diff --git a/code/controllers/configuration/configuration.dm b/code/controllers/configuration/configuration.dm
index 49ccb411fc..a9807a599c 100644
--- a/code/controllers/configuration/configuration.dm
+++ b/code/controllers/configuration/configuration.dm
@@ -74,6 +74,10 @@ GLOBAL_PROTECT(config_dir)
 		if(copytext(L, 1, 2) == "#")
 			continue
 
+		var/lockthis = copytext(L, 1, 2) == "@"
+		if(lockthis)
+			L = copytext(L, 2)
+
 		var/pos = findtext(L, " ")
 		var/entry = null
 		var/value = null
@@ -96,6 +100,9 @@ GLOBAL_PROTECT(config_dir)
 			log_config("Found [entry] in [filename] when it should have been in [E.resident_file]! Ignoring.")
 			continue
 
+		if(lockthis)
+			E.protection |= CONFIG_ENTRY_LOCKED
+
 		var/validated = E.ValidateAndSet(value)
 		if(!validated)
 			log_config("Failed to validate setting \"[value]\" for [entry]")
diff --git a/config/config.txt b/config/config.txt
index d5d2725714..72f168dcce 100644
--- a/config/config.txt
+++ b/config/config.txt
@@ -1,3 +1,11 @@
+# You can use the @ character at the beginning of a config option to lock it from being edited in-game
+# Example usage:
+# @SERVERNAME tgstation
+# Which sets the SERVERNAME, and disallows admins from being able to change it using View Variables.
+# @LOG_TWITTER 0
+# Which explicitly disables LOG_TWITTER, as well as locking it.
+# There are various options which are hard-locked for security reasons.
+
 ## Server name: This appears at the top of the screen in-game and in the BYOND hub. Uncomment and replace 'tgstation' with the name of your choice.
 # SERVERNAME tgstation