diff --git a/roles/matrix-base/defaults/main.yml b/roles/matrix-base/defaults/main.yml
index 8a860b1ea..3a147124e 100644
--- a/roles/matrix-base/defaults/main.yml
+++ b/roles/matrix-base/defaults/main.yml
@@ -56,6 +56,11 @@ matrix_integration_manager_ui_url: ~
 # See: https://github.com/vector-im/riot-web/blob/develop/docs/jitsi.md#configuring-riot-to-use-your-self-hosted-jitsi-server
 matrix_riot_jitsi_preferredDomain: ''
 
+# Controls whether Riot should use End-to-End Encryption by default.
+# Setting this to false will update `/.well-known/matrix/client` and tell Riot clients to avoid E2EE.
+# See: https://github.com/vector-im/riot-web/blob/develop/docs/e2ee.md
+matrix_riot_e2ee_default: true
+
 # The Docker network that all services would be put into
 matrix_docker_network: "matrix"
 
diff --git a/roles/matrix-base/templates/static-files/well-known/matrix-client.j2 b/roles/matrix-base/templates/static-files/well-known/matrix-client.j2
index edbaa62eb..a4c1c4391 100644
--- a/roles/matrix-base/templates/static-files/well-known/matrix-client.j2
+++ b/roles/matrix-base/templates/static-files/well-known/matrix-client.j2
@@ -23,4 +23,9 @@
 		"preferredDomain": {{ matrix_riot_jitsi_preferredDomain|to_json }}
 	}
 	{% endif %}
+	{% if not matrix_riot_e2ee_default %},
+	"im.vector.riot.e2ee": {
+		"default": false
+	}
+	{% endif %}
 }