diff --git a/public/docs-static/files/io.netbird.client.plist b/public/docs-static/files/io.netbird.client.plist
index f42b6b3d..ed87c71d 100644
--- a/public/docs-static/files/io.netbird.client.plist
+++ b/public/docs-static/files/io.netbird.client.plist
@@ -66,6 +66,9 @@
     <key>disableAutoConnect</key>
     <false/>
 
+    <key>disableAutostart</key>
+    <false/>
+
     <key>disableClientRoutes</key>
     <false/>
 
diff --git a/public/docs-static/files/netbird-macos.mobileconfig b/public/docs-static/files/netbird-macos.mobileconfig
index 53453db5..d5b54e73 100644
--- a/public/docs-static/files/netbird-macos.mobileconfig
+++ b/public/docs-static/files/netbird-macos.mobileconfig
@@ -103,6 +103,8 @@
                                 <!--
                                 <key>disableAutoConnect</key>
                                 <false/>
+                                <key>disableAutostart</key>
+                                <false/>
                                 <key>disableClientRoutes</key>
                                 <false/>
                                 <key>disableServerRoutes</key>
diff --git a/public/docs-static/files/netbird-macos.sh b/public/docs-static/files/netbird-macos.sh
index c36c409e..d22ea45f 100644
--- a/public/docs-static/files/netbird-macos.sh
+++ b/public/docs-static/files/netbird-macos.sh
@@ -58,6 +58,7 @@ preSharedKey="$NULL"                       # secret; redacted in log
 allowServerSSH='true'
 blockInbound="$NULL"
 disableAutoConnect="$NULL"
+disableAutostart="$NULL"
 disableClientRoutes="$NULL"
 disableServerRoutes="$NULL"
 disableMetricsCollection="$NULL"
@@ -167,6 +168,7 @@ main() {
   is_set "$allowServerSSH"            && emit_bool    allowServerSSH            "$allowServerSSH"
   is_set "$blockInbound"              && emit_bool    blockInbound              "$blockInbound"
   is_set "$disableAutoConnect"        && emit_bool    disableAutoConnect        "$disableAutoConnect"
+  is_set "$disableAutostart"          && emit_bool    disableAutostart          "$disableAutostart"
   is_set "$disableClientRoutes"       && emit_bool    disableClientRoutes       "$disableClientRoutes"
   is_set "$disableServerRoutes"       && emit_bool    disableServerRoutes       "$disableServerRoutes"
   is_set "$disableMetricsCollection"  && emit_bool    disableMetricsCollection  "$disableMetricsCollection"
diff --git a/public/docs-static/files/netbird-policy.reg b/public/docs-static/files/netbird-policy.reg
index ba4402e5..074e42d4 100644
Binary files a/public/docs-static/files/netbird-policy.reg and b/public/docs-static/files/netbird-policy.reg differ
diff --git a/public/docs-static/files/netbird.adml b/public/docs-static/files/netbird.adml
index d49b0502..8a62ff04 100644
--- a/public/docs-static/files/netbird.adml
+++ b/public/docs-static/files/netbird.adml
@@ -24,6 +24,9 @@
       <string id="DisableAutoConnect_Name">Disable auto-connect</string>
       <string id="DisableAutoConnect_Help">When enabled, the NetBird tunnel does not auto-connect at daemon startup. Equivalent to --disable-auto-connect.</string>
 
+      <string id="DisableAutostart_Name">Disable autostart</string>
+      <string id="DisableAutostart_Help">When enabled, the NetBird GUI is prevented from registering itself as an OS autostart entry on fresh installs, and any existing OS autostart entry registration is removed on the next GUI launch (Windows Registry Run key, macOS Login Item, Linux .desktop). Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings.</string>
+
       <string id="DisableClientRoutes_Name">Disable client routes</string>
       <string id="DisableClientRoutes_Help">When enabled, this client will not consume routes advertised by routing peers. Equivalent to --disable-client-routes.</string>
 
diff --git a/public/docs-static/files/netbird.admx b/public/docs-static/files/netbird.admx
index 2f7645d6..ddeacc17 100644
--- a/public/docs-static/files/netbird.admx
+++ b/public/docs-static/files/netbird.admx
@@ -64,6 +64,18 @@
       <disabledValue><decimal value="0" /></disabledValue>
     </policy>
 
+    <policy name="DisableAutostart"
+            class="Machine"
+            displayName="$(string.DisableAutostart_Name)"
+            explainText="$(string.DisableAutostart_Help)"
+            key="Software\Policies\NetBird"
+            valueName="DisableAutostart">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <enabledValue><decimal value="1" /></enabledValue>
+      <disabledValue><decimal value="0" /></disabledValue>
+    </policy>
+
     <policy name="DisableClientRoutes"
             class="Machine"
             displayName="$(string.DisableClientRoutes_Name)"
diff --git a/src/pages/client/mdm-integration.mdx b/src/pages/client/mdm-integration.mdx
index 7d1976c4..2173fc4b 100644
--- a/src/pages/client/mdm-integration.mdx
+++ b/src/pages/client/mdm-integration.mdx
@@ -71,6 +71,7 @@ PascalCase variant in the Group Policy Editor — both are recognized.
 | `wireguardPort` | integer | UDP port the local WireGuard interface binds to. Range `1–65535`. |
 | `allowServerSSH` | boolean | Allow the embedded NetBird SSH server on this peer. |
 | `disableAutoConnect` | boolean | Skip auto-connecting on startup; require an explicit `netbird up`. |
+| `disableAutostart` | boolean | Prevent the GUI from registering itself as an OS autostart entry on fresh installs, and — when enabled at any later point — remove an existing registration on the next GUI launch (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`). Desktop GUIs only; no-op on iOS/Android. Once the admin lifts the policy, the setting stays off until the user re-enables it in Settings. |
 | `rosenpassEnabled` | boolean | Turn on the post-quantum Rosenpass key exchange. |
 | `rosenpassPermissive` | boolean | Permissive mode for Rosenpass (interop with non-Rosenpass peers). |
 | `blockInbound` | boolean | Drop all inbound traffic except established/related — kill-switch style. |
@@ -96,6 +97,11 @@ PascalCase variant in the Group Policy Editor — both are recognized.
   `VpnService.Builder.addAllowedApplication()` flow; on Windows and
   macOS the daemon parses the keys but ignores them. They are safe to
   ship in a cross-platform payload.
+- `disableAutostart` only affects the desktop GUI's OS autostart entry
+  (Windows Registry `Run` key, macOS Login Item, Linux `.desktop`).
+  iOS and Android have no equivalent user-space autostart mechanism —
+  the daemon runs as a system service — so the key is parsed and
+  ignored there. Safe to ship in cross-platform payloads.
 - The `disableMetricsCollection` key is reserved for an upcoming
   metrics integration; the client recognizes it today but no metrics
   pipeline is shipped yet.