diff --git a/CHANGELOG.md b/CHANGELOG.md
index c7951df07..bf74fb93e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,8 @@
 
 FEATURE: New permission mode support for public frontends. Open permission mode frontends are available to all users in the service instance. Closed permission mode frontends reference the new `frontend_grants` table that can be used to control which accounts are allowed to create shares using that frontend. `zrok admin create frontend` now supports `--closed` flag to create closed permission mode frontends (https://github.com/openziti/zrok/issues/539)
 
+FEATURE: New config `defaultFrontend` that specifies the default frontend to be used for an environment (https://github.com/openziti/zrok/issues/663)
+
 FEATURE: Resource count limits now include `share_frontends` to limit the number of frontends that are allowed to make connections to a share (https://github.com/openziti/zrok/issues/650)
 
 FIX: use controller config spec v4 in the Docker instance
diff --git a/cmd/zrok/sharePublic.go b/cmd/zrok/sharePublic.go
index 931365a5e..99b7a270b 100644
--- a/cmd/zrok/sharePublic.go
+++ b/cmd/zrok/sharePublic.go
@@ -45,7 +45,7 @@ func newSharePublicCommand() *sharePublicCommand {
 		Args:  cobra.ExactArgs(1),
 	}
 	command := &sharePublicCommand{cmd: cmd}
-	cmd.Flags().StringArrayVar(&command.frontendSelection, "frontends", []string{"public"}, "Selected frontends to use for the share")
+	cmd.Flags().StringArrayVar(&command.frontendSelection, "frontend", []string{"public|<defaultFrontend>"}, "Selected frontends to use for the share")
 	cmd.Flags().StringVarP(&command.backendMode, "backend-mode", "b", "proxy", "The backend mode {proxy, web, caddy, drive}")
 	cmd.Flags().BoolVar(&command.headless, "headless", false, "Disable TUI and run headless")
 	cmd.Flags().BoolVar(&command.insecure, "insecure", false, "Enable insecure TLS certificate validation for <target>")
diff --git a/environment/env_core/model.go b/environment/env_core/model.go
index 8c8384291..ebb1df349 100644
--- a/environment/env_core/model.go
+++ b/environment/env_core/model.go
@@ -13,6 +13,7 @@ type Root interface {
 
 	Client() (*rest_client_zrok.Zrok, error)
 	ApiEndpoint() (string, string)
+	DefaultFrontend() (string, string)
 
 	IsEnabled() bool
 	Environment() *Environment
@@ -34,7 +35,8 @@ type Environment struct {
 }
 
 type Config struct {
-	ApiEndpoint string
+	ApiEndpoint     string
+	DefaultFrontend string
 }
 
 type Metadata struct {
diff --git a/environment/env_v0_3/api.go b/environment/env_v0_3/api.go
index b7bd285ce..61a03296a 100644
--- a/environment/env_v0_3/api.go
+++ b/environment/env_v0_3/api.go
@@ -85,6 +85,24 @@ func (r *Root) ApiEndpoint() (string, string) {
 	return apiEndpoint, from
 }
 
+func (r *Root) DefaultFrontend() (string, string) {
+	defaultFrontend := "public"
+	from := "binary"
+
+	if r.Config() != nil && r.Config().DefaultFrontend != "" {
+		defaultFrontend = r.Config().DefaultFrontend
+		from = "config"
+	}
+
+	env := os.Getenv("ZROK_DEFAULT_FRONTEND")
+	if env != "" {
+		defaultFrontend = env
+		from = "ZROK_DEFAULT_FRONTEND"
+	}
+
+	return defaultFrontend, from
+}
+
 func (r *Root) Environment() *env_core.Environment {
 	return r.env
 }
diff --git a/environment/env_v0_4/api.go b/environment/env_v0_4/api.go
index 3e08202b4..35db06c50 100644
--- a/environment/env_v0_4/api.go
+++ b/environment/env_v0_4/api.go
@@ -85,6 +85,24 @@ func (r *Root) ApiEndpoint() (string, string) {
 	return apiEndpoint, from
 }
 
+func (r *Root) DefaultFrontend() (string, string) {
+	defaultFrontend := "public"
+	from := "binary"
+
+	if r.Config() != nil && r.Config().DefaultFrontend != "" {
+		defaultFrontend = r.Config().DefaultFrontend
+		from = "config"
+	}
+
+	env := os.Getenv("ZROK_DEFAULT_FRONTEND")
+	if env != "" {
+		defaultFrontend = env
+		from = "ZROK_DEFAULT_FRONTEND"
+	}
+
+	return defaultFrontend, from
+}
+
 func (r *Root) Environment() *env_core.Environment {
 	return r.env
 }