diff --git a/Emby.Server.Implementations/ApplicationHost.cs b/Emby.Server.Implementations/ApplicationHost.cs
index 33aec1a06..7e7b785d8 100644
--- a/Emby.Server.Implementations/ApplicationHost.cs
+++ b/Emby.Server.Implementations/ApplicationHost.cs
@@ -106,6 +106,7 @@ using Microsoft.AspNetCore.Http.Extensions;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using OperatingSystem = MediaBrowser.Common.System.OperatingSystem;
+using Prometheus.DotNetRuntime;
 
 namespace Emby.Server.Implementations
 {
@@ -259,6 +260,12 @@ namespace Emby.Server.Implementations
 
             _startupOptions = options;
 
+            // Initialize runtime stat collection
+            if (ServerConfigurationManager.Configuration.EnableMetrics)
+            {
+                IDisposable collector = DotNetRuntimeStatsBuilder.Default().StartCollecting();
+            }
+
             fileSystem.AddShortcutHandler(new MbLinkShortcutHandler(fileSystem));
 
             _networkManager.NetworkChanged += OnNetworkChanged;
diff --git a/Emby.Server.Implementations/Emby.Server.Implementations.csproj b/Emby.Server.Implementations/Emby.Server.Implementations.csproj
index bf4a0d939..44fc932e3 100644
--- a/Emby.Server.Implementations/Emby.Server.Implementations.csproj
+++ b/Emby.Server.Implementations/Emby.Server.Implementations.csproj
@@ -39,6 +39,7 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.Abstractions" Version="3.1.3" />
     <PackageReference Include="Microsoft.Extensions.Hosting.Abstractions" Version="3.1.3" />
     <PackageReference Include="Mono.Nat" Version="2.0.1" />
+    <PackageReference Include="prometheus-net.DotNetRuntime" Version="3.3.1" />
     <PackageReference Include="ServiceStack.Text.Core" Version="5.8.0" />
     <PackageReference Include="sharpcompress" Version="0.25.0" />
     <PackageReference Include="SQLitePCL.pretty.netstandard" Version="2.1.0" />
diff --git a/Jellyfin.Server/Jellyfin.Server.csproj b/Jellyfin.Server/Jellyfin.Server.csproj
index c49fc41f4..88114d999 100644
--- a/Jellyfin.Server/Jellyfin.Server.csproj
+++ b/Jellyfin.Server/Jellyfin.Server.csproj
@@ -45,7 +45,6 @@
     <PackageReference Include="Microsoft.Extensions.Configuration.Json" Version="3.1.3" />
     <PackageReference Include="prometheus-net" Version="3.5.0" />
     <PackageReference Include="prometheus-net.AspNetCore" Version="3.5.0" />
-    <PackageReference Include="prometheus-net.DotNetRuntime" Version="3.3.1" />
     <PackageReference Include="Serilog.AspNetCore" Version="3.2.0" />
     <PackageReference Include="Serilog.Enrichers.Thread" Version="3.1.0" />
     <PackageReference Include="Serilog.Settings.Configuration" Version="3.1.0" />
diff --git a/Jellyfin.Server/Migrations/Routines/DisableMetricsCollection.cs b/Jellyfin.Server/Migrations/Routines/DisableMetricsCollection.cs
new file mode 100644
index 000000000..b5dc43614
--- /dev/null
+++ b/Jellyfin.Server/Migrations/Routines/DisableMetricsCollection.cs
@@ -0,0 +1,33 @@
+using System;
+using MediaBrowser.Common.Configuration;
+using MediaBrowser.Model.Configuration;
+using Microsoft.Extensions.Logging;
+
+namespace Jellyfin.Server.Migrations.Routines
+{
+    /// <summary>
+    /// Disable metrics collections for all installations since it can be a security risk if not properly secured.
+    /// </summary>
+    internal class DisableMetricsCollection : IMigrationRoutine
+    {
+        /// <inheritdoc/>
+        public Guid Id => Guid.Parse("{4124C2CD-E939-4FFB-9BE9-9B311C413638}");
+
+        /// <inheritdoc/>
+        public string Name => "DisableMetricsCollection";
+
+        /// <inheritdoc/>
+        public void Perform(CoreAppHost host, ILogger logger)
+        {
+            // Set EnableMetrics to false since it can leak sensitive information if not properly secured
+            var metrics = host.ServerConfigurationManager.Configuration.EnableMetrics;
+            if (metrics)
+            {
+                logger.LogInformation("Disabling metrics collection during migration");
+                metrics = false;
+
+                host.ServerConfigurationManager.SaveConfiguration("false", metrics);
+            }
+        }
+    }
+}
diff --git a/Jellyfin.Server/Program.cs b/Jellyfin.Server/Program.cs
index be070f9d5..193d30e3a 100644
--- a/Jellyfin.Server/Program.cs
+++ b/Jellyfin.Server/Program.cs
@@ -28,7 +28,6 @@ using Microsoft.Extensions.DependencyInjection.Extensions;
 using Microsoft.Extensions.Hosting;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Logging.Abstractions;
-using Prometheus.DotNetRuntime;
 using Serilog;
 using Serilog.Extensions.Logging;
 using SQLitePCL;
@@ -162,9 +161,6 @@ namespace Jellyfin.Server
 
             ApplicationHost.LogEnvironmentInfo(_logger, appPaths);
 
-            // Initialize runtime stat collection
-            IDisposable collector = DotNetRuntimeStatsBuilder.Default().StartCollecting();
-
             // Make sure we have all the code pages we can get
             // Ref: https://docs.microsoft.com/en-us/dotnet/api/system.text.codepagesencodingprovider.instance?view=netcore-3.0#remarks
             Encoding.RegisterProvider(CodePagesEncodingProvider.Instance);
diff --git a/Jellyfin.Server/Startup.cs b/Jellyfin.Server/Startup.cs
index 2e5f843e3..8f85161c7 100644
--- a/Jellyfin.Server/Startup.cs
+++ b/Jellyfin.Server/Startup.cs
@@ -70,11 +70,18 @@ namespace Jellyfin.Server
             app.UseJellyfinApiSwagger();
             app.UseRouting();
             app.UseAuthorization();
-            app.UseHttpMetrics(); // Must be registered after any middleware that could chagne HTTP response codes or the data will be bad
+            if (_serverConfigurationManager.Configuration.EnableMetrics)
+            {
+                app.UseHttpMetrics(); // Must be registered after any middleware that could chagne HTTP response codes or the data will be bad
+            }
+
             app.UseEndpoints(endpoints =>
             {
                 endpoints.MapControllers();
-                endpoints.MapMetrics();
+                if (_serverConfigurationManager.Configuration.EnableMetrics)
+                {
+                    endpoints.MapMetrics();
+                }
             });
 
             app.Use(serverApplicationHost.ExecuteHttpHandlerAsync);
diff --git a/MediaBrowser.Model/Configuration/ServerConfiguration.cs b/MediaBrowser.Model/Configuration/ServerConfiguration.cs
index b5e8d5589..063ccd9b9 100644
--- a/MediaBrowser.Model/Configuration/ServerConfiguration.cs
+++ b/MediaBrowser.Model/Configuration/ServerConfiguration.cs
@@ -19,6 +19,11 @@ namespace MediaBrowser.Model.Configuration
         /// </summary>
         public bool EnableUPnP { get; set; }
 
+        /// <summary>
+        /// Gets or sets a value indicating whether to enable prometheus metrics exporting.
+        /// </summary>
+        public bool EnableMetrics { get; set; }
+
         /// <summary>
         /// Gets or sets the public mapped port.
         /// </summary>
@@ -246,6 +251,7 @@ namespace MediaBrowser.Model.Configuration
             PublicHttpsPort = DefaultHttpsPort;
             HttpServerPortNumber = DefaultHttpPort;
             HttpsPortNumber = DefaultHttpsPort;
+            EnableMetrics = false;
             EnableHttps = false;
             EnableDashboardResponseCaching = true;
             EnableCaseSensitiveItemIds = true;