diff --git a/Changes b/Changes
index f57fd7370..6e27e2d88 100644
--- a/Changes
+++ b/Changes
@@ -2487,3 +2487,5 @@
   no advantage anyway. Reported by nenolod (#4129).
 - Various updates to makefile.win32 and .iss file, found during
   building new versions of zlib, openssl, and curl.
+- Added set::options::disable-cap, which can be used to disable the
+  new CAP support (#4104).
diff --git a/doc/unreal32docs.html b/doc/unreal32docs.html
index 5ecc559fd..69aa8a0ab 100644
--- a/doc/unreal32docs.html
+++ b/doc/unreal32docs.html
@@ -2519,6 +2519,10 @@ set {
 <p><font class="set">set::options::allow-insane-bans;</font><br>
   Allow insane broad bans like /GLINE *@*.xx. This makes it very easy to
   accidentally ban everyone on your network, so use with great care!</p>
+<p><font class="set">set::options::disable-cap;</font><br>
+  Disable IRC Client Capabilities Extensions (CAP). Note that this makes
+  SASL and various other features unavailable or harder for clients to
+  use.</p>
 <p id="set_nopost_ban_action"><font class="set">set::nopost::ban-action</font> (requires <a href="#modules_m_nopost">m_nopost</a>)<br />
   Action to take on a user if he tries to perform an HTTP POST command.
   The allowed values are: kill, gline, gzline, kline, zline, shun, and tempshun.
diff --git a/include/dynconf.h b/include/dynconf.h
index d5b6b6f8d..10c33d827 100644
--- a/include/dynconf.h
+++ b/include/dynconf.h
@@ -83,6 +83,7 @@ struct zConfiguration {
 	unsigned mkpasswd_for_everyone:1;
 	unsigned allow_insane_bans;
 	unsigned allow_part_if_shunned:1;
+	unsigned disable_cap:1;
 	unsigned check_target_nick_bans:1;
 	unsigned use_egd : 1;
 	long host_timeout;
@@ -266,6 +267,8 @@ extern MODVAR aConfiguration iConf;
 
 #define ALLOW_PART_IF_SHUNNED	iConf.allow_part_if_shunned
 
+#define DISABLE_CAP	iConf.disable_cap
+
 #define BAN_VERSION_TKL_TIME	iConf.ban_version_tkl_time
 #define SILENCE_LIMIT (iConf.silence_limit ? iConf.silence_limit : 15)
 
@@ -306,6 +309,7 @@ struct SetCheck {
 	unsigned has_dont_resolve:1;
 	unsigned has_mkpasswd_for_everyone:1;
 	unsigned has_allow_part_if_shunned:1;
+	unsigned has_disable_cap:1;
 	unsigned has_ssl_egd:1;
 	unsigned has_ssl_server_cipher_list :1;
 	unsigned has_dns_timeout:1;
@@ -402,6 +406,7 @@ struct SetCheck {
 	unsigned has_options_mkpasswd_for_everyone:1;
 	unsigned has_options_allow_insane_bans:1;
 	unsigned has_options_allow_part_if_shunned:1;
+	unsigned has_options_disable_cap:1;
 	int cgiirc_type; /* cheat :( */
 	unsigned has_cgiirc_hosts:1;
 	unsigned has_cgiirc_webpass:1;
diff --git a/src/modules/m_cap.c b/src/modules/m_cap.c
index 8a510c2de..8d519bb6f 100644
--- a/src/modules/m_cap.c
+++ b/src/modules/m_cap.c
@@ -407,6 +407,16 @@ DLLFUNC int m_cap(aClient *cptr, aClient *sptr, int parc, char *parv[])
 {
 	struct clicap_cmd *cmd;
 
+	if (DISABLE_CAP)
+	{
+		/* I know nothing! */
+		if (IsPerson(sptr))
+			sendto_one(sptr, err_str(ERR_UNKNOWNCOMMAND), me.name, parv[0], "CAP");
+		else
+			sendto_one(sptr, err_str(ERR_NOTREGISTERED), me.name, "CAP");
+		return 0;
+	}
+
 	if (parc < 2)
 	{
 		sendto_one(sptr, err_str(ERR_NEEDMOREPARAMS),
diff --git a/src/s_conf.c b/src/s_conf.c
index 42814c359..882e24165 100644
--- a/src/s_conf.c
+++ b/src/s_conf.c
@@ -7597,6 +7597,9 @@ int	_conf_set(ConfigFile *conf, ConfigEntry *ce)
 				else if (!strcmp(cepp->ce_varname, "allow-part-if-shunned")) {
 					tempiConf.allow_part_if_shunned = 1;
 				}
+				else if (!strcmp(cepp->ce_varname, "disable-cap")) {
+					tempiConf.disable_cap = 1;
+				}
 			}
 		}
 		else if (!strcmp(cep->ce_varname, "hosts")) {
@@ -8356,6 +8359,9 @@ int	_test_set(ConfigFile *conf, ConfigEntry *ce)
 				else if (!strcmp(cepp->ce_varname, "allow-part-if-shunned")) {
 					CheckDuplicate(cepp, options_allow_part_if_shunned, "options::allow-part-if-shunned");
 				}
+				else if (!strcmp(cepp->ce_varname, "disable-cap")) {
+					CheckDuplicate(cepp, options_disable_cap, "options::disable-cap");
+				}
 				else
 				{
 					config_error_unknownopt(cepp->ce_fileptr->cf_filename,