diff --git a/control-plane/roles/metal/README.md b/control-plane/roles/metal/README.md
index 5c1866e03..c8826e7ae 100644
--- a/control-plane/roles/metal/README.md
+++ b/control-plane/roles/metal/README.md
@@ -72,6 +72,7 @@ You can look up all the default values of this role [here](defaults/main.yaml).
 | metal_api_nsq_tcp_address           |           | The tcp address of nsqd                                                                        |
 | metal_api_nsq_http_address          |           | The http address of nsqd (only used for in-cluster traffic)                                    |
 | metal_api_nsq_tls_enabled           |           | Enables TLS for nsq                                                                            |
+| metal_api_nsq_tls_require_mode      |           | The TLS require mode for nsq. One of `true`, `false` and `require-verify`                     |
 | metal_api_nsq_tls_secret_name       |           | The name of the secret where nsq certificates are stored                                       |
 | metal_api_nsq_tls_checksum          |           | The checksum of the nsq certificate data to imply a rolling update                             |
 | metal_api_grpc_tls_enabled          |           | Enables TLS for gRPC                                                                           |
diff --git a/control-plane/roles/metal/defaults/main.yaml b/control-plane/roles/metal/defaults/main.yaml
index 6130e054b..4dc66b3b3 100644
--- a/control-plane/roles/metal/defaults/main.yaml
+++ b/control-plane/roles/metal/defaults/main.yaml
@@ -70,6 +70,7 @@ metal_api_nsq_tcp_address: "{{ metal_control_plane_ingress_dns }}:4150"
 metal_api_nsq_http_address: "nsqd:4151"
 metal_api_nsq_lookupd_address: "nsq-lookupd:4161"
 metal_api_nsq_tls_enabled: true
+metal_api_nsq_tls_require_mode: tcp-https
 metal_api_nsq_tls_secret_name: nsqd
 metal_api_nsq_tls_checksum: "{{ lookup('k8s', api_version='v1', namespace=metal_control_plane_namespace, kind='Secret', resource_name='nsqd').get('data', {}) | string | hash('sha1') if metal_api_nsq_tls_enabled else None }}"
 metal_api_grpc_tls_enabled: true
diff --git a/control-plane/roles/nsq/README.md b/control-plane/roles/nsq/README.md
index 1b9508e32..26dca1ead 100644
--- a/control-plane/roles/nsq/README.md
+++ b/control-plane/roles/nsq/README.md
@@ -27,6 +27,7 @@ You can look up all the default values of this role [here](defaults/main.yaml).
 | nsq_broadcast_address            |           | The nsq broadcast address                                                                                                          |
 | nsq_nsqd_data_size               |           | The size of the nsqd data volume (used when memory cache is full)                                                                  |
 | nsq_tls_enabled                  |           | Enables TLS for nsq                                                                                                                |
+| nsq_tls_require_mode             |           | The TLS require mode for nsq. One of `true`, `false` and `require-verify`                                                      |
 | nsq_certs_client_key             |           | The nsq certificate client key as a string                                                                                         |
 | nsq_certs_client_cert            |           | The nsq client certificate as a string                                                                                             |
 | nsq_certs_ca_cert                |           | The nsq ca certificate as a string                                                                                                 |
diff --git a/control-plane/roles/nsq/defaults/main.yaml b/control-plane/roles/nsq/defaults/main.yaml
index ca2f103d9..ec753cf20 100644
--- a/control-plane/roles/nsq/defaults/main.yaml
+++ b/control-plane/roles/nsq/defaults/main.yaml
@@ -22,6 +22,7 @@ nsq_broadcast_address: "{{ metal_control_plane_ingress_dns }}"
 nsq_nsqd_data_size: 100Mi
 
 nsq_tls_enabled: false
+nsq_tls_require_mode: false
 nsq_certs_client_key:
 nsq_certs_client_cert:
 nsq_certs_ca_cert:
diff --git a/control-plane/roles/nsq/templates/nsq.yaml b/control-plane/roles/nsq/templates/nsq.yaml
index 7c87b7b95..96406a33e 100644
--- a/control-plane/roles/nsq/templates/nsq.yaml
+++ b/control-plane/roles/nsq/templates/nsq.yaml
@@ -51,7 +51,11 @@ spec:
         - -broadcast-address={{ nsq_broadcast_address }}
         - -data-path=/data
 {% if nsq_tls_enabled %}
-        - -tls-required=tcp-https
+{% if nsq_tls_require_mode is boolean %}
+- -tls-required={{ nsq_tls_require_mode | to_json }}
+{% else %}
+- -tls-required={{ nsq_tls_require_mode | default("tcp-https") }}
+{% endif %}
         - -tls-client-auth-policy=require-verify
         - -tls-root-ca-file=/certs/ca.pem
         - -tls-cert=/certs/client.pem