diff --git a/changelog/unreleased/mask-user-email-in-output.md b/changelog/unreleased/mask-user-email-in-output.md
index 9f0b0c20a..e61e5e738 100644
--- a/changelog/unreleased/mask-user-email-in-output.md
+++ b/changelog/unreleased/mask-user-email-in-output.md
@@ -5,3 +5,4 @@ the sharee search. This is the ocis side which adds an suiting config option to
 
 https://github.com/owncloud/ocis/issues/8726
 https://github.com/cs3org/reva/pull/4603
+https://github.com/owncloud/ocis/pull/8764
diff --git a/services/graph/pkg/config/reva.go b/services/graph/pkg/config/reva.go
index 646c3f36e..50b52f33a 100644
--- a/services/graph/pkg/config/reva.go
+++ b/services/graph/pkg/config/reva.go
@@ -2,5 +2,6 @@ package config
 
 // TokenManager is the config for using the reva token manager
 type TokenManager struct {
-	JWTSecret string `yaml:"jwt_secret" env:"OCIS_JWT_SECRET;GRAPH_JWT_SECRET" desc:"The secret to mint and validate jwt tokens." introductionVersion:"pre5.0"`
+	JWTSecret              string `yaml:"jwt_secret" env:"OCIS_JWT_SECRET;GRAPH_JWT_SECRET" desc:"The secret to mint and validate jwt tokens." introductionVersion:"pre5.0"`
+	ShowUserEmailInResults bool   `yaml:"mask_user_email" env:"OCIS_SHOW_USER_EMAIL_IN_RESULTS" desc:"Mask user email addresses in responses." introductionVersion:"5.1"`
 }
diff --git a/services/graph/pkg/service/v0/users.go b/services/graph/pkg/service/v0/users.go
index b7d6c4fca..32fc7554f 100644
--- a/services/graph/pkg/service/v0/users.go
+++ b/services/graph/pkg/service/v0/users.go
@@ -279,9 +279,12 @@ func (g Graph) GetUsers(w http.ResponseWriter, r *http.Request) {
 			finalUsers[i] = &libregraph.User{
 				Id:          u.Id,
 				DisplayName: u.DisplayName,
-				Mail:        u.Mail,
 				UserType:    u.UserType,
 			}
+
+			if g.config.TokenManager.ShowUserEmailInResults {
+				finalUsers[i].Mail = u.Mail
+			}
 		}
 		users = finalUsers
 	}
@@ -545,6 +548,10 @@ func (g Graph) GetUser(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	if !g.config.TokenManager.ShowUserEmailInResults {
+		user.Mail = nil
+	}
+
 	render.Status(r, http.StatusOK)
 	render.JSON(w, r, user)
 }
diff --git a/services/ocs/pkg/config/reva.go b/services/ocs/pkg/config/reva.go
index 4192044b9..5089f92c6 100644
--- a/services/ocs/pkg/config/reva.go
+++ b/services/ocs/pkg/config/reva.go
@@ -3,5 +3,5 @@ package config
 // TokenManager is the config for using the reva token manager
 type TokenManager struct {
 	JWTSecret              string `yaml:"jwt_secret" env:"OCIS_JWT_SECRET;OCS_JWT_SECRET" desc:"The secret to mint and validate jwt tokens." introductionVersion:"pre5.0"`
-	ShowUserEmailInResults bool   `yaml:"mask_user_email" env:"OCS_SHOW_USER_EMAIL_IN_RESULTS" desc:"Mask user email addresses in responses." introductionVersion:"5.1"`
+	ShowUserEmailInResults bool   `yaml:"mask_user_email" env:"OCIS_SHOW_USER_EMAIL_IN_RESULTS" desc:"Mask user email addresses in responses." introductionVersion:"5.1"`
 }