diff --git a/roles/custom/matrix-matrixto/defaults/main.yml b/roles/custom/matrix-matrixto/defaults/main.yml
index 838b5e929..da3bf9e0d 100644
--- a/roles/custom/matrix-matrixto/defaults/main.yml
+++ b/roles/custom/matrix-matrixto/defaults/main.yml
@@ -97,6 +97,12 @@ matrix_matrixto_container_labels_traefik_additional_response_headers_auto: |
   }}
 matrix_matrixto_container_labels_traefik_additional_response_headers_custom: {}
 
+# Controls whether a `com.centurylinklabs.watchtower.enable=false` label will be attached to the container.
+# The label tells [Watchtower](https://containrrr.dev/watchtower/) (if in use) to skip this container.
+# The container image for this service is built locally (from source), so Watchtower cannot update it
+# and merely produces "digest retrieval failed" errors when it tries.
+matrix_matrixto_container_labels_watchtower_skip_enabled: true
+
 # matrix_matrixto_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
 # See `../templates/labels.j2` for details.
 #
diff --git a/roles/custom/matrix-matrixto/templates/labels.j2 b/roles/custom/matrix-matrixto/templates/labels.j2
index 54c45a4b6..ee9567754 100644
--- a/roles/custom/matrix-matrixto/templates/labels.j2
+++ b/roles/custom/matrix-matrixto/templates/labels.j2
@@ -56,4 +56,8 @@ traefik.http.routers.{{ matrix_matrixto_identifier }}.tls.certResolver={{ matrix
 traefik.http.services.{{ matrix_matrixto_identifier }}.loadbalancer.server.port={{ matrix_matrixto_container_http_port }}
 {% endif %}
 
+{% if matrix_matrixto_container_labels_watchtower_skip_enabled %}
+com.centurylinklabs.watchtower.enable=false
+{% endif %}
+
 {{ matrix_matrixto_container_labels_additional_labels }}