diff --git a/static-commontooling/make/docker.mk b/static-commontooling/make/docker.mk
index c706009..0424458 100644
--- a/static-commontooling/make/docker.mk
+++ b/static-commontooling/make/docker.mk
@@ -79,6 +79,9 @@
 #    MS_DOCKER_PUSH_LATEST?=FALSE
 #       Set to TRUE to automatically run ms_docker-push-latest when make push is run, i.e. push with the "latest" tag
 #
+#    MS_DOCKER_ALLOW_PUSH?=TRUE
+#       Set to a value not equal to TRUE to prevent pushing Docker images. This value is output in the error message and may be used to provide the reason for the failure.
+#
 #    CLOUDFIT_BASE_NAME?=python
 #
 #    CLOUDFIT_BASE_LABEL?=latest
@@ -127,6 +130,7 @@ BUILD_ARTEFACT?=$(topbuilddir)/requirements.txt $(topbuilddir)/constraints.txt
 EXTRA_DOCKER_RUN_ARGS?=
 BASE_MOD_DIR?=
 ALLOW_LOCAL_WHEELS?=FALSE
+MS_DOCKER_ALLOW_PUSH?=TRUE
 
 ifndef DOCKER_TAGS
 export DOCKER_TAGS := $(shell $(PBRVERSION) --docker-tag)
diff --git a/static-commontooling/make/include/ms_docker.mk b/static-commontooling/make/include/ms_docker.mk
index b4b151f..d510758 100644
--- a/static-commontooling/make/include/ms_docker.mk
+++ b/static-commontooling/make/include/ms_docker.mk
@@ -97,7 +97,13 @@ ms_docker-run-%: ms_docker-build-%
 
 ms_docker-push: ms_docker-ver-push-$(DOCKERISED_VERSION)
 
-ms_docker-ver-push-%: push-check-changes ms_docker-build
+ms_docker-check-allow-push:
+	@if [ "$(MS_DOCKER_ALLOW_PUSH)" != "TRUE" ]; then \
+		echo ERROR: Docker image push has been disabled. $(MS_DOCKER_ALLOW_PUSH); \
+		exit 1; \
+	fi
+
+ms_docker-ver-push-%: push-check-changes ms_docker-check-allow-push ms_docker-build
 	docker tag $(MODNAME):$(BUILD_TAG) $(DOCKER_REPO)/$(MODNAME):$*
 ifeq (${IS_ECR_REGISTRY},true)
 	$(call ecr_docker_push,$(DOCKER_REPO)/$(MODNAME):$*)
@@ -105,7 +111,7 @@ else
 	docker push $(DOCKER_REPO)/$(MODNAME):$*
 endif
 
-ms_docker-push-%: push-check-changes ms_docker-build-%
+ms_docker-push-%: push-check-changes ms_docker-check-allow-push ms_docker-build-%
 	docker tag $(MODNAME)_$*:$(BUILD_TAG) $(DOCKER_REPO)/$(MODNAME)_$*:$(DOCKERISED_VERSION)
 ifeq (${IS_ECR_REGISTRY},true)
 	$(call ecr_docker_push,$(DOCKER_REPO)/$(MODNAME)_$*:$(DOCKERISED_VERSION))
@@ -113,7 +119,7 @@ else
 	docker push $(DOCKER_REPO)/$(MODNAME)_$*:$(DOCKERISED_VERSION)
 endif
 
-ms_docker-push-latest-%: push-check-changes ms_docker-build-%
+ms_docker-push-latest-%: push-check-changes ms_docker-check-allow-push ms_docker-build-%
 	docker tag $(MODNAME)_$*:$(BUILD_TAG) $(DOCKER_REPO)/$(MODNAME)_$*:latest
 ifeq (${IS_ECR_REGISTRY},true)
 	$(call ecr_docker_push,$(DOCKER_REPO)/$(MODNAME)_$*:latest)
@@ -138,4 +144,4 @@ $(topbuilddir)/externals.json:
 ${MS_DOCKERFILE}: $(MS_DOCKERFILE_TEMPLATE) $(commontooling_dir)/docker/Dockerfile_multi_macros.j2 $(topbuilddir)/externals.json
 	$(J2) $< externals.json > $@
 
-.PHONY: check-allow-local-wheels ms_docker-build ms_docker-run ms_docker-clean ms_docker-push pull-cloudfit-base
+.PHONY: check-allow-local-wheels ms_docker-build ms_docker-run ms_docker-clean ms_docker-push pull-cloudfit-base ms_docker-check-allow-push