diff --git a/client/mdm/policy.go b/client/mdm/policy.go
index da3dd0d06..919eae9bc 100644
--- a/client/mdm/policy.go
+++ b/client/mdm/policy.go
@@ -23,6 +23,7 @@ const (
 	KeyDisableAdvancedSettings  = "disableAdvancedSettings"
 	KeyDisableUpdateSettings    = "disableUpdateSettings"
 	KeyDisableProfiles          = "disableProfiles"
+	KeyDisableNetworks          = "disableNetworks"
 	KeyDisableClientRoutes      = "disableClientRoutes"
 	KeyDisableServerRoutes      = "disableServerRoutes"
 	KeyBlockInbound             = "blockInbound"
@@ -56,6 +57,7 @@ var AllKeys = []string{
 	KeyDisableAdvancedSettings,
 	KeyDisableUpdateSettings,
 	KeyDisableProfiles,
+	KeyDisableNetworks,
 	KeyDisableClientRoutes,
 	KeyDisableServerRoutes,
 	KeyBlockInbound,
diff --git a/client/server/network.go b/client/server/network.go
index 12cefbd9c..7a3c08f2e 100644
--- a/client/server/network.go
+++ b/client/server/network.go
@@ -30,7 +30,7 @@ func (s *Server) ListNetworks(context.Context, *proto.ListNetworksRequest) (*pro
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.networksDisabled {
+	if s.checkNetworksDisabled() {
 		return nil, gstatus.Errorf(codes.Unavailable, errNetworksDisabled)
 	}
 
@@ -143,7 +143,7 @@ func (s *Server) SelectNetworks(_ context.Context, req *proto.SelectNetworksRequ
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.networksDisabled {
+	if s.checkNetworksDisabled() {
 		return nil, gstatus.Errorf(codes.Unavailable, errNetworksDisabled)
 	}
 
@@ -195,7 +195,7 @@ func (s *Server) DeselectNetworks(_ context.Context, req *proto.SelectNetworksRe
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
-	if s.networksDisabled {
+	if s.checkNetworksDisabled() {
 		return nil, gstatus.Errorf(codes.Unavailable, errNetworksDisabled)
 	}
 
diff --git a/client/server/server.go b/client/server/server.go
index e27e0a467..83bf74275 100644
--- a/client/server/server.go
+++ b/client/server/server.go
@@ -1699,7 +1699,7 @@ func (s *Server) GetFeatures(ctx context.Context, msg *proto.GetFeaturesRequest)
 	features := &proto.GetFeaturesResponse{
 		DisableProfiles:       s.checkProfilesDisabled(),
 		DisableUpdateSettings: s.checkUpdateSettingsDisabled(),
-		DisableNetworks:       s.networksDisabled,
+		DisableNetworks:       s.checkNetworksDisabled(),
 	}
 
 	// MDM kill switch: read the value from the active policy on the
@@ -1746,6 +1746,21 @@ func (s *Server) checkProfilesDisabled() bool {
 	return false
 }
 
+func (s *Server) checkNetworksDisabled() bool {
+	// CLI flag set at service install time wins.
+	if s.networksDisabled {
+		return true
+	}
+	// MDM kill switch: either source can disable the feature; neither
+	// can re-enable a switch the other has set.
+	if s.config != nil {
+		if v, ok := s.config.Policy().GetBool(mdm.KeyDisableNetworks); ok && v {
+			return true
+		}
+	}
+	return false
+}
+
 func (s *Server) checkUpdateSettingsDisabled() bool {
 	// CLI flag set at service install time wins.
 	if s.updateSettingsDisabled {