diff --git a/lib/mqtt.ts b/lib/mqtt.ts
index 8104ad6f5..50729a862 100644
--- a/lib/mqtt.ts
+++ b/lib/mqtt.ts
@@ -109,6 +109,11 @@ export default class Mqtt {
             options.rejectUnauthorized = false;
         }
 
+        if (mqttSettings.server_name) {
+            logger.debug(`MQTT SSL/TLS: SNI server name = ${mqttSettings.server_name}`);
+            options.servername = mqttSettings.server_name;
+        }
+
         this.client = await connectAsync(mqttSettings.server, options);
 
         // https://github.com/Koenkk/zigbee2mqtt/issues/9822
diff --git a/lib/types/api.ts b/lib/types/api.ts
index 373591cd5..eac20e8bd 100644
--- a/lib/types/api.ts
+++ b/lib/types/api.ts
@@ -133,6 +133,7 @@ export interface Zigbee2MQTTSettings {
         cert?: string;
         client_id?: string;
         reject_unauthorized?: boolean;
+        server_name?: string;
         maximum_packet_size: number;
     };
     serial: {
diff --git a/lib/util/settings.schema.json b/lib/util/settings.schema.json
index 1f997aa86..d265836e2 100644
--- a/lib/util/settings.schema.json
+++ b/lib/util/settings.schema.json
@@ -188,6 +188,13 @@
                     "description": "Disable self-signed SSL certificate",
                     "default": true
                 },
+                "server_name": {
+                    "type": "string",
+                    "title": "TLS server name (SNI)",
+                    "requiresRestart": true,
+                    "description": "Override the TLS SNI / hostname used for certificate verification when it differs from the host in 'server' (e.g. connecting to an internal service DNS name while validating a public certificate SAN). Leave unset to use the hostname from 'server'.",
+                    "examples": ["mqtt.example.com"]
+                },
                 "include_device_information": {
                     "type": "boolean",
                     "title": "Include device information",
diff --git a/test/controller.test.ts b/test/controller.test.ts
index 116524799..70fcbae89 100644
--- a/test/controller.test.ts
+++ b/test/controller.test.ts
@@ -149,6 +149,7 @@ describe("Controller", () => {
             user: "user1",
             client_id: "my_client_id",
             reject_unauthorized: false,
+            server_name: "mqtt.example.com",
             version: 5,
             maximum_packet_size: 20000,
         };
@@ -166,6 +167,7 @@ describe("Controller", () => {
             username: "user1",
             clientId: "my_client_id",
             rejectUnauthorized: false,
+            servername: "mqtt.example.com",
             protocolVersion: 5,
             properties: {maximumPacketSize: 20000},
         };