diff --git a/docs/DOCS.md b/docs/DOCS.md
index dab585df..4659e14e 100644
--- a/docs/DOCS.md
+++ b/docs/DOCS.md
@@ -1453,6 +1453,7 @@ Spindle is configured using environment variables. The following environment var
 - `SPINDLE_SERVER_HOSTNAME`: The hostname of the server (required).
 - `SPINDLE_SERVER_JETSTREAM_ENDPOINT`: The endpoint of the Jetstream server (default: `"wss://jetstream1.us-west.bsky.network/subscribe"`).
 - `SPINDLE_SERVER_DEV`: A boolean indicating whether the server is running in development mode (default: `false`).
+- `SPINDLE_SERVER_INVITE_ONLY`: A boolean indicating whether only members of this spindle may register repos. When `false`, the spindle accepts repos from anyone on the network (default: `true`).
 - `SPINDLE_SERVER_LOG_DIR`: The directory to store workflow logs (default: `"/var/log/spindle"`).
 - `SPINDLE_SERVER_DOCKER_SOCKET`: Path to Docker socket to expose to invoked Spindle containers (default: `""`).
 - `SPINDLE_NIXERY_PIPELINES_NIXERY`: The Nixery URL (default: `"nixery.tangled.sh"`).
diff --git a/nix/modules/spindle.nix b/nix/modules/spindle.nix
index 6e56cdbb..04005e52 100644
--- a/nix/modules/spindle.nix
+++ b/nix/modules/spindle.nix
@@ -65,6 +65,12 @@ in
             description = "Enable development mode (disables signature verification)";
           };
 
+          inviteOnly = mkOption {
+            type = types.bool;
+            default = true;
+            description = "Only accept repos from members of this spindle";
+          };
+
           maxJobCount = mkOption {
             type = types.int;
             default = 2;
@@ -350,6 +356,7 @@ in
               "SPINDLE_SERVER_PLC_URL=${cfg.server.plcUrl}"
               "SPINDLE_SERVER_JETSTREAM_ENDPOINT=${cfg.server.jetstreamEndpoint}"
               "SPINDLE_SERVER_DEV=${lib.boolToString cfg.server.dev}"
+              "SPINDLE_SERVER_INVITE_ONLY=${lib.boolToString cfg.server.inviteOnly}"
               "SPINDLE_SERVER_MAX_JOB_COUNT=${toString cfg.server.maxJobCount}"
               "SPINDLE_SERVER_QUEUE_SIZE=${toString cfg.server.queueSize}"
               "SPINDLE_SERVER_SECRETS_PROVIDER=${cfg.server.secrets.provider}"