diff --git a/cmd/osctrld/config.go b/cmd/osctrld/config.go
index 4779d20..2e66e25 100644
--- a/cmd/osctrld/config.go
+++ b/cmd/osctrld/config.go
@@ -29,6 +29,26 @@ type Configuration struct {
 	ExtensionsDir string `json:"extensionsDir" yaml:"extensionsDir" mapstructure:"extensionsDir"`
 }
 
+func defaultConfigurationYAML() string {
+	return `osctrld:
+  secret: "replace-with-enrollment-secret"
+  secretFile: "/path/to/osquery.secret"
+  flags: "/path/to/osquery.flags"
+  cert: "/path/to/osctrl.crt"
+  enrollScript: "/path/to/osctrld-enroll.sh"
+  removeScript: "/path/to/osctrld-remove.sh"
+  osquery: "/path/to/osquery/"
+  environment: "environment_name_or_UUID"
+  baseurl: "https://osctrl.url"
+  insecure: false
+  verbose: false
+  force: false
+  logFormat: "text"
+  interval: 60
+  extensionsDir: "/path/to/extensions/"
+`
+}
+
 func loadConfiguration(file string, verbose bool) (Configuration, error) {
 	var cfg Configuration
 	log.Debug().Str("path", file).Msg("loading configuration")
diff --git a/cmd/osctrld/main.go b/cmd/osctrld/main.go
index 39b4c42..a822d08 100644
--- a/cmd/osctrld/main.go
+++ b/cmd/osctrld/main.go
@@ -1,6 +1,7 @@
 package main
 
 import (
+	"fmt"
 	"os"
 	"runtime"
 
@@ -65,7 +66,7 @@ var (
 // Variables for flags
 var (
 	configFile string
-	appConfig Configuration
+	appConfig  Configuration
 	osctrlURLs OsctrlURLs
 )
 
@@ -216,6 +217,14 @@ func init() {
 			Usage:  "Run as a daemon, periodically syncing flags and certificate",
 			Action: cliWrapper(serviceNode),
 		},
+		{
+			Name:  "default-config",
+			Usage: "Print a default YAML configuration",
+			Action: func(c *cli.Context) error {
+				_, err := fmt.Fprint(c.App.Writer, defaultConfigurationYAML())
+				return err
+			},
+		},
 	}
 }
 
diff --git a/cmd/osctrld/main_test.go b/cmd/osctrld/main_test.go
index 94fbc16..eb17e80 100644
--- a/cmd/osctrld/main_test.go
+++ b/cmd/osctrld/main_test.go
@@ -1,9 +1,14 @@
 package main
 
 import (
+	"bytes"
+	"os"
+	"path/filepath"
+	"strings"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )
 
 func TestForceFlagDoesNotAffectVerbose(t *testing.T) {
@@ -23,3 +28,46 @@ func TestVerboseFlagDoesNotAffectForce(t *testing.T) {
 	assert.True(t, appConfig.Verbose, "Verbose should be true when --verbose flag is set")
 	assert.False(t, appConfig.Force, "Force should be false when only --verbose flag is set")
 }
+
+func TestDefaultConfigCommandWritesLoadableYAML(t *testing.T) {
+	appConfig = Configuration{}
+	configFile = defEmptyValue
+	app := buildApp()
+
+	var stdout bytes.Buffer
+	app.Writer = &stdout
+
+	err := app.Run([]string{"osctrld", "default-config"})
+	require.NoError(t, err)
+
+	output := stdout.String()
+	assert.True(t, strings.HasPrefix(output, "osctrld:\n"))
+	assert.Contains(t, output, `secret: "replace-with-enrollment-secret"`)
+	assert.Contains(t, output, `secretFile: "/path/to/osquery.secret"`)
+	assert.Contains(t, output, `flags: "/path/to/osquery.flags"`)
+	assert.Contains(t, output, `cert: "/path/to/osctrl.crt"`)
+	assert.Contains(t, output, `enrollScript: "/path/to/osctrld-enroll.sh"`)
+	assert.Contains(t, output, `removeScript: "/path/to/osctrld-remove.sh"`)
+	assert.Contains(t, output, `osquery: "/path/to/osquery/"`)
+	assert.Contains(t, output, `environment: "environment_name_or_UUID"`)
+	assert.Contains(t, output, `baseurl: "https://osctrl.url"`)
+	assert.Contains(t, output, "insecure: false")
+	assert.Contains(t, output, "verbose: false")
+	assert.Contains(t, output, "force: false")
+	assert.Contains(t, output, `logFormat: "text"`)
+	assert.Contains(t, output, "interval: 60")
+	assert.Contains(t, output, `extensionsDir: "/path/to/extensions/"`)
+
+	configPath := filepath.Join(t.TempDir(), "osctrld.yaml")
+	require.NoError(t, os.WriteFile(configPath, []byte(output), 0644))
+
+	cfg, err := loadConfiguration(configPath, false)
+	require.NoError(t, err)
+	assert.Equal(t, "replace-with-enrollment-secret", cfg.Secret)
+	assert.Equal(t, "/path/to/osquery/", cfg.OsqueryPath)
+	assert.Equal(t, "/path/to/osctrld-enroll.sh", cfg.EnrollScript)
+	assert.Equal(t, "/path/to/osctrld-remove.sh", cfg.RemoveScript)
+	assert.False(t, cfg.Insecure)
+	assert.False(t, cfg.Force)
+	assert.Equal(t, 60, cfg.Interval)
+}