diff --git a/README.md b/README.md
index c374d7836..1e4fb906d 100644
--- a/README.md
+++ b/README.md
@@ -180,6 +180,7 @@ option and which are reproduced below:
 	  -x, --xmlrpc-format=INT          XMLRPC timeout request format to use. 0: SEMS DI, 1: call-id only
 	  --num-threads=INT                Number of worker threads to create
 	  --sip-source                     Use SIP source address by default
+	  --dtls-passive                   Always prefer DTLS passive role
 
 Most of these options are indeed optional, with two exceptions. It's mandatory to specify at least one local
 IP address through `--interface`, and at least one of the `--listen-...` options must be given.
@@ -330,6 +331,10 @@ The options are described in more detail below.
 	message as default endpoint address. Newer versions of *rtpengine* reverse this behaviour and
 	honour the addresses given in the SDP body by default. This option restores the old behaviour.
 
+* --dtls-passive
+
+	Enabled the `DTLS=passive` flag for all calls unconditionally.
+
 * -r, --redis, -R, --redis-db, -b, --b2b-url
 
 	NGCP-specific options
diff --git a/daemon/call_interfaces.c b/daemon/call_interfaces.c
index c7bc88744..9425b88a8 100644
--- a/daemon/call_interfaces.c
+++ b/daemon/call_interfaces.c
@@ -20,6 +20,7 @@
 
 
 int trust_address_def;
+int dtls_passive_def;
 
 
 
@@ -484,6 +485,7 @@ static void call_ng_process_flags(struct sdp_ng_flags *out, bencode_item_t *inpu
 	ZERO(*out);
 
 	out->trust_address = trust_address_def;
+	out->dtls_passive = dtls_passive_def;
 
 	if ((list = bencode_dictionary_get_expect(input, "flags", BENCODE_LIST))) {
 		for (it = list->child; it; it = it->sibling) {
diff --git a/daemon/call_interfaces.h b/daemon/call_interfaces.h
index 38ffde8cb..b6df0dab2 100644
--- a/daemon/call_interfaces.h
+++ b/daemon/call_interfaces.h
@@ -16,6 +16,7 @@ struct control_stream;
 
 
 extern int trust_address_def;
+extern int dtls_passive_def;
 
 
 str *call_request_tcp(char **, struct callmaster *);
diff --git a/daemon/main.c b/daemon/main.c
index 28b45997a..6975dea8d 100644
--- a/daemon/main.c
+++ b/daemon/main.c
@@ -337,6 +337,7 @@ static void options(int *argc, char ***argv) {
 		{ "xmlrpc-format",'x', 0, G_OPTION_ARG_INT,	&xmlrpc_fmt,	"XMLRPC timeout request format to use. 0: SEMS DI, 1: call-id only",	"INT"	},
 		{ "num-threads",  0, 0, G_OPTION_ARG_INT,	&num_threads,	"Number of worker threads to create",	"INT"	},
 		{ "sip-source",  0,  0, G_OPTION_ARG_NONE,	&sip_source,	"Use SIP source address by default",	NULL	},
+		{ "dtls-passive", 0, 0, G_OPTION_ARG_NONE,	&dtls_passive_def,"Always prefer DTLS passive role",	NULL	},
 		{ NULL, }
 	};