diff --git a/CMakeLists.txt b/CMakeLists.txt
index 867c58d4b..635ce80ea 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -93,6 +93,7 @@ include(InstallFreeRDPMan)
 include(GetGitRevisionDescription)
 include(SetFreeRDPCMakeInstallDir)
 include(Doxygen)
+include(GetSysconfDir)
 
 # Soname versioning
 set(BUILD_NUMBER 0)
diff --git a/client/SDL/SDL2/man/CMakeLists.txt b/client/SDL/SDL2/man/CMakeLists.txt
index 0c1cd7d3c..1f243ac49 100644
--- a/client/SDL/SDL2/man/CMakeLists.txt
+++ b/client/SDL/SDL2/man/CMakeLists.txt
@@ -4,5 +4,7 @@ set(DEPS
     ../../common/man/sdl-freerdp-examples.1 ../../../common/man/freerdp-global-links.1
 )
 
-set(VAR_NAMES "VENDOR" "PRODUCT" "VENDOR_PRODUCT" "CMAKE_INSTALL_FULL_SYSCONFDIR")
+include(GetSysconfDir)
+get_sysconf_dir("" SYSCONF_DIR)
+set(VAR_NAMES "VENDOR" "PRODUCT" "VENDOR_PRODUCT" "SYSCONF_DIR")
 generate_and_install_freerdp_man_from_xml(${MODULE_NAME} "1" "${DEPS}" "${VAR_NAMES}")
diff --git a/client/SDL/SDL3/man/CMakeLists.txt b/client/SDL/SDL3/man/CMakeLists.txt
index 0c1cd7d3c..1f243ac49 100644
--- a/client/SDL/SDL3/man/CMakeLists.txt
+++ b/client/SDL/SDL3/man/CMakeLists.txt
@@ -4,5 +4,7 @@ set(DEPS
     ../../common/man/sdl-freerdp-examples.1 ../../../common/man/freerdp-global-links.1
 )
 
-set(VAR_NAMES "VENDOR" "PRODUCT" "VENDOR_PRODUCT" "CMAKE_INSTALL_FULL_SYSCONFDIR")
+include(GetSysconfDir)
+get_sysconf_dir("" SYSCONF_DIR)
+set(VAR_NAMES "VENDOR" "PRODUCT" "VENDOR_PRODUCT" "SYSCONF_DIR")
 generate_and_install_freerdp_man_from_xml(${MODULE_NAME} "1" "${DEPS}" "${VAR_NAMES}")
diff --git a/client/X11/man/CMakeLists.txt b/client/X11/man/CMakeLists.txt
index e56a56a29..eeb5a3fb5 100644
--- a/client/X11/man/CMakeLists.txt
+++ b/client/X11/man/CMakeLists.txt
@@ -1,7 +1,15 @@
-set(DEPS ../../common/man/freerdp-global-options.1 xfreerdp-shortcuts.1 ../../common/man/freerdp-global-envvar.1
-         ../../common/man/freerdp-global-config.1 xfreerdp-examples.1 ../../common/man/freerdp-global-links.1
+set(DEPS
+    ../../common/man/freerdp-global-options.1
+    xfreerdp-shortcuts.1
+    ../../common/man/freerdp-global-envvar.1
+    ../../common/man/freerdp-global-config.1
+    xfreerdp-global-config.1
+    xfreerdp-examples.1
+    ../../common/man/freerdp-global-links.1
 )
 
+include(GetSysconfDir)
+get_sysconf_dir("" SYSCONF_DIR)
 set(SDL_WIKI_BASE_URL "https://wiki.libsdl.org/SDL2")
-set(VAR_NAMES "VENDOR" "PRODUCT" "VENDOR_PRODUCT" "CMAKE_INSTALL_FULL_SYSCONFDIR" "SDL_WIKI_BASE_URL")
+set(VAR_NAMES "VENDOR" "PRODUCT" "VENDOR_PRODUCT" "SYSCONF_DIR" "SDL_WIKI_BASE_URL")
 generate_and_install_freerdp_man_from_xml(${MODULE_NAME} "1" "${DEPS}" "${VAR_NAMES}")
diff --git a/client/X11/man/xfreerdp-global-config.1.in b/client/X11/man/xfreerdp-global-config.1.in
new file mode 100644
index 000000000..fb84ed436
--- /dev/null
+++ b/client/X11/man/xfreerdp-global-config.1.in
@@ -0,0 +1,22 @@
+.SH "GLOBAL CONFIGURATION (X11 client)"
+.PP
+The X11 client configuration location is
+\fI@SYSCONF_DIR@/xfreerdp\&.json\fR
+.br
+
+File format is JSON
+.RE
+.PP
+Supported options:
+.RS 4
+.PP
+\fIisActionScriptAllowed\fR
+.RS 4
+.PP
+.RS 4
+\fIJSON boolean\fR
+.br
+
+Allow or block action scripts. Default (if option is not set) is to allow action scripts.
+.RE
+.RE
diff --git a/client/X11/xf_event.c b/client/X11/xf_event.c
index 2e35b398d..1239487a9 100644
--- a/client/X11/xf_event.c
+++ b/client/X11/xf_event.c
@@ -190,6 +190,15 @@ BOOL xf_event_action_script_init(xfContext* xfc)
 
 	xf_event_action_script_free(xfc);
 
+	char* val = getConfigOption(TRUE, "isActionScriptAllowed");
+
+	/* We default to enabled if there is no global config file. */
+	xfc->isActionScriptAllowed = !val || (_stricmp(val, "true") == 0);
+	free(val);
+
+	if (!xfc->isActionScriptAllowed)
+		return TRUE;
+
 	xfc->xevents = ArrayList_New(TRUE);
 
 	if (!xfc->xevents)
@@ -216,6 +225,9 @@ static BOOL action_script_run(xfContext* xfc, const char* buffer, size_t size, v
                               const char* what, const char* arg)
 {
 	WINPR_UNUSED(xfc);
+	if (!xfc->isActionScriptAllowed)
+		return TRUE;
+
 	WINPR_UNUSED(what);
 	WINPR_UNUSED(arg);
 	WINPR_ASSERT(user);
diff --git a/client/X11/xf_utils.c b/client/X11/xf_utils.c
index 0cd7d5bf1..4f691c89d 100644
--- a/client/X11/xf_utils.c
+++ b/client/X11/xf_utils.c
@@ -26,6 +26,7 @@
 #include "xf_utils.h"
 #include "xfreerdp.h"
 
+#include <freerdp/utils/helpers.h>
 #include <freerdp/log.h>
 
 #define TAG CLIENT_TAG("xfreerdp.utils")
@@ -732,3 +733,22 @@ int LogDynAndXReparentWindow_ex(wLog* log, const char* file, const char* fkt, si
 	return write_result_log_expect_one(log, WLOG_WARN, file, fkt, line, display, "XReparentWindow",
 	                                   rc);
 }
+
+char* getConfigOption(BOOL system, const char* option)
+{
+	char* res = NULL;
+	WINPR_JSON* file = freerdp_GetJSONConfigFile(system, "xfreerdp.json");
+	if (!file)
+		return NULL;
+
+	WINPR_JSON* obj = WINPR_JSON_GetObjectItem(file, option);
+	if (obj)
+	{
+		const char* val = WINPR_JSON_GetStringValue(obj);
+		if (val)
+			res = _strdup(val);
+	}
+	WINPR_JSON_Delete(file);
+
+	return res;
+}
diff --git a/client/X11/xf_utils.h b/client/X11/xf_utils.h
index 418f9c902..9cad40d93 100644
--- a/client/X11/xf_utils.h
+++ b/client/X11/xf_utils.h
@@ -289,3 +289,5 @@ extern int LogDynAndXSetFunction_ex(wLog* log, const char* file, const char* fkt
                                     Display* display, GC gc, int function);
 
 BOOL IsGnome(void);
+
+char* getConfigOption(BOOL system, const char* option);
diff --git a/client/X11/xfreerdp.h b/client/X11/xfreerdp.h
index c083ea8ea..834488c41 100644
--- a/client/X11/xfreerdp.h
+++ b/client/X11/xfreerdp.h
@@ -318,6 +318,7 @@ struct xf_context
 	FREERDP_REMAP_TABLE* remap_table;
 	DWORD X11_KEYCODE_TO_VIRTUAL_SCANCODE[256];
 	bool isCursorHidden;
+	bool isActionScriptAllowed;
 };
 
 BOOL xf_create_window(xfContext* xfc);
diff --git a/client/common/man/freerdp-global-config.1.in b/client/common/man/freerdp-global-config.1.in
index 557d036c5..21691a51a 100644
--- a/client/common/man/freerdp-global-config.1.in
+++ b/client/common/man/freerdp-global-config.1.in
@@ -1,12 +1,12 @@
-.SH "GLOBAL CONFIGURATION"
+.SH "GLOBAL CONFIGURATION (client common)"
 .PP
 Format and Location:
 .RS 4
-The configuration file is stored in global system configuration\&.
+The configuration files are stored in global system configuration\&.
 .br
 
-The location is
-\fI@CMAKE_INSTALL_FULL_SYSCONFDIR@/@VENDOR@/@PRODUCT@/certificates\&.json\fR
+The common certificate settings location is
+\fI@SYSCONF_DIR@/certificates\&.json\fR
 .br
 
 File format is JSON
diff --git a/cmake/GetSysconfDir.cmake b/cmake/GetSysconfDir.cmake
new file mode 100644
index 000000000..6a17182ff
--- /dev/null
+++ b/cmake/GetSysconfDir.cmake
@@ -0,0 +1,14 @@
+option(FREERDP_USE_VENDOR_PRODUCT_CONFIG_DIR "Use <vendor>/<product> path for resources" OFF)
+
+function(get_sysconf_dir name result)
+  set(CONF_FILE ${PRODUCT})
+  if(WITH_RESOURCE_VERSIONING)
+    string(APPEND CONF_FILE "${FREERDP_VERSION_MAJOR}")
+  endif()
+  if(FREERDP_USE_VENDOR_PRODUCT_CONFIG_DIR)
+    string(PREPEND CONF_FILE "${VENDOR}/")
+  endif()
+  string(PREPEND CONF_FILE "${CMAKE_INSTALL_FULL_SYSCONFDIR}/")
+  string(APPEND CONF_FILE "${name}")
+  set(${result} ${CONF_FILE} PARENT_SCOPE)
+endfunction()
diff --git a/libfreerdp/CMakeLists.txt b/libfreerdp/CMakeLists.txt
index caaec2ee5..fb465cafb 100644
--- a/libfreerdp/CMakeLists.txt
+++ b/libfreerdp/CMakeLists.txt
@@ -18,7 +18,6 @@
 set(MODULE_NAME "freerdp")
 set(MODULE_PREFIX "FREERDP")
 
-option(FREERDP_USE_VENDOR_PRODUCT_CONFIG_DIR "Use <vendor>/<product> path for resources" OFF)
 set(FREERDP_RESOURCE_ROOT ${CMAKE_INSTALL_FULL_DATAROOTDIR})
 if(FREERDP_USE_VENDOR_PRODUCT_CONFIG_DIR)
   string(APPEND FREERDP_RESOURCE_ROOT "/${VENDOR}")