+			if errors.As(err, &errSignupDisabled) {
+				httpserver.RenderError(w, http.StatusBadRequest, fmt.Errorf("cannot register user: %w", err))
+				return
+			}
+
 			panic(fmt.Errorf("cannot register user: %w", err))
 		}
 
diff --git a/pkg/usrmgr/usrmgr.go b/pkg/usrmgr/usrmgr.go
index bd9acca09..634b1aaa5 100644
--- a/pkg/usrmgr/usrmgr.go
+++ b/pkg/usrmgr/usrmgr.go
@@ -32,10 +32,11 @@ import (
 
 type (
 	Service struct {
-		pg          *pg.Client
-		hp          *passwdhash.Profile
-		hostname    string
-		tokenSecret string
+		pg            *pg.Client
+		hp            *passwdhash.Profile
+		hostname      string
+		tokenSecret   string
+		disableSignup bool
 	}
 
 	ErrInvalidCredentials struct {
@@ -70,6 +71,8 @@ type (
 		message string
 	}
 
+	ErrSignupDisabled struct{}
+
 	EmailConfirmationData struct {
 		UserID gid.GID `json:"uid"`
 		Email  string  `json:"email"`
@@ -138,18 +141,24 @@ func (e ErrInvalidTokenType) Error() string {
 	return e.message
 }
 
+func (e ErrSignupDisabled) Error() string {
+	return "signup is disabled, contact the owner of the Probo instance"
+}
+
 func NewService(
 	ctx context.Context,
 	pgClient *pg.Client,
 	hp *passwdhash.Profile,
 	tokenSecret string,
 	hostname string,
+	disableSignup bool,
 ) (*Service, error) {
 	return &Service{
-		pg:          pgClient,
-		hp:          hp,
-		hostname:    hostname,
-		tokenSecret: tokenSecret,
+		pg:            pgClient,
+		hp:            hp,
+		hostname:      hostname,
+		tokenSecret:   tokenSecret,
+		disableSignup: disableSignup,
 	}, nil
 }
 
@@ -157,6 +166,10 @@ func (s Service) SignUp(
 	ctx context.Context,
 	email, password, fullName string,
 ) (*coredata.User, *coredata.Session, error) {
+	if s.disableSignup {
+		return nil, nil, &ErrSignupDisabled{}
+	}
+
 	if !strings.Contains(email, "@") {
 		return nil, nil, &ErrInvalidEmail{email}
 	}