diff --git a/apis/installer/v1alpha1/ace_ace_types.go b/apis/installer/v1alpha1/ace_ace_types.go
index c3185408b..fe02f9ec2 100644
--- a/apis/installer/v1alpha1/ace_ace_types.go
+++ b/apis/installer/v1alpha1/ace_ace_types.go
@@ -480,8 +480,10 @@ type PlatformSettings struct {
 	ServiceEnableCaptcha         bool    `json:"serviceEnableCaptcha"`
 	ServiceRegisterEmailConfirm  bool    `json:"serviceRegisterEmailConfirm"`
 	ServiceDisableRegistration   bool    `json:"serviceDisableRegistration"`
-	ServiceRequireSignInView     bool    `json:"serviceRequireSignInView"`
-	ServiceEnableNotifyMail      bool    `json:"serviceEnableNotifyMail"`
+	// +optional
+	DisableRegularOrgCreation *bool `json:"disableRegularOrgCreation"`
+	ServiceRequireSignInView  bool  `json:"serviceRequireSignInView"`
+	ServiceEnableNotifyMail   bool  `json:"serviceEnableNotifyMail"`
 	// +optional
 	ServiceDomainWhiteList          []string `json:"serviceDomainWhiteList"`
 	CookieName                      string   `json:"cookieName"`
diff --git a/apis/installer/v1alpha1/zz_generated.deepcopy.go b/apis/installer/v1alpha1/zz_generated.deepcopy.go
index 724f97a1a..4bee2d7d4 100644
--- a/apis/installer/v1alpha1/zz_generated.deepcopy.go
+++ b/apis/installer/v1alpha1/zz_generated.deepcopy.go
@@ -9883,6 +9883,11 @@ func (in *PlatformSettings) DeepCopyInto(out *PlatformSettings) {
 		*out = new(string)
 		**out = **in
 	}
+	if in.DisableRegularOrgCreation != nil {
+		in, out := &in.DisableRegularOrgCreation, &out.DisableRegularOrgCreation
+		*out = new(bool)
+		**out = **in
+	}
 	if in.ServiceDomainWhiteList != nil {
 		in, out := &in.ServiceDomainWhiteList, &out.ServiceDomainWhiteList
 		*out = make([]string, len(*in))
diff --git a/charts/ace/README.md b/charts/ace/README.md
index e1a2bdac4..c055c2ddb 100644
--- a/charts/ace/README.md
+++ b/charts/ace/README.md
@@ -194,6 +194,7 @@ The following table lists the configurable parameters of the `ace` chart and the
 | settings.platform.serviceEnableCaptcha               | # Enable this to use captcha validation for registration. #                                                                                                                                                                                    | <code>true</code>                                                                                                                                                                              |
 | settings.platform.serviceRegisterEmailConfirm        | # Users need to confirm e-mail for registration #                                                                                                                                                                                              | <code>true</code>                                                                                                                                                                              |
 | settings.platform.serviceDisableRegistration         | # Weather or not to allow users to register. #                                                                                                                                                                                                 | <code>false</code>                                                                                                                                                                             |
+| settings.platform.disableRegularOrgCreation          | # Bar regular users from creating organizations. Only seeds the ace-user-config secret; # site admins toggle it at runtime. Null lets the platform decide (on for selfhosted). #                                                               | <code>null</code>                                                                                                                                                                              |
 | settings.platform.serviceRequireSignInView           | # Weather or not sign in is required to view anything. #                                                                                                                                                                                       | <code>false</code>                                                                                                                                                                             |
 | settings.platform.serviceEnableNotifyMail            | # Mail notification #                                                                                                                                                                                                                          | <code>true</code>                                                                                                                                                                              |
 | settings.platform.serviceDomainWhiteList             | # To create an account, email should belong to this domain list #                                                                                                                                                                              | <code>[]</code>                                                                                                                                                                                |
diff --git a/charts/ace/templates/platform/user-config.yaml b/charts/ace/templates/platform/user-config.yaml
index 281ba2c16..7bc79f4b6 100644
--- a/charts/ace/templates/platform/user-config.yaml
+++ b/charts/ace/templates/platform/user-config.yaml
@@ -14,6 +14,11 @@ stringData:
   user.ini: |-
     [service]
     EMAIL_DOMAIN_WHITELIST = {{ join "," .Values.settings.platform.serviceDomainWhiteList }}
+{{- if kindIs "bool" .Values.settings.platform.disableRegularOrgCreation }}
+
+    [admin]
+    DISABLE_REGULAR_ORG_CREATION = {{ .Values.settings.platform.disableRegularOrgCreation }}
+{{- end }}
 
     [branding]
     APP_NAME = {{ .Values.settings.platform.appName }}
diff --git a/charts/ace/values.openapiv3_schema.yaml b/charts/ace/values.openapiv3_schema.yaml
index f948fe3cc..62dc4f035 100644
--- a/charts/ace/values.openapiv3_schema.yaml
+++ b/charts/ace/values.openapiv3_schema.yaml
@@ -24750,6 +24750,8 @@ properties:
             type: string
           disableHttpGit:
             type: boolean
+          disableRegularOrgCreation:
+            type: boolean
           enableCSRFCookieHttpOnly:
             type: boolean
           forcePrivate:
diff --git a/charts/ace/values.yaml b/charts/ace/values.yaml
index de8d3901a..8bbff9e2f 100644
--- a/charts/ace/values.yaml
+++ b/charts/ace/values.yaml
@@ -402,6 +402,11 @@ settings:
     ##
     serviceDisableRegistration: false
 
+    ## Bar regular users from creating organizations. Only seeds the ace-user-config secret;
+    ## site admins toggle it at runtime. Null lets the platform decide (on for selfhosted).
+    ##
+    disableRegularOrgCreation: null
+
     ## Weather or not sign in is required to view anything.
     ##
     serviceRequireSignInView: false