diff --git a/rust/headless-client/src/main.rs b/rust/headless-client/src/main.rs
index b4c41d59e..2e0a5d7d9 100644
--- a/rust/headless-client/src/main.rs
+++ b/rust/headless-client/src/main.rs
@@ -101,6 +101,16 @@ struct Cli {
     #[arg(short = 'i', long, env = "FIREZONE_ID")]
     firezone_id: Option<String>,
 
+    /// Activate the Internet Resource.
+    ///
+    /// To actually use the Internet Resource, the user must also have a policy granting access to the Internet Resource.
+    #[arg(
+        long,
+        env = "FIREZONE_ACTIVATE_INTERNET_RESOURCE",
+        default_value_t = false
+    )]
+    activate_internet_resource: bool,
+
     /// Disable sentry.io crash-reporting agent.
     #[arg(long, env = "FIREZONE_NO_TELEMETRY", default_value_t = false)]
     no_telemetry: bool,
@@ -341,7 +351,7 @@ fn try_main() -> Result<()> {
             Arc::new(tcp_socket_factory),
             Arc::new(UdpSocketFactory::default()),
             portal,
-            false,
+            cli.activate_internet_resource,
             rt.handle().clone(),
         );
 
diff --git a/website/src/components/Changelog/Headless.tsx b/website/src/components/Changelog/Headless.tsx
index 8e73a1b88..c0ac614e9 100644
--- a/website/src/components/Changelog/Headless.tsx
+++ b/website/src/components/Changelog/Headless.tsx
@@ -13,6 +13,10 @@ export default function Headless({ os }: { os: OS }) {
         <ChangeItem pull="10533">
           Improves reliability by caching DNS responses as per their TTL.
         </ChangeItem>
+        <ChangeItem pull="10553">
+          Adds a CLI switch `--activate-internet-resource`. By default, the
+          Internet Resource is now off.
+        </ChangeItem>
       </Unreleased>
       <Entry version="1.5.3" date={new Date("2025-09-10")}>
         <ChangeItem pull="10126">