diff --git a/src/api/client/membership/mod.rs b/src/api/client/membership/mod.rs
index 4784921f..20c3a317 100644
--- a/src/api/client/membership/mod.rs
+++ b/src/api/client/membership/mod.rs
@@ -8,7 +8,7 @@ mod leave;
 mod members;
 mod unban;
 
-use std::net::IpAddr;
+use std::{cmp::Ordering, net::IpAddr};
 
 use axum::extract::State;
 use futures::{FutureExt, StreamExt};
@@ -205,5 +205,27 @@ async fn get_join_params(
 	servers.dedup();
 	servers.append(&mut additional_servers);
 
+	// sort deprioritized servers last
+	servers.sort_by(|a, b| {
+		let a_matches = services
+			.server
+			.config
+			.deprioritize_joins_through_servers
+			.is_match(a.host());
+		let b_matches = services
+			.server
+			.config
+			.deprioritize_joins_through_servers
+			.is_match(b.host());
+
+		if a_matches && !b_matches {
+			Ordering::Greater
+		} else if !a_matches && b_matches {
+			Ordering::Less
+		} else {
+			Ordering::Equal
+		}
+	});
+
 	Ok((room_id, servers))
 }
diff --git a/src/core/config/mod.rs b/src/core/config/mod.rs
index 564f641f..4bc94f65 100644
--- a/src/core/config/mod.rs
+++ b/src/core/config/mod.rs
@@ -1604,6 +1604,21 @@ pub struct Config {
 	#[serde(default, with = "serde_regex")]
 	pub forbidden_usernames: RegexSet,
 
+	/// List of server names to deprioritize joining through.
+	///
+	/// If a client requests a join through one of these servers,
+	/// they will be tried last.
+	///
+	/// Useful for preventing failed joins due to timeouts
+	/// from a certain homeserver.
+	///
+	/// default: ["matrix\.org"]
+	#[serde(
+		default = "default_deprioritize_joins_through_servers",
+		with = "serde_regex"
+	)]
+	pub deprioritize_joins_through_servers: RegexSet,
+
 	/// Retry failed and incomplete messages to remote servers immediately upon
 	/// startup. This is called bursting. If this is disabled, said messages may
 	/// not be delivered until more messages are queued for that server. Do not
@@ -2761,3 +2776,7 @@ fn default_client_sync_timeout_default() -> u64 { 30000 }
 fn default_client_sync_timeout_max() -> u64 { 90000 }
 
 fn default_access_token_ttl() -> u64 { 604_800 }
+
+fn default_deprioritize_joins_through_servers() -> RegexSet {
+	RegexSet::new([r"matrix\.org"]).unwrap()
+}
diff --git a/tuwunel-example.toml b/tuwunel-example.toml
index 639411fc..a3ddadbd 100644
--- a/tuwunel-example.toml
+++ b/tuwunel-example.toml
@@ -1382,6 +1382,16 @@
 #
 #forbidden_usernames = []
 
+# List of server names to deprioritize joining through.
+#
+# If a client requests a join through one of these servers,
+# they will be tried last.
+#
+# Useful for preventing failed joins due to timeouts
+# from a certain homeserver.
+#
+#deprioritize_joins_through_servers = ["matrix\.org"]
+
 # Retry failed and incomplete messages to remote servers immediately upon
 # startup. This is called bursting. If this is disabled, said messages may
 # not be delivered until more messages are queued for that server. Do not