diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 29f905c..6c9c645 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -558,6 +558,11 @@
  * client's. */
 #define SSL_OP_CIPHER_SERVER_PREFERENCE 0x00400000L
 
+/* SSL_OP_DISABLE_NPN configures an individual |SSL| to not advertise NPN,
+ * despite |SSL_CTX_set_next_proto_select_cb| being configured on the
+ * |SSL_CTX|. */
+#define SSL_OP_DISABLE_NPN 0x00800000L
+
 /* SSL_CTX_set_options enables all options set in |options| (which should be one
  * or more of the |SSL_OP_*| values, ORed together) in |ctx|. It returns a
  * bitmask representing the resulting enabled options. */
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 8efca84..8485ba3 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1374,6 +1374,7 @@
 static int ext_npn_add_clienthello(SSL *ssl, CBB *out) {
   if (ssl->s3->initial_handshake_complete ||
       ssl->ctx->next_proto_select_cb == NULL ||
+      (ssl->options & SSL_OP_DISABLE_NPN) ||
       SSL_IS_DTLS(ssl)) {
     return 1;
   }
@@ -1398,6 +1399,7 @@
   assert(!ssl->s3->initial_handshake_complete);
   assert(!SSL_IS_DTLS(ssl));
   assert(ssl->ctx->next_proto_select_cb != NULL);
+  assert(!(ssl->options & SSL_OP_DISABLE_NPN));
 
   if (ssl->s3->alpn_selected != NULL) {
     /* NPN and ALPN may not be negotiated in the same connection. */
diff --git a/ssl/test/bssl_shim.cc b/ssl/test/bssl_shim.cc
index a133d09..17a91ad 100644
--- a/ssl/test/bssl_shim.cc
+++ b/ssl/test/bssl_shim.cc
@@ -1124,6 +1124,9 @@
   if (!config->check_close_notify) {
     SSL_set_quiet_shutdown(ssl.get(), 1);
   }
+  if (config->disable_npn) {
+    SSL_set_options(ssl.get(), SSL_OP_DISABLE_NPN);
+  }
 
   int sock = Connect(config->port);
   if (sock == -1) {
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 01813f9..fb1e46f 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -3366,6 +3366,18 @@
 		shouldFail:    true,
 		expectedError: ":NEGOTIATED_BOTH_NPN_AND_ALPN:",
 	})
+	// Test that NPN can be disabled with SSL_OP_DISABLE_NPN.
+	testCases = append(testCases, testCase{
+		name: "DisableNPN",
+		config: Config{
+			NextProtos: []string{"foo"},
+		},
+		flags: []string{
+			"-select-next-proto", "foo",
+			"-disable-npn",
+		},
+		expectNoNextProto: true,
+	})
 	// Resume with a corrupt ticket.
 	testCases = append(testCases, testCase{
 		testType: serverTest,
diff --git a/ssl/test/test_config.cc b/ssl/test/test_config.cc
index 4e19be6..54492df 100644
--- a/ssl/test/test_config.cc
+++ b/ssl/test/test_config.cc
@@ -97,6 +97,7 @@
   { "-expect-verify-result", &TestConfig::expect_verify_result },
   { "-renegotiate-once", &TestConfig::renegotiate_once },
   { "-renegotiate-freely", &TestConfig::renegotiate_freely },
+  { "-disable-npn", &TestConfig::disable_npn },
 };
 
 const Flag<std::string> kStringFlags[] = {
diff --git a/ssl/test/test_config.h b/ssl/test/test_config.h
index 4601851..af1dd80 100644
--- a/ssl/test/test_config.h
+++ b/ssl/test/test_config.h
@@ -99,6 +99,7 @@
   int expect_total_renegotiations = 0;
   bool renegotiate_once = false;
   bool renegotiate_freely = false;
+  bool disable_npn = false;
 };
 
 bool ParseConfig(int argc, char **argv, TestConfig *out_config);