diff --git a/api/handlers/app.go b/api/handlers/app.go
index 146a693b1..7095f7578 100644
--- a/api/handlers/app.go
+++ b/api/handlers/app.go
@@ -35,6 +35,7 @@ const (
 	AppEnvVarsPath                    = "/v3/apps/{guid}/environment_variables"
 	AppEnvPath                        = "/v3/apps/{guid}/env"
 	AppPackagesPath                   = "/v3/apps/{guid}/packages"
+	AppSSHEnabledPath                 = "/v3/apps/{guid}/ssh_enabled"
 	invalidDropletMsg                 = "Unable to assign current droplet. Ensure the droplet exists and belongs to this app."
 
 	AppStartedState = "STARTED"
@@ -598,6 +599,13 @@ func (h *App) update(r *http.Request) (*routing.Response, error) {
 	return routing.NewResponse(http.StatusOK).WithBody(presenter.ForApp(app, h.serverURL)), nil
 }
 
+func (h *App) getSSHEnabled(r *http.Request) (*routing.Response, error) {
+	return routing.NewResponse(http.StatusOK).WithBody(presenter.AppSSHEnabled{
+		Enabled: false,
+		Reason:  "Disabled globally",
+	}), nil
+}
+
 func (h *App) UnauthenticatedRoutes() []routing.Route {
 	return nil
 }
@@ -621,5 +629,6 @@ func (h *App) AuthenticatedRoutes() []routing.Route {
 		{Method: "GET", Pattern: AppEnvPath, Handler: h.getEnvironment},
 		{Method: "GET", Pattern: AppPackagesPath, Handler: h.getPackages},
 		{Method: "PATCH", Pattern: AppPath, Handler: h.update},
+		{Method: "GET", Pattern: AppSSHEnabledPath, Handler: h.getSSHEnabled},
 	}
 }
diff --git a/api/handlers/app_test.go b/api/handlers/app_test.go
index 3a20d49f4..e1cd84598 100644
--- a/api/handlers/app_test.go
+++ b/api/handlers/app_test.go
@@ -1580,6 +1580,21 @@ var _ = Describe("App", func() {
 			})
 		})
 	})
+
+	Describe("GET /v3/apps/GUID/ssh_enabled", func() {
+		BeforeEach(func() {
+			req = createHttpRequest("GET", "/v3/apps/"+appGUID+"/ssh_enabled", nil)
+		})
+
+		It("returns false", func() {
+			Expect(rr).To(HaveHTTPStatus(http.StatusOK))
+			Expect(rr).To(HaveHTTPHeaderWithValue("Content-Type", "application/json"))
+			Expect(rr).To(HaveHTTPBody(SatisfyAll(
+				MatchJSONPath("$.enabled", BeFalse()),
+				MatchJSONPath("$.reason", Equal("Disabled globally")),
+			)))
+		})
+	})
 })
 
 func createHttpRequest(method string, url string, body io.Reader) *http.Request {
diff --git a/api/presenter/app.go b/api/presenter/app.go
index 3e6a877a8..c5b3b8c58 100644
--- a/api/presenter/app.go
+++ b/api/presenter/app.go
@@ -187,3 +187,8 @@ func emptyMapToAnyIfEmpty(m map[string]any) map[string]any {
 
 	return m
 }
+
+type AppSSHEnabled struct {
+	Enabled bool   `json:"enabled"`
+	Reason  string `json:"reason"`
+}
diff --git a/tests/e2e/apps_test.go b/tests/e2e/apps_test.go
index 5c2316ab9..77a8c75ad 100644
--- a/tests/e2e/apps_test.go
+++ b/tests/e2e/apps_test.go
@@ -955,4 +955,22 @@ var _ = Describe("Apps", func() {
 			Expect(result.Metadata.Annotations).To(HaveKeyWithValue("annkey", "annvalue"))
 		})
 	})
+
+	Describe("query SSH enabled", func() {
+		It("always returns false", func() {
+			var respObj struct {
+				Enabled bool   `json:"enabled"`
+				Reason  string `json:"reason"`
+			}
+
+			resp, err := certClient.R().
+				SetResult(&respObj).
+				Get("/v3/apps/any-guid/ssh_enabled")
+			Expect(err).NotTo(HaveOccurred())
+
+			Expect(resp).To(HaveRestyStatusCode(http.StatusOK))
+			Expect(respObj.Enabled).To(BeFalse())
+			Expect(respObj.Reason).To(Equal("Disabled globally"))
+		})
+	})
 })