diff --git a/config/tool_shed.ini.sample b/config/tool_shed.ini.sample
index 309be27ea61..16c3eed28b0 100644
--- a/config/tool_shed.ini.sample
+++ b/config/tool_shed.ini.sample
@@ -35,6 +35,9 @@ database_file = database/community.sqlite
 # The default is the Galaxy installation directory.
 #hgweb_config_dir = None
 
+# Disable Mercurial pushing to repositories.
+#disable_push = True
+
 # Where tool shed repositories are stored.
 file_path = database/community_files
 # Temporary storage for additional datasets,
diff --git a/lib/galaxy/webapps/tool_shed/config.py b/lib/galaxy/webapps/tool_shed/config.py
index c4feb367c42..2bc06091df6 100644
--- a/lib/galaxy/webapps/tool_shed/config.py
+++ b/lib/galaxy/webapps/tool_shed/config.py
@@ -136,6 +136,7 @@ class Configuration( object ):
         self.sentry_dsn = kwargs.get( 'sentry_dsn', None )
         # Where the tool shed hgweb.config file is stored - the default is the Galaxy installation directory.
         self.hgweb_config_dir = resolve_path( kwargs.get( 'hgweb_config_dir', '' ), self.root )
+        self.disable_push = string_as_bool( kwargs.get( "disable_push", "True" ) )
         # Proxy features
         self.apache_xsendfile = kwargs.get( 'apache_xsendfile', False )
         self.nginx_x_accel_redirect_base = kwargs.get( 'nginx_x_accel_redirect_base', False )
diff --git a/lib/galaxy/webapps/tool_shed/framework/middleware/hg.py b/lib/galaxy/webapps/tool_shed/framework/middleware/hg.py
index 862298c2ff0..5d8aa943580 100644
--- a/lib/galaxy/webapps/tool_shed/framework/middleware/hg.py
+++ b/lib/galaxy/webapps/tool_shed/framework/middleware/hg.py
@@ -74,6 +74,9 @@ class Hg( object ):
                     connection.execute( sql_cmd )
                     connection.close()
         elif cmd in [ 'unbundle', 'pushkey' ]:
+            if self.config[ 'disable_push' ]:
+                msg = 'Pushing to Tool Shed is disabled.'
+                return self.__display_exception_remotely( start_response, msg )
             # This is an hg push from the command line.  When doing this, the following commands, in order,
             # will be retrieved from environ (see the docs at http://mercurial.selenic.com/wiki/WireProtocol):
             # # If mercurial version >= '2.2.3': capabilities -> batch -> branchmap -> unbundle -> listkeys -> pushkey -> listkeys