diff --git a/.env.example b/.env.example
index d28e24c..94a84bd 100644
--- a/.env.example
+++ b/.env.example
@@ -683,6 +683,9 @@
 ## Where the ENGINE reaches HyperDX. The in-stack service unless this names an
 ## external one; the profile decides whether the engine is pointed at it at all.
 # DFE_HYPERDX_BASE_URL=http://hyperdx:8000
+## Upstream HyperDX's usage stats, sent to in-otel.hyperdx.io -- a third party.
+## Off unless you choose to send them.
+# DFE_HYPERDX_USAGE_STATS_ENABLED=false
 # HYPERDX_THEME=dfe
 # HYPERDX_POSTGRES_USER=hyperdx
 #
diff --git a/docker-compose.yml b/docker-compose.yml
index 83fc61e..05ee259 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1573,6 +1573,10 @@ services:
       DFE_ENGINE_JWKS_URL: ${DFE_ENGINE_JWKS_URL:-http://dfe-engine:8000/.well-known/jwks.json}
       # The team a token carrying no group claim lands in.
       DFE_AUTH_DEFAULT_TEAM: ${DFE_HYPERDX_TEAM:-dfe}
+      # Upstream's usage-stats task reports to a third party, and reads each
+      # connection without its password, so it fails ClickHouse auth on every API
+      # start. Off unless the deployer opts in, the same default as the k8s chart.
+      USAGE_STATS_ENABLED: ${DFE_HYPERDX_USAGE_STATS_ENABLED:-false}
       # Setting the directory is what starts the provisioner: entry.prod.sh
       # launches the provision-dashboards task only when it is present. It then
       # re-runs on a one-minute cron, which is how a team created after startup
diff --git a/docs/configuration.md b/docs/configuration.md
index 7ffebd9..d8cd90c 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -322,6 +322,7 @@ The same toggle points the engine at HyperDX: with it on, the engine receives `D
 | `DFE_HYPERDX_AUTH_MODE`                          | `header-dev` runs HyperDX off request headers, for a stack with no engine            | `oidc-proxy`                                                        |
 | `DFE_HYPERDX_BASE_URL`                           | Where the ENGINE reaches HyperDX; name an external one here                          | `http://hyperdx:8000`                                               |
 | `DFE_HYPERDX_TEAM`                               | Team name when the token carries no group claim                                      | `dfe`                                                               |
+| `DFE_HYPERDX_USAGE_STATS_ENABLED`                | `true` sends upstream HyperDX's usage stats to `in-otel.hyperdx.io`, a third party   | `false`                                                             |
 | `HYPERDX_THEME`                                  | UI theme (NEXT_PUBLIC_THEME)                                                         | `dfe`                                                               |
 | `HYPERDX_POSTGRES_USER`                          | FerretDB/Postgres user                                                               | `hyperdx`                                                           |
 | `HYPERDX_POSTGRES_PASSWORD`                      | FerretDB/Postgres password                                                           | `hyperdx`                                                           |