diff --git a/salt/soc/defaults.yaml b/salt/soc/defaults.yaml
index 4eeae5579..c93e8d87a 100644
--- a/salt/soc/defaults.yaml
+++ b/salt/soc/defaults.yaml
@@ -1821,6 +1821,7 @@ soc:
         cacheExpirationMs: 300000
         casesEnabled: true
         detectionsEnabled: true
+        allowExternalMarkdownImages: false
         inactiveTools: ['toolUnused']
         exportNodeId:
         tools:
diff --git a/salt/soc/soc_soc.yaml b/salt/soc/soc_soc.yaml
index a98cbb908..11ded60aa 100644
--- a/salt/soc/soc_soc.yaml
+++ b/salt/soc/soc_soc.yaml
@@ -1155,6 +1155,11 @@ soc:
           description: Set to true to enable the Detections module in SOC.
           global: True
           forcedType: bool
+        allowExternalMarkdownImages:
+          description: Set to true to let user-written Markdown, such as case descriptions and comments, load images from other servers. Loading an image sends a request to its server, so leave this disabled unless needed; Onion AI output never loads external images.
+          global: True
+          advanced: True
+          forcedType: bool
         inactiveTools:
           description: List of external tools to remove from the SOC UI.
           global: True