diff --git a/client/server/debug.go b/client/server/debug.go
index f9b6c68f8..966b65e56 100644
--- a/client/server/debug.go
+++ b/client/server/debug.go
@@ -36,7 +36,7 @@ func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRe
 	// socket that carries no identity, which skips the UI log.
 	callerID, callerIdentified := ipcauth.CallerIdentity(callerCtx)
 
-	path, managementURL, publishedUploadURL, err := s.generateDebugBundle(req, uiLogOpener(callerID, callerIdentified))
+	path, managementURL, publishedUploadURL, mdmUploadURL, err := s.generateDebugBundle(req, uiLogOpener(callerID, callerIdentified))
 	if err != nil {
 		return nil, err
 	}
@@ -49,7 +49,10 @@ func (s *Server) DebugBundle(callerCtx context.Context, req *proto.DebugBundleRe
 	// it is the operator of this deployment naming their own upload service, and
 	// the peer already trusts that server for its whole configuration. Only a
 	// URL the local caller named goes through requirePrivilegeForUploadURL above.
-	uploadURL := debug.ResolveUploadURL("", req.GetUploadURL(), publishedUploadURL)
+	if mdmUploadURL != "" && req.GetUploadURL() != "" && mdmUploadURL != req.GetUploadURL() {
+		log.Infof("using the MDM debug bundle upload URL instead of the one the caller named")
+	}
+	uploadURL := debug.ResolveUploadURL(mdmUploadURL, req.GetUploadURL(), publishedUploadURL)
 
 	// The upload runs without s.mutex held: it does network I/O to a possibly
 	// slow destination and must not block the other RPCs that take the lock. The
@@ -83,7 +86,7 @@ func redactUploadURL(raw string) string {
 // the management URL and the upload service the management server publishes,
 // both captured under the lock, so the caller can run the upload without
 // holding the lock.
-func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener debug.LogOpener) (path string, managementURL string, publishedUploadURL string, err error) {
+func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener debug.LogOpener) (path string, managementURL string, publishedUploadURL string, mdmUploadURL string, err error) {
 	s.mutex.Lock()
 	defer s.mutex.Unlock()
 
@@ -152,14 +155,17 @@ func (s *Server) generateDebugBundle(req *proto.DebugBundleRequest, uiOpener deb
 
 	path, err = bundleGenerator.Generate()
 	if err != nil {
-		return "", "", "", fmt.Errorf("generate debug bundle: %w", err)
+		return "", "", "", "", fmt.Errorf("generate debug bundle: %w", err)
 	}
 
-	if s.config != nil && s.config.ManagementURL != nil {
-		managementURL = s.config.ManagementURL.String()
+	if s.config != nil {
+		if s.config.ManagementURL != nil {
+			managementURL = s.config.ManagementURL.String()
+		}
+		mdmUploadURL = s.config.DebugBundleUploadURL
 	}
 
-	return path, managementURL, publishedUploadURL, nil
+	return path, managementURL, publishedUploadURL, mdmUploadURL, nil
 }
 
 // GetLogLevel gets the current logging level for the server.