diff --git a/changelog/unreleased/add-default-link-permission-config.md b/changelog/unreleased/add-default-link-permission-config.md
new file mode 100644
index 0000000000..4ee2030843
--- /dev/null
+++ b/changelog/unreleased/add-default-link-permission-config.md
@@ -0,0 +1,6 @@
+Enhancement: Default link permission config
+
+A new config for default link permissions that is being announced via capabilities has been added. It defaults to 1 (= public link with viewer permissions).
+
+https://github.com/owncloud/ocis/pull/7783
+https://github.com/owncloud/web/issues/9919
diff --git a/services/frontend/pkg/config/config.go b/services/frontend/pkg/config/config.go
index fcf40a5293..0975ac68a7 100644
--- a/services/frontend/pkg/config/config.go
+++ b/services/frontend/pkg/config/config.go
@@ -39,6 +39,7 @@ type Config struct {
 	SearchMinLength                int    `yaml:"search_min_length" env:"FRONTEND_SEARCH_MIN_LENGTH" desc:"Minimum number of characters to enter before a client should start a search for Share receivers. This setting can be used to customize the user experience if e.g too many results are displayed."`
 	Edition                        string `yaml:"edition" env:"OCIS_EDITION;FRONTEND_EDITION"`
 	DisableSSE                     bool   `yaml:"disable_sse" env:"OCIS_DISABLE_SSE;FRONTEND_DISABLE_SSE" desc:"When set to true, clients are informed that the Server-Sent Events endpoint is not accessible."`
+	DefaultLinkPermissions         int    `yaml:"default_link_permissions" env:"FRONTEND_DEFAULT_LINK_PERMISSIONS" desc:"Defines the default permissions a link is being created with. Possible values are 0 (= internal link, for instance members only) and 1 (= public link with viewer permissions). Defaults to 1."`
 
 	PublicURL string `yaml:"public_url" env:"OCIS_URL;FRONTEND_PUBLIC_URL" desc:"The public facing URL of the oCIS frontend."`
 
diff --git a/services/frontend/pkg/config/defaults/defaultconfig.go b/services/frontend/pkg/config/defaults/defaultconfig.go
index 700aebbe05..b589aa2f97 100644
--- a/services/frontend/pkg/config/defaults/defaultconfig.go
+++ b/services/frontend/pkg/config/defaults/defaultconfig.go
@@ -87,6 +87,7 @@ func DefaultConfig() *config.Config {
 		UploadHTTPMethodOverride: "",
 		DefaultUploadProtocol:    "tus",
 		EnableResharing:          true,
+		DefaultLinkPermissions:   1,
 		SearchMinLength:          3,
 		Edition:                  "Community",
 		Checksums: config.Checksums{
diff --git a/services/frontend/pkg/revaconfig/config.go b/services/frontend/pkg/revaconfig/config.go
index 1dc287e991..be692a6d9a 100644
--- a/services/frontend/pkg/revaconfig/config.go
+++ b/services/frontend/pkg/revaconfig/config.go
@@ -247,6 +247,7 @@ func FrontendConfigFromStruct(cfg *config.Config, logger log.Logger) (map[string
 									"upload":                     true,
 									"multiple":                   true,
 									"supports_upload_only":       true,
+									"default_permissions":        cfg.DefaultLinkPermissions,
 									"password": map[string]interface{}{
 										"enforced": false,
 										"enforced_for": map[string]interface{}{