diff --git a/roles/synapse/defaults/main/homeserver.config.yml b/roles/synapse/defaults/main/homeserver.config.yml
index 47cb681..c853e8d 100644
--- a/roles/synapse/defaults/main/homeserver.config.yml
+++ b/roles/synapse/defaults/main/homeserver.config.yml
@@ -23,6 +23,7 @@ synapse_default_config: >-
     | combine(synapse_metrics_config)
     | combine(synapse_api_config)
     | combine(synapse_push_config)
+    | combine(synapse_registration_config)
   }}
 
 synapse_homeserver_config: >-
diff --git a/roles/synapse/defaults/main/homeserver.registration.yml b/roles/synapse/defaults/main/homeserver.registration.yml
new file mode 100644
index 0000000..893c59a
--- /dev/null
+++ b/roles/synapse/defaults/main/homeserver.registration.yml
@@ -0,0 +1,41 @@
+---
+synapse_config_enable_registration: false
+synapse_config_enable_registration_without_verification: false
+synapse_config_registrations_require_3pid: []
+synapse_config_registration_requires_token: true
+synapse_config_registration_shared_secret: ~
+synapse_config_registration_shared_secret_path: ~
+synapse_config_allowed_local_3pids: []
+synapse_config_enable_3pid_lookup: true
+
+synapse_config_bcrypt_rounds: 14
+synapse_config_allow_guest_access: false
+synapse_config_default_identity_server: ~
+synapse_config_enable_set_displayname: true
+synapse_config_enable_set_avatar_url: true
+synapse_config_enable_3pid_changes: true
+
+synapse_registration_base_config:
+  enable_set_displayname: "{{ synapse_config_enable_set_displayname }}"
+  enable_set_avatar_url: "{{ synapse_config_enable_set_avatar_url }}"
+  enable_3pid_changes: "{{ synapse_config_enable_3pid_changes }}"
+  allow_guest_access: "{{ synapse_config_allow_guest_access }}"
+  enable_registration: "{{ synapse_config_enable_registration }}"
+  enable_registration_without_verification: >-2
+    {{ synapse_config_enable_registration_without_verification }}
+  allowed_local_3pids: "{{ synapse_config_allowed_local_3pids }}"
+  enable_3pid_lookup: "{{ synapse_config_enable_3pid_lookup }}"
+  registrations_require_3pid: "{{ synapse_config_registrations_require_3pid }}"
+  registration_requires_token: "{{ synapse_config_registration_requires_token }}"
+  registration_shared_secret: "{{ synapse_config_registration_shared_secret }}"
+  registration_shared_secret_path: >-2
+    {{ synapse_config_registration_shared_secret_path }}
+  bcrypt_rounds: "{{ synapse_config_bcrypt_rounds }}"
+
+synapse_registration_config: >-2
+  {{
+    synapse_registration_base_config
+    | combine(({"default_identity_server": synapse_config_default_identity_server})
+      if (synapse_config_default_identity_server | default(false, true)
+        and synapse_config_default_identity_server | length > 0) else {})
+  }}