diff --git a/core/src/main/java/google/registry/model/registrar/Registrar.java b/core/src/main/java/google/registry/model/registrar/Registrar.java
index fa15c3101..602a84b1e 100644
--- a/core/src/main/java/google/registry/model/registrar/Registrar.java
+++ b/core/src/main/java/google/registry/model/registrar/Registrar.java
@@ -409,6 +409,9 @@ public class Registrar extends ImmutableObject implements Buildable, Jsonifiable
    */
   boolean contactsRequireSyncing = true;
 
+  /** Whether or not registry lock is allowed for this registrar. */
+  boolean registryLockAllowed = false;
+
   @NonFinalForTesting
   private static Supplier<byte[]> saltSupplier =
       () -> {
@@ -545,6 +548,10 @@ public class Registrar extends ImmutableObject implements Buildable, Jsonifiable
     return contactsRequireSyncing;
   }
 
+  public boolean isRegistryLockAllowed() {
+    return registryLockAllowed;
+  }
+
   public String getUrl() {
     return url;
   }
@@ -895,6 +902,11 @@ public class Registrar extends ImmutableObject implements Buildable, Jsonifiable
       return this;
     }
 
+    public Builder setRegistryLockAllowed(boolean registryLockAllowed) {
+      getInstance().registryLockAllowed = registryLockAllowed;
+      return this;
+    }
+
     /** Build the registrar, nullifying empty fields. */
     @Override
     public Registrar build() {
diff --git a/core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java b/core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
index 44052667e..8d5c819bf 100644
--- a/core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
+++ b/core/src/main/java/google/registry/tools/CreateOrUpdateRegistrarCommand.java
@@ -234,6 +234,13 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
       arity = 1)
   private Boolean contactsRequireSyncing;
 
+  @Nullable
+  @Parameter(
+      names = "--registry_lock_allowed",
+      description = "Whether this registrar is allowed to use registry lock",
+      arity = 1)
+  private Boolean registryLockAllowed;
+
   @Nullable
   @Parameter(
       names = "--drive_folder_id",
@@ -393,6 +400,7 @@ abstract class CreateOrUpdateRegistrarCommand extends MutatingCommand {
       }
       Optional.ofNullable(blockPremiumNames).ifPresent(builder::setBlockPremiumNames);
       Optional.ofNullable(contactsRequireSyncing).ifPresent(builder::setContactsRequireSyncing);
+      Optional.ofNullable(registryLockAllowed).ifPresent(builder::setRegistryLockAllowed);
       Optional.ofNullable(phonePasscode).ifPresent(builder::setPhonePasscode);
       Optional.ofNullable(icannReferralEmail).ifPresent(builder::setIcannReferralEmail);
       Optional.ofNullable(whoisServer).ifPresent(builder::setWhoisServer);
diff --git a/core/src/test/java/google/registry/tools/CreateRegistrarCommandTest.java b/core/src/test/java/google/registry/tools/CreateRegistrarCommandTest.java
index e048ebd04..f013001b3 100644
--- a/core/src/test/java/google/registry/tools/CreateRegistrarCommandTest.java
+++ b/core/src/test/java/google/registry/tools/CreateRegistrarCommandTest.java
@@ -88,6 +88,7 @@ public class CreateRegistrarCommandTest extends CommandTestCase<CreateRegistrarC
     assertThat(registrar.getCreationTime()).isIn(Range.closed(before, after));
     assertThat(registrar.getLastUpdateTime()).isEqualTo(registrar.getCreationTime());
     assertThat(registrar.getBlockPremiumNames()).isFalse();
+    assertThat(registrar.isRegistryLockAllowed()).isFalse();
     assertThat(registrar.getPoNumber()).isEmpty();
     assertThat(registrar.getIcannReferralEmail()).isEqualTo("foo@bar.test");
 
@@ -766,6 +767,50 @@ public class CreateRegistrarCommandTest extends CommandTestCase<CreateRegistrarC
     assertThat(registrar.get().getBlockPremiumNames()).isFalse();
   }
 
+  @Test
+  public void testSuccess_registryLockAllowed() throws Exception {
+    runCommandForced(
+        "--name=blobio",
+        "--password=some_password",
+        "--registrar_type=REAL",
+        "--iana_id=8",
+        "--registry_lock_allowed=true",
+        "--passcode=01234",
+        "--icann_referral_email=foo@bar.test",
+        "--street=\"123 Fake St\"",
+        "--city Fakington",
+        "--state MA",
+        "--zip 00351",
+        "--cc US",
+        "clientz");
+
+    Optional<Registrar> registrar = Registrar.loadByClientId("clientz");
+    assertThat(registrar).isPresent();
+    assertThat(registrar.get().isRegistryLockAllowed()).isTrue();
+  }
+
+  @Test
+  public void testSuccess_registryLockDisallowed() throws Exception {
+    runCommandForced(
+        "--name=blobio",
+        "--password=some_password",
+        "--registrar_type=REAL",
+        "--iana_id=8",
+        "--registry_lock_allowed=false",
+        "--passcode=01234",
+        "--icann_referral_email=foo@bar.test",
+        "--street=\"123 Fake St\"",
+        "--city Fakington",
+        "--state MA",
+        "--zip 00351",
+        "--cc US",
+        "clientz");
+
+    Optional<Registrar> registrar = Registrar.loadByClientId("clientz");
+    assertThat(registrar).isPresent();
+    assertThat(registrar.get().isRegistryLockAllowed()).isFalse();
+  }
+
   @Test
   public void testFailure_badPhoneNumber() {
     ParameterException thrown =
diff --git a/core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java b/core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java
index aab7aa5c0..642e63dd0 100644
--- a/core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java
+++ b/core/src/test/java/google/registry/tools/UpdateRegistrarCommandTest.java
@@ -364,6 +364,20 @@ public class UpdateRegistrarCommandTest extends CommandTestCase<UpdateRegistrarC
     assertThat(loadRegistrar("NewRegistrar").getBlockPremiumNames()).isFalse();
   }
 
+  @Test
+  public void testSuccess_allowRegistryLock() throws Exception {
+    assertThat(loadRegistrar("NewRegistrar").isRegistryLockAllowed()).isFalse();
+    runCommandForced("--registry_lock_allowed=true", "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").isRegistryLockAllowed()).isTrue();
+  }
+
+  @Test
+  public void testSuccess_disallowRegistryLock() throws Exception {
+    persistResource(loadRegistrar("NewRegistrar").asBuilder().setRegistryLockAllowed(true).build());
+    runCommandForced("--registry_lock_allowed=false", "NewRegistrar");
+    assertThat(loadRegistrar("NewRegistrar").isRegistryLockAllowed()).isFalse();
+  }
+
   @Test
   public void testSuccess_unspecifiedBooleansArentChanged() throws Exception {
     persistResource(
diff --git a/core/src/test/resources/google/registry/model/schema.txt b/core/src/test/resources/google/registry/model/schema.txt
index a7ef1deb8..ea72bab4f 100644
--- a/core/src/test/resources/google/registry/model/schema.txt
+++ b/core/src/test/resources/google/registry/model/schema.txt
@@ -409,6 +409,7 @@ class google.registry.model.registrar.Registrar {
   @Parent com.googlecode.objectify.Key<google.registry.model.common.EntityGroupRoot> parent;
   boolean blockPremiumNames;
   boolean contactsRequireSyncing;
+  boolean registryLockAllowed;
   google.registry.model.CreateAutoTimestamp creationTime;
   google.registry.model.UpdateAutoTimestamp lastUpdateTime;
   google.registry.model.registrar.Registrar$State state;