diff --git a/mercurial/bookmarks.py b/mercurial/bookmarks.py
--- a/mercurial/bookmarks.py
+++ b/mercurial/bookmarks.py
@@ -445,6 +445,8 @@
     return d
 
 def pushbookmark(repo, key, old, new):
+    if repo.ui.configbool('server', 'bookmarks-pushkey-reject'):
+        return False
     if bookmarksinstore(repo):
         wlock = util.nullcontextmanager()
     else:
diff --git a/mercurial/configitems.py b/mercurial/configitems.py
--- a/mercurial/configitems.py
+++ b/mercurial/configitems.py
@@ -1027,6 +1027,9 @@
 coreconfigitem('server', 'bookmarks-pushkey-compat',
     default=True,
 )
+coreconfigitem('server', 'bookmarks-pushkey-reject',
+    default=False,
+)
 coreconfigitem('server', 'bundle1',
     default=True,
 )
diff --git a/tests/test-bookmarks-pushpull.t b/tests/test-bookmarks-pushpull.t
--- a/tests/test-bookmarks-pushpull.t
+++ b/tests/test-bookmarks-pushpull.t
@@ -1350,3 +1350,28 @@
   no changes found (ignored 1 secret changesets)
   abort: cannot push bookmark foo as it points to a secret changeset
   [255]
+
+Should fail to push a bookmark if server.bookmarks-pushkey-reject=true
+  $ hg init pb_server
+  $ cat << EOF >> pb_server/.hg/hgrc
+  > [server]
+  > bookmarks-pushkey-reject = true
+  > [web]
+  > push_ssl = false
+  > allow_push = *
+  > EOF
+  $ echo a > pb_server/a
+  $ hg --cwd pb_server add a
+  $ hg -R pb_server commit -m "Initial commit"
+  $ "$TESTDIR/killdaemons.py" $DAEMON_PIDS
+  $ hg serve -R pb_server -p $HGPORT --pid-file=pb_server.pid -d
+  $ cat pb_server.pid >> $DAEMON_PIDS
+  $ hg clone -q http://localhost:$HGPORT/ pb_copy
+  $ hg -R pb_copy book book1
+  $ hg -R pb_copy push -B book1 --config devel.legacy.exchange=bookmarks
+  pushing to http://localhost:$HGPORT/
+  searching for changes
+  no changes found
+  abort: exporting bookmark book1 failed!
+  [255]
+  $ "$TESTDIR/killdaemons.py" $DAEMON_PIDS