diff --git a/nixos/modules/services/web-apps/mattermost.nix b/nixos/modules/services/web-apps/mattermost.nix
index 9b420f8a51fc..e21164e1e74c 100644
--- a/nixos/modules/services/web-apps/mattermost.nix
+++ b/nixos/modules/services/web-apps/mattermost.nix
@@ -202,6 +202,7 @@ let
       ListenAddress = "${cfg.host}:${toString cfg.port}";
       LocalModeSocketLocation = cfg.socket.path;
       EnableLocalMode = cfg.socket.enable;
+      EnableSecurityFixAlert = cfg.telemetry.enableSecurityAlerts;
     };
     TeamSettings.SiteName = cfg.siteName;
     SqlSettings.DriverName = cfg.database.driver;
@@ -233,7 +234,13 @@ let
     FileSettings.Directory = cfg.dataDir;
     PluginSettings.Directory = "${pluginDir}/server";
     PluginSettings.ClientDirectory = "${pluginDir}/client";
-    LogSettings.FileLocation = cfg.logDir;
+    LogSettings = {
+      FileLocation = cfg.logDir;
+
+      # Reaches out to Mattermost's servers for telemetry; disable it by default.
+      # https://docs.mattermost.com/configure/environment-configuration-settings.html#enable-diagnostics-and-error-reporting
+      EnableDiagnostics = cfg.telemetry.enableDiagnostics;
+    };
   } cfg.settings;
 
   mattermostConf = recursiveUpdate mattermostConfWithoutPlugins (
@@ -474,6 +481,26 @@ in
         '';
       };
 
+      telemetry = {
+        enableSecurityAlerts = mkOption {
+          type = types.bool;
+          default = true;
+          description = ''
+            True if we should enable security update checking. This reaches out to Mattermost's servers:
+            https://docs.mattermost.com/manage/telemetry.html#security-update-check-feature
+          '';
+        };
+
+        enableDiagnostics = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            True if we should enable sending diagnostic data. This reaches out to Mattermost's servers:
+            https://docs.mattermost.com/manage/telemetry.html#error-and-diagnostics-reporting-feature
+          '';
+        };
+      };
+
       environment = mkOption {
         type = with types; attrsOf (either int str);
         default = { };
diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index 99ad4b110118..02f5e8ce247b 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -48,6 +48,7 @@ import ../make-test-python.nix (
               database = {
                 peerAuth = lib.mkDefault true;
               };
+              telemetry.enableSecurityAlerts = false;
               settings = {
                 SupportSettings.AboutLink = "https://nixos.org";
                 PluginSettings.AutomaticPrepackagedPlugins = false;