diff --git a/packages/web/src/app/[domain]/onboard/components/connectCodeHost.tsx b/packages/web/src/app/[domain]/onboard/components/connectCodeHost.tsx
index fb1bde50..7a665ca4 100644
--- a/packages/web/src/app/[domain]/onboard/components/connectCodeHost.tsx
+++ b/packages/web/src/app/[domain]/onboard/components/connectCodeHost.tsx
@@ -21,9 +21,10 @@ import SecurityCard from "@/app/components/securityCard";
 
 interface ConnectCodeHostProps {
     nextStep: OnboardingSteps;
+    securityCardEnabled: boolean;
 }
 
-export const ConnectCodeHost = ({ nextStep }: ConnectCodeHostProps) => {
+export const ConnectCodeHost = ({ nextStep, securityCardEnabled }: ConnectCodeHostProps) => {
     const [selectedCodeHost, setSelectedCodeHost] = useState<CodeHostType | null>(null);
     const router = useRouter();
     const { data: session } = useSession();
@@ -51,7 +52,7 @@ export const ConnectCodeHost = ({ nextStep }: ConnectCodeHostProps) => {
         return (
             <>
                 <CodeHostSelection onSelect={setSelectedCodeHost} />
-                <SecurityCard />
+                {securityCardEnabled && <SecurityCard />}
             </>
         )
     }
diff --git a/packages/web/src/app/[domain]/onboard/page.tsx b/packages/web/src/app/[domain]/onboard/page.tsx
index 586a6f91..768244ee 100644
--- a/packages/web/src/app/[domain]/onboard/page.tsx
+++ b/packages/web/src/app/[domain]/onboard/page.tsx
@@ -8,6 +8,7 @@ import { CompleteOnboarding } from "./components/completeOnboarding";
 import { Checkout } from "./components/checkout";
 import { LogoutEscapeHatch } from "@/app/components/logoutEscapeHatch";
 import { IS_BILLING_ENABLED } from "@/lib/stripe";
+import { env } from "@/env.mjs";
 
 interface OnboardProps {
     params: {
@@ -57,6 +58,7 @@ export default async function Onboard({ params, searchParams }: OnboardProps) {
                     />
                     <ConnectCodeHost
                         nextStep={OnboardingSteps.InviteTeam}
+                        securityCardEnabled={env.SECURITY_CARD_ENABLED === 'true'}
                     />
                 </>
             )}
diff --git a/packages/web/src/env.mjs b/packages/web/src/env.mjs
index 4f4e2319..2f8f44bf 100644
--- a/packages/web/src/env.mjs
+++ b/packages/web/src/env.mjs
@@ -45,6 +45,9 @@ export const env = createEnv({
         SOURCEBOT_TENANCY_MODE: tenancyModeSchema.default("single"),
         SOURCEBOT_AUTH_ENABLED: booleanSchema.default('true'),
         CONFIG_PATH: z.string().optional(),
+
+        // Misc UI flags
+        SECURITY_CARD_ENABLED: booleanSchema.default('false'),
     },
     // @NOTE: Make sure you destructure all client variables in the
     // `experimental__runtimeEnv` block below.