diff --git a/bin/core/src/api/execute/maintenance.rs b/bin/core/src/api/execute/maintenance.rs
index 984d0dc02..2673e2881 100644
--- a/bin/core/src/api/execute/maintenance.rs
+++ b/bin/core/src/api/execute/maintenance.rs
@@ -2,7 +2,10 @@ use std::{fmt::Write as _, sync::OnceLock};
 
 use anyhow::{Context, anyhow};
 use command::run_komodo_command;
-use database::mungos::{find::find_collect, mongodb::bson::doc};
+use database::{
+  bson::{Document, doc},
+  mungos::find::find_collect,
+};
 use formatting::{bold, format_serror};
 use futures::StreamExt;
 use komodo_client::{
@@ -351,7 +354,7 @@ impl Resolve<ExecuteArgs> for RotateAllServerKeys {
 
     let mut servers = db_client()
       .servers
-      .find(doc! { "config.enabled": true })
+      .find(Document::new())
       .await
       .context("Failed to query servers from database")?;
 
@@ -367,6 +370,22 @@ impl Resolve<ExecuteArgs> for RotateAllServerKeys {
           continue;
         }
       };
+      if !server.config.enabled {
+        let _ = write!(
+          &mut log,
+          "\nSkipping {}: Server Disabled ⚙️",
+          bold(&server.name)
+        );
+        continue;
+      }
+      if !server.config.auto_rotate_keys {
+        let _ = write!(
+          &mut log,
+          "\nSkipping {}: Key Rotation Disabled ⚙️",
+          bold(&server.name)
+        );
+        continue;
+      }
       let Some(status) = server_status_cache.get(&server.id).await
       else {
         let _ = write!(
diff --git a/client/core/rs/src/entities/server.rs b/client/core/rs/src/entities/server.rs
index ed5d33f4d..5cc671df5 100644
--- a/client/core/rs/src/entities/server.rs
+++ b/client/core/rs/src/entities/server.rs
@@ -118,6 +118,14 @@ pub struct ServerConfig {
   #[partial_default(default_enabled())]
   pub enabled: bool,
 
+  /// Whether to automatically rotate Server keys when
+  /// RotateAllServerKeys is called.
+  /// Default: true
+  #[serde(default = "default_auto_rotate_keys")]
+  #[builder(default = "default_auto_rotate_keys()")]
+  #[partial_default(default_auto_rotate_keys())]
+  pub auto_rotate_keys: bool,
+
   /// Deprecated. Use private / public keys instead.
   /// An optional override passkey to use
   /// to authenticate with periphery agent.
@@ -136,13 +144,6 @@ pub struct ServerConfig {
   #[builder(default)]
   pub ignore_mounts: Vec<String>,
 
-  /// Whether to monitor any server stats beyond passing health check.
-  /// default: true
-  #[serde(default = "default_stats_monitoring")]
-  #[builder(default = "default_stats_monitoring()")]
-  #[partial_default(default_stats_monitoring())]
-  pub stats_monitoring: bool,
-
   /// Whether to trigger 'docker image prune -a -f' every 24 hours.
   /// default: true
   #[serde(default = "default_auto_prune")]
@@ -159,6 +160,13 @@ pub struct ServerConfig {
   #[builder(default)]
   pub links: Vec<String>,
 
+  /// Whether to monitor any server stats beyond passing health check.
+  /// default: true
+  #[serde(default = "default_stats_monitoring")]
+  #[builder(default = "default_stats_monitoring()")]
+  #[partial_default(default_stats_monitoring())]
+  pub stats_monitoring: bool,
+
   /// Whether to send alerts about the servers reachability
   #[serde(default = "default_send_alerts")]
   #[builder(default = "default_send_alerts()")]
@@ -246,6 +254,10 @@ fn default_enabled() -> bool {
   false
 }
 
+fn default_auto_rotate_keys() -> bool {
+  true
+}
+
 fn default_stats_monitoring() -> bool {
   true
 }
@@ -289,6 +301,7 @@ impl Default for ServerConfig {
       insecure_tls: default_insecure_tls(),
       external_address: Default::default(),
       enabled: default_enabled(),
+      auto_rotate_keys: Default::default(),
       ignore_mounts: Default::default(),
       stats_monitoring: default_stats_monitoring(),
       auto_prune: default_auto_prune(),
diff --git a/client/core/ts/src/types.ts b/client/core/ts/src/types.ts
index b630431c3..b51d95286 100644
--- a/client/core/ts/src/types.ts
+++ b/client/core/ts/src/types.ts
@@ -2130,6 +2130,12 @@ export interface ServerConfig {
 	 * Default: false
 	 */
 	enabled: boolean;
+	/**
+	 * Whether to automatically rotate Server keys when
+	 * RotateAllServerKeys is called.
+	 * Default: true
+	 */
+	auto_rotate_keys: boolean;
 	/**
 	 * Deprecated. Use private / public keys instead.
 	 * An optional override passkey to use
@@ -2142,11 +2148,6 @@ export interface ServerConfig {
 	 * Use this field to filter it out from the report.
 	 */
 	ignore_mounts?: string[];
-	/**
-	 * Whether to monitor any server stats beyond passing health check.
-	 * default: true
-	 */
-	stats_monitoring: boolean;
 	/**
 	 * Whether to trigger 'docker image prune -a -f' every 24 hours.
 	 * default: true
@@ -2154,6 +2155,11 @@ export interface ServerConfig {
 	auto_prune: boolean;
 	/** Configure quick links that are displayed in the resource header */
 	links?: string[];
+	/**
+	 * Whether to monitor any server stats beyond passing health check.
+	 * default: true
+	 */
+	stats_monitoring: boolean;
 	/** Whether to send alerts about the servers reachability */
 	send_unreachable_alerts: boolean;
 	/** Whether to send alerts about the servers CPU status */
diff --git a/frontend/public/client/types.d.ts b/frontend/public/client/types.d.ts
index 0e7ce33c1..427827fc8 100644
--- a/frontend/public/client/types.d.ts
+++ b/frontend/public/client/types.d.ts
@@ -2259,6 +2259,12 @@ export interface ServerConfig {
      * Default: false
      */
     enabled: boolean;
+    /**
+     * Whether to automatically rotate Server keys when
+     * RotateAllServerKeys is called.
+     * Default: true
+     */
+    auto_rotate_keys: boolean;
     /**
      * Deprecated. Use private / public keys instead.
      * An optional override passkey to use
@@ -2271,11 +2277,6 @@ export interface ServerConfig {
      * Use this field to filter it out from the report.
      */
     ignore_mounts?: string[];
-    /**
-     * Whether to monitor any server stats beyond passing health check.
-     * default: true
-     */
-    stats_monitoring: boolean;
     /**
      * Whether to trigger 'docker image prune -a -f' every 24 hours.
      * default: true
@@ -2283,6 +2284,11 @@ export interface ServerConfig {
     auto_prune: boolean;
     /** Configure quick links that are displayed in the resource header */
     links?: string[];
+    /**
+     * Whether to monitor any server stats beyond passing health check.
+     * default: true
+     */
+    stats_monitoring: boolean;
     /** Whether to send alerts about the servers reachability */
     send_unreachable_alerts: boolean;
     /** Whether to send alerts about the servers CPU status */
diff --git a/frontend/src/components/resources/server/config.tsx b/frontend/src/components/resources/server/config.tsx
index 524148e16..ad22950d9 100644
--- a/frontend/src/components/resources/server/config.tsx
+++ b/frontend/src/components/resources/server/config.tsx
@@ -103,6 +103,10 @@ export const ServerConfig = ({
                   disabled={disabled}
                 />
               ),
+              auto_rotate_keys: {
+                description:
+                  "Automatically rotate keys when 'RotateAllServerKeys' is called.",
+              },
             },
           },
           {
diff --git a/lib/database/src/lib.rs b/lib/database/src/lib.rs
index 417b7cf51..6a85b1aab 100644
--- a/lib/database/src/lib.rs
+++ b/lib/database/src/lib.rs
@@ -36,6 +36,7 @@ use mungos::{
 
 pub use mongo_indexed;
 pub use mungos;
+pub use mungos::mongodb::bson;
 
 pub mod utils;