diff --git a/ui/src/main/java/com/wireguard/android/model/TunnelManager.java b/ui/src/main/java/com/wireguard/android/model/TunnelManager.java
index e370f8de..eb818791 100644
--- a/ui/src/main/java/com/wireguard/android/model/TunnelManager.java
+++ b/ui/src/main/java/com/wireguard/android/model/TunnelManager.java
@@ -275,10 +275,7 @@ public final class TunnelManager extends BaseObservable {
                 return;
             }
 
-            /* We disable the below, for now, as the security model of allowing this
-             * might take a bit more consideration.
-             */
-            if (true)
+            if (!Application.getSharedPreferences().getBoolean("allow_remote_control_intents", false))
                 return;
 
             final State state;
diff --git a/ui/src/main/res/values-hi/strings.xml b/ui/src/main/res/values-hi/strings.xml
index cd2d4eb8..c79341d7 100644
--- a/ui/src/main/res/values-hi/strings.xml
+++ b/ui/src/main/res/values-hi/strings.xml
@@ -118,7 +118,6 @@
     <string name="parse_error_integer">संख्या</string>
     <string name="parse_error_reason">%1$s “%2$s” को पार्स नहीं कर सकता</string>
     <string name="peer">पीयर</string>
-    <string name="permission_description">किसी एप्लिकेशन को वायरगार्ड टनलस को नियंत्रित करने की अनुमति देता है। इस अनुमति वाले ऐप्स, इंटरनेट ट्रैफ़िक को संभावित रूप से गलत तरीके से वायरगार्ड टनलस को सक्षम और अक्षम कर सकते हैं।</string>
     <string name="permission_label">वायरगार्ड टनलस को नियंत्रित करें</string>
     <string name="persistent_keepalive">लगातार जिंदा रहो</string>
     <string name="pre_shared_key">प्री-शेयर्ड कीस</string>
diff --git a/ui/src/main/res/values-id/strings.xml b/ui/src/main/res/values-id/strings.xml
index 2c8bc486..7c6c6a0b 100644
--- a/ui/src/main/res/values-id/strings.xml
+++ b/ui/src/main/res/values-id/strings.xml
@@ -119,7 +119,6 @@
     <string name="parse_error_integer">angka</string>
     <string name="parse_error_reason">%1$s “%2$s” Tidak dapat diuraikan</string>
     <string name="peer">Peer</string>
-    <string name="permission_description">Memungkinkan aplikasi untuk mengontrol tunel WireGuard. Aplikasi dengan izin ini dapat mengaktifkan dan menonaktifkan tunel WireGuard yang berakibat salah mengatur lalu lintas Internet.</string>
     <string name="permission_label">Kontrol tunel WireGuard</string>
     <string name="persistent_keepalive">Keepalive persisten</string>
     <string name="pre_shared_key">Kunci Pra-bersama</string>
diff --git a/ui/src/main/res/values-it/strings.xml b/ui/src/main/res/values-it/strings.xml
index 5496f42e..48f36a2b 100644
--- a/ui/src/main/res/values-it/strings.xml
+++ b/ui/src/main/res/values-it/strings.xml
@@ -111,7 +111,6 @@
     <string name="parse_error_integer">numero</string>
     <string name="parse_error_reason">Impossibile analizzare %1$s “%2$s”</string>
     <string name="peer">Peer</string>
-    <string name="permission_description">Permette ad un\'app di controllare i tunnel WireGuard. Le app con questa autorizzazione possono attivare e disattivare i tunnel WireGuard a piacimento, potenzialmente deviando il traffico internet.</string>
     <string name="permission_label">controlla tunnel WireGuard</string>
     <string name="persistent_keepalive">Tieni sempre attivo</string>
     <string name="pre_shared_key">Chiave condivisa (PSK)</string>
diff --git a/ui/src/main/res/values-ja/strings.xml b/ui/src/main/res/values-ja/strings.xml
index a7627cb5..c753a5d5 100644
--- a/ui/src/main/res/values-ja/strings.xml
+++ b/ui/src/main/res/values-ja/strings.xml
@@ -115,7 +115,6 @@
     <string name="parse_error_integer">数値</string>
     <string name="parse_error_reason">%1$s の内容を解読できません “%2$s”</string>
     <string name="peer">ピア</string>
-    <string name="permission_description">アプリに WireGuard トンネルの制御を許可します。この権限を持つアプリはトンネルの起動停止ができるようになりますが、インターネットトラフィックが意図しない方向に向かう可能性があります。</string>
     <string name="permission_label">control WireGuard tunnels</string>
     <string name="persistent_keepalive">持続的キープアライブ</string>
     <string name="pre_shared_key">事前共有鍵</string>
diff --git a/ui/src/main/res/values-ru/strings.xml b/ui/src/main/res/values-ru/strings.xml
index dc43e78d..eb22fc98 100644
--- a/ui/src/main/res/values-ru/strings.xml
+++ b/ui/src/main/res/values-ru/strings.xml
@@ -118,7 +118,6 @@
     <string name="parse_error_integer">число</string>
     <string name="parse_error_reason">Не могу разобрать %1$s “%2$s”</string>
     <string name="peer">Пир</string>
-    <string name="permission_description">Приложение сможет управлять туннелями WireGuard. Приложения с таким разрешением могут по желанию включать и отключать туннели WireGuard, что может привести к неправильному перенаправлению интернет-трафика.</string>
     <string name="permission_label">управлять туннелями WireGuard</string>
     <string name="persistent_keepalive">Постоянное соединение</string>
     <string name="pre_shared_key">Общий ключ</string>
diff --git a/ui/src/main/res/values-zh-rCN/strings.xml b/ui/src/main/res/values-zh-rCN/strings.xml
index a47351c6..613abf46 100644
--- a/ui/src/main/res/values-zh-rCN/strings.xml
+++ b/ui/src/main/res/values-zh-rCN/strings.xml
@@ -112,7 +112,6 @@
     <string name="parse_error_integer">数字</string>
     <string name="parse_error_reason">无法解析%1$s “%2$s”&#32;</string>
     <string name="peer">节点 / Peer</string>
-    <string name="permission_description">允许其他应用控制 WireGuard 隧道（开启 / 关闭），但可能会误传一些流量</string>
     <string name="permission_label">控制 WireGuard 隧道</string>
     <string name="persistent_keepalive">连接保活间隔</string>
     <string name="pre_shared_key">预共享密钥</string>
diff --git a/ui/src/main/res/values/strings.xml b/ui/src/main/res/values/strings.xml
index 47fd867a..70d92c39 100644
--- a/ui/src/main/res/values/strings.xml
+++ b/ui/src/main/res/values/strings.xml
@@ -26,6 +26,9 @@
     </plurals>
     <string name="add_peer">Add peer</string>
     <string name="addresses">Addresses</string>
+    <string name="allow_remote_control_intents_title">Allow remote control apps</string>
+    <string name="allow_remote_control_intents_summary_on">External apps may toggle tunnels (advanced)</string>
+    <string name="allow_remote_control_intents_summary_off">External apps may not toggle tunnels (recommended)</string>
     <string name="allowed_ips">Allowed IPs</string>
     <string name="app_name">WireGuard</string>
     <string name="bad_config_context">%1$s\'s %2$s</string>
@@ -121,7 +124,7 @@
     <string name="parse_error_integer">number</string>
     <string name="parse_error_reason">Cannot parse %1$s “%2$s”</string>
     <string name="peer">Peer</string>
-    <string name="permission_description">Allows an app to control WireGuard tunnels. Apps with this permission may enable and disable WireGuard tunnels at will, potentially misdirecting Internet traffic.</string>
+    <string name="permission_description">control WireGuard tunnels, enabling and disabling tunnels at will, potentially misdirecting Internet traffic</string>
     <string name="permission_label">control WireGuard tunnels</string>
     <string name="persistent_keepalive">Persistent keepalive</string>
     <string name="pre_shared_key">Pre-shared key</string>
diff --git a/ui/src/main/res/xml/preferences.xml b/ui/src/main/res/xml/preferences.xml
index d7955052..0f674108 100644
--- a/ui/src/main/res/xml/preferences.xml
+++ b/ui/src/main/res/xml/preferences.xml
@@ -24,4 +24,10 @@
         android:summaryOn="@string/dark_theme_summary_on"
         android:title="@string/dark_theme_title" />
     <com.wireguard.android.preference.KernelModuleDisablerPreference android:key="kernel_module_disabler" />
+    <CheckBoxPreference
+        android:defaultValue="false"
+        android:key="allow_remote_control_intents"
+        android:summaryOff="@string/allow_remote_control_intents_summary_off"
+        android:summaryOn="@string/allow_remote_control_intents_summary_on"
+        android:title="@string/allow_remote_control_intents_title" />
 </androidx.preference.PreferenceScreen>