diff --git a/core/Command/Config/App/SetConfig.php b/core/Command/Config/App/SetConfig.php
index c818404fc0e..97454b353d6 100644
--- a/core/Command/Config/App/SetConfig.php
+++ b/core/Command/Config/App/SetConfig.php
@@ -60,6 +60,12 @@ class SetConfig extends Base {
 				InputOption::VALUE_NEGATABLE,
 				'Set value as sensitive',
 			)
+			->addOption(
+				'internal',
+				null,
+				InputOption::VALUE_NONE,
+				'Confirm the edit of an internal value',
+			)
 			->addOption(
 				'update-only',
 				null,
@@ -159,6 +165,12 @@ class SetConfig extends Base {
 				$sensitive = $sensitive ?? false;
 			}
 
+			if (!$input->getOption('internal') && ($this->appConfig->getKeyDetails($appName, $configName)['internal'] ?? false)) {
+				$output->writeln('<error>Config key is set as INTERNAL and modifying it might induce strange behavior or break user experience.</error>');
+				$output->writeln('please use option <comment>--internal</comment> to confirm your action');
+				return self::FAILURE;
+			}
+
 			$value = (string)$input->getOption('value');
 			switch ($type) {
 				case IAppConfig::VALUE_MIXED:
diff --git a/lib/private/AppConfig.php b/lib/private/AppConfig.php
index 50fa23e516e..a9aa48a6c21 100644
--- a/lib/private/AppConfig.php
+++ b/lib/private/AppConfig.php
@@ -1115,7 +1115,7 @@ class AppConfig implements IAppConfig {
 	 * @param string $app id of the app
 	 * @param string $key config key
 	 *
-	 * @return array{app: string, key: string, lazy?: bool, valueType?: ValueType, valueTypeName?: string, sensitive?: bool, default?: string, definition?: string, note?: string}
+	 * @return array{app: string, key: string, lazy?: bool, valueType?: ValueType, valueTypeName?: string, sensitive?: bool, internal?: bool, default?: string, definition?: string, note?: string}
 	 * @since 32.0.0
 	 */
 	public function getKeyDetails(string $app, string $key): array {
@@ -1143,6 +1143,7 @@ class AppConfig implements IAppConfig {
 				'valueType' => $lexiconEntry->getValueType(),
 				'valueTypeName' => $lexiconEntry->getValueType()->name,
 				'sensitive' => $lexiconEntry->isFlagged(self::FLAG_SENSITIVE),
+				'internal' => $lexiconEntry->isFlagged(self::FLAG_INTERNAL),
 				'default' => $lexiconEntry->getDefault($this->presetManager->getLexiconPreset()),
 				'definition' => $lexiconEntry->getDefinition(),
 				'note' => $lexiconEntry->getNote(),
diff --git a/lib/public/Config/IUserConfig.php b/lib/public/Config/IUserConfig.php
index cb42608ea75..ac9e67d5695 100644
--- a/lib/public/Config/IUserConfig.php
+++ b/lib/public/Config/IUserConfig.php
@@ -38,6 +38,10 @@ interface IUserConfig {
 	 * @since 32.0.0
 	 */
 	public const FLAG_INDEXED = 2;    // value should be indexed
+	/**
+	 * @since 33.0.0
+	 */
+	public const FLAG_INTERNAL = 4;   // value is considered internal and can be hidden from listing
 
 	/**
 	 * Get list of all userIds with config stored in database.
diff --git a/lib/public/IAppConfig.php b/lib/public/IAppConfig.php
index d9e3e0d95a7..eb89680767d 100644
--- a/lib/public/IAppConfig.php
+++ b/lib/public/IAppConfig.php
@@ -48,6 +48,10 @@ interface IAppConfig {
 
 	/** @since 31.0.0 */
 	public const FLAG_SENSITIVE = 1;   // value is sensitive
+	/**
+	 * @since 33.0.0
+	 */
+	public const FLAG_INTERNAL = 4;   // value is considered internal and can be hidden from listing
 
 	/**
 	 * Get list of all apps that have at least one config value stored in database
@@ -472,7 +476,7 @@ interface IAppConfig {
 	 * @param string $app id of the app
 	 * @param string $key config key
 	 *
-	 * @return array{app: string, key: string, lazy?: bool, valueType?: ValueType, valueTypeName?: string, sensitive?: bool, default?: string, definition?: string, note?: string}
+	 * @return array{app: string, key: string, lazy?: bool, valueType?: ValueType, valueTypeName?: string, sensitive?: bool, internal?: bool, default?: string, definition?: string, note?: string}
 	 * @since 32.0.0
 	 */
 	public function getKeyDetails(string $app, string $key): array;