diff --git a/src/sql/src/plan/statement/dml.rs b/src/sql/src/plan/statement/dml.rs
index 495acf5336a9f..bd02257785f34 100644
--- a/src/sql/src/plan/statement/dml.rs
+++ b/src/sql/src/plan/statement/dml.rs
@@ -62,7 +62,7 @@ use crate::plan::{
     PlanError, QueryContext, ReadThenWritePlan, SelectPlan, SubscribeFrom, SubscribePlan,
 };
 use crate::plan::{with_options, CopyFromSource};
-use crate::session::vars;
+use crate::session::vars::{self, ENABLE_COPY_FROM_REMOTE};
 
 // TODO(benesch): currently, describing a `SELECT` or `INSERT` query
 // plans the whole query to determine its shape and parameter types,
@@ -1117,6 +1117,8 @@ fn plan_copy_from(
     let source = match target {
         CopyTarget::Stdin => CopyFromSource::Stdin,
         CopyTarget::Expr(from) => {
+            scx.require_feature_flag(&ENABLE_COPY_FROM_REMOTE)?;
+
             // Converting the to expr to a HirScalarExpr
             let mut from_expr = from.clone();
             transform_ast::transform(scx, &mut from_expr)?;
diff --git a/src/sql/src/session/vars/definitions.rs b/src/sql/src/session/vars/definitions.rs
index 3d1cccbb5c9f6..c0caa8d08d91a 100644
--- a/src/sql/src/session/vars/definitions.rs
+++ b/src/sql/src/session/vars/definitions.rs
@@ -2182,6 +2182,12 @@ feature_flags!(
         default: false,
         enable_for_item_parsing: true,
     },
+    {
+        name: enable_copy_from_remote,
+        desc: "Whether to allow COPY FROM <url>.",
+        default: false,
+        enable_for_item_parsing: false,
+    },
 );
 
 impl From<&super::SystemVars> for OptimizerFeatures {