diff --git a/templates/subapp.cfg.j2 b/templates/subapp.cfg.j2
index 4c43532352bb7b9a90e1779941d007413ecc4063..0c7c3d38ea68552bfa1643533be2a43af2ac168a 100644
--- a/templates/subapp.cfg.j2
+++ b/templates/subapp.cfg.j2
@@ -12,6 +12,9 @@ blacklist_sip_file:/home/{{ vault_subapp_user }}/.subapp/usa_blacklist_file.csv
 pid_file:/run/subapp/subapp_bagit.pid
 # Log4perl log level
 logger_min_level:debug
+# Blocking AIP updates
+ingest_only:{{ vault_subapp_vars.hosts[ansible_hostname].ingest_only | default("INGEST_ONLY_TEMPLATE") }}
+
 
 
 ############################
diff --git a/vars/subapp.vault.example b/vars/subapp.vault.example
index 89f730f2ec4e8413770b1e50c24aa3ae2536693a..e1f2709eba5fc8c9156f7e16fee03044f6249e3b 100644
--- a/vars/subapp.vault.example
+++ b/vars/subapp.vault.example
@@ -29,4 +29,5 @@ vault_subapp_vars:
       logger_producer_email: "example@example.com,foo@example.com, bar@example.com, (...)"
       logger_staff_email: "example@example.com,foo@example.com, bar@example.com, (...)"
       Rosetta_Password: "ROSETTA_PASSWORD_HERE"
+      ingest_only: "0_OR_1_HERE"
     # You an add more host configurations here.