diff --git a/apps/dav/lib/CardDAV/SyncService.php b/apps/dav/lib/CardDAV/SyncService.php
index 0dec815ec769a..c2a0310a3c352 100644
--- a/apps/dav/lib/CardDAV/SyncService.php
+++ b/apps/dav/lib/CardDAV/SyncService.php
@@ -46,7 +46,17 @@ public function __construct(
 	 * @psalm-return list{0: ?string, 1: boolean}
 	 * @throws \Exception
 	 */
-	public function syncRemoteAddressBook(string $url, string $userName, string $addressBookUrl, string $sharedSecret, ?string $syncToken, string $targetBookHash, string $targetPrincipal, array $targetProperties): array {
+	public function syncRemoteAddressBook(
+		string $url,
+		string $userName,
+		string $addressBookUrl,
+		string $sharedSecret,
+		?string $syncToken,
+		string $targetBookHash,
+		string $targetPrincipal,
+		array $targetProperties,
+		bool $tokenOnly = false,
+	): array {
 		// 1. create addressbook
 		$book = $this->ensureSystemAddressBookExists($targetPrincipal, $targetBookHash, $targetProperties);
 		$addressBookId = $book['id'];
@@ -55,6 +65,9 @@ public function syncRemoteAddressBook(string $url, string $userName, string $add
 		try {
 			$absoluteUri = $this->prepareUri($url, $addressBookUrl);
 			$response = $this->requestSyncReport($absoluteUri, $userName, $sharedSecret, $syncToken);
+			if ($tokenOnly) {
+				return [$response['token'], false];
+			}
 		} catch (ClientExceptionInterface $ex) {
 			if ($ex->getCode() === Http::STATUS_UNAUTHORIZED) {
 				// remote server revoked access to the address book, remove it
diff --git a/apps/federation/composer/composer/autoload_classmap.php b/apps/federation/composer/composer/autoload_classmap.php
index deca7ce3f04c8..15539dd33a240 100644
--- a/apps/federation/composer/composer/autoload_classmap.php
+++ b/apps/federation/composer/composer/autoload_classmap.php
@@ -12,6 +12,7 @@
     'OCA\\Federation\\BackgroundJob\\RequestSharedSecret' => $baseDir . '/../lib/BackgroundJob/RequestSharedSecret.php',
     'OCA\\Federation\\Command\\SyncFederationAddressBooks' => $baseDir . '/../lib/Command/SyncFederationAddressBooks.php',
     'OCA\\Federation\\Command\\SyncFederationCalendars' => $baseDir . '/../lib/Command/SyncFederationCalendars.php',
+    'OCA\\Federation\\ConfigLexicon' => $baseDir . '/../lib/ConfigLexicon.php',
     'OCA\\Federation\\Controller\\OCSAuthAPIController' => $baseDir . '/../lib/Controller/OCSAuthAPIController.php',
     'OCA\\Federation\\Controller\\SettingsController' => $baseDir . '/../lib/Controller/SettingsController.php',
     'OCA\\Federation\\DAV\\FedAuth' => $baseDir . '/../lib/DAV/FedAuth.php',
diff --git a/apps/federation/composer/composer/autoload_static.php b/apps/federation/composer/composer/autoload_static.php
index edae4c88ab97d..46a24bc9b4e76 100644
--- a/apps/federation/composer/composer/autoload_static.php
+++ b/apps/federation/composer/composer/autoload_static.php
@@ -27,6 +27,7 @@ class ComposerStaticInitFederation
         'OCA\\Federation\\BackgroundJob\\RequestSharedSecret' => __DIR__ . '/..' . '/../lib/BackgroundJob/RequestSharedSecret.php',
         'OCA\\Federation\\Command\\SyncFederationAddressBooks' => __DIR__ . '/..' . '/../lib/Command/SyncFederationAddressBooks.php',
         'OCA\\Federation\\Command\\SyncFederationCalendars' => __DIR__ . '/..' . '/../lib/Command/SyncFederationCalendars.php',
+        'OCA\\Federation\\ConfigLexicon' => __DIR__ . '/..' . '/../lib/ConfigLexicon.php',
         'OCA\\Federation\\Controller\\OCSAuthAPIController' => __DIR__ . '/..' . '/../lib/Controller/OCSAuthAPIController.php',
         'OCA\\Federation\\Controller\\SettingsController' => __DIR__ . '/..' . '/../lib/Controller/SettingsController.php',
         'OCA\\Federation\\DAV\\FedAuth' => __DIR__ . '/..' . '/../lib/DAV/FedAuth.php',
diff --git a/apps/federation/lib/AppInfo/Application.php b/apps/federation/lib/AppInfo/Application.php
index 7dde4b300557f..8b8f76f8ded63 100644
--- a/apps/federation/lib/AppInfo/Application.php
+++ b/apps/federation/lib/AppInfo/Application.php
@@ -9,6 +9,7 @@
 namespace OCA\Federation\AppInfo;
 
 use OCA\DAV\Events\SabrePluginAuthInitEvent;
+use OCA\Federation\ConfigLexicon;
 use OCA\Federation\Listener\SabrePluginAuthInitListener;
 use OCA\Federation\Listener\TrustedServerRemovedListener;
 use OCP\AppFramework\App;
@@ -32,6 +33,8 @@ public function __construct($urlParams = []) {
 	public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(SabrePluginAuthInitEvent::class, SabrePluginAuthInitListener::class);
 		$context->registerEventListener(TrustedServerRemovedEvent::class, TrustedServerRemovedListener::class);
+
+		$context->registerConfigLexicon(ConfigLexicon::class);
 	}
 
 	#[\Override]
diff --git a/apps/federation/lib/ConfigLexicon.php b/apps/federation/lib/ConfigLexicon.php
new file mode 100644
index 0000000000000..42c85a292e4c7
--- /dev/null
+++ b/apps/federation/lib/ConfigLexicon.php
@@ -0,0 +1,43 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OCA\Federation;
+
+use OCP\Config\Lexicon\Entry;
+use OCP\Config\Lexicon\ILexicon;
+use OCP\Config\Lexicon\Strictness;
+use OCP\Config\ValueType;
+
+/**
+ * Config Lexicon for federation.
+ *
+ * Please Add & Manage your Config Keys in that file and keep the Lexicon up to date!
+ *
+ * {@see ILexicon}
+ */
+class ConfigLexicon implements ILexicon {
+	public const string IGNORE_REMOTE_SYSTEM_ADDRESS_BOOK = 'ignore_remote_system_address_book';
+
+	#[\Override]
+	public function getStrictness(): Strictness {
+		return Strictness::NOTICE;
+	}
+
+	#[\Override]
+	public function getAppConfigs(): array {
+		return [
+			new Entry(self::IGNORE_REMOTE_SYSTEM_ADDRESS_BOOK, ValueType::BOOL, true, 'Ignore system address book from trusted servers', true, note: 'This does not stop your own instance from replying to request from trusted servers'),
+		];
+	}
+
+	#[\Override]
+	public function getUserConfigs(): array {
+		return [];
+	}
+}
diff --git a/apps/federation/lib/SyncFederationAddressBooks.php b/apps/federation/lib/SyncFederationAddressBooks.php
index f61cde8e10d3a..bd904fe3e74f1 100644
--- a/apps/federation/lib/SyncFederationAddressBooks.php
+++ b/apps/federation/lib/SyncFederationAddressBooks.php
@@ -10,6 +10,7 @@
 
 use OCA\DAV\CardDAV\SyncService;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Services\IAppConfig;
 use OCP\OCS\IDiscoveryService;
 use Psr\Log\LoggerInterface;
 
@@ -18,6 +19,7 @@ public function __construct(
 		protected DbHandler $dbHandler,
 		private SyncService $syncService,
 		private IDiscoveryService $ocsDiscoveryService,
+		private IAppConfig $appConfig,
 		private LoggerInterface $logger,
 	) {
 	}
@@ -64,7 +66,8 @@ public function syncThemAll(\Closure $callback, bool $full = false) {
 						$syncToken,
 						$targetBookId,
 						$targetPrincipal,
-						$targetBookProperties
+						$targetBookProperties,
+						$this->appConfig->getAppValueBool(ConfigLexicon::IGNORE_REMOTE_SYSTEM_ADDRESS_BOOK),
 					);
 				} while ($truncated);
 
diff --git a/apps/federation/tests/SyncFederationAddressbooksTest.php b/apps/federation/tests/SyncFederationAddressbooksTest.php
index 1dacbb288ba8e..77613d65f4e47 100644
--- a/apps/federation/tests/SyncFederationAddressbooksTest.php
+++ b/apps/federation/tests/SyncFederationAddressbooksTest.php
@@ -14,6 +14,7 @@
 use OCA\Federation\DbHandler;
 use OCA\Federation\SyncFederationAddressBooks;
 use OCA\Federation\TrustedServers;
+use OCP\AppFramework\Services\IAppConfig;
 use PHPUnit\Framework\MockObject\MockObject;
 use Psr\Log\LoggerInterface;
 
@@ -49,7 +50,7 @@ public function testSync(): void {
 			->willReturn(['1', false]);
 
 		/** @var SyncService $syncService */
-		$s = new SyncFederationAddressBooks($dbHandler, $syncService, $this->discoveryService, $this->logger);
+		$s = new SyncFederationAddressBooks($dbHandler, $syncService, $this->discoveryService, $this->createMock(IAppConfig::class), $this->logger);
 		$s->syncThemAll(function ($url, $ex): void {
 			$this->callBacks[] = [$url, $ex];
 		});
@@ -73,7 +74,7 @@ public function testException(): void {
 			->willThrowException(new \Exception('something did not work out'));
 
 		/** @var SyncService $syncService */
-		$s = new SyncFederationAddressBooks($dbHandler, $syncService, $this->discoveryService, $this->logger);
+		$s = new SyncFederationAddressBooks($dbHandler, $syncService, $this->discoveryService, $this->createMock(IAppConfig::class), $this->logger);
 		$s->syncThemAll(function ($url, $ex): void {
 			$this->callBacks[] = [$url, $ex];
 		});
@@ -100,7 +101,7 @@ public function testSuccessfulSyncWithoutChangesAfterFailure(): void {
 			->willReturn(['0', false]);
 
 		/** @var SyncService $syncService */
-		$s = new SyncFederationAddressBooks($dbHandler, $syncService, $this->discoveryService, $this->logger);
+		$s = new SyncFederationAddressBooks($dbHandler, $syncService, $this->discoveryService, $this->createMock(IAppConfig::class), $this->logger);
 		$s->syncThemAll(function ($url, $ex): void {
 			$this->callBacks[] = [$url, $ex];
 		});