diff --git a/roles/custom/matrix-synapse/defaults/main.yml b/roles/custom/matrix-synapse/defaults/main.yml
index c251ae38e..2de8884ff 100644
--- a/roles/custom/matrix-synapse/defaults/main.yml
+++ b/roles/custom/matrix-synapse/defaults/main.yml
@@ -725,6 +725,9 @@ matrix_synapse_oidc_providers: []
 # Note: internally, this uses the `--mount` flag for mounting the specified volumes.
 matrix_synapse_container_additional_volumes: []
 
+# Controls whether cas_config is enabled
+matrix_synapse_cas_config_enabled: false
+
 # A list of additional loggers to register in synapse.log.config.
 # This list gets populated dynamically based on Synapse extensions that have been enabled.
 # Contains definition objects like this: `{"name": "..", "level": "DEBUG"}
diff --git a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2 b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2
index 69e6e0b01..738dbaeae 100644
--- a/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2
+++ b/roles/custom/matrix-synapse/templates/synapse/homeserver.yaml.j2
@@ -2136,7 +2136,7 @@ cas_config:
   # Uncomment the following to enable authorization against a CAS server.
   # Defaults to false.
   #
-  #enabled: true
+  enabled: {{ matrix_synapse_cas_config_enabled | to_json }}
 
   # The URL of the CAS authorization endpoint.
   #