diff --git a/cmd/prometheus/config.go b/cmd/prometheus/config.go
index e8302a03a..234e15f1a 100644
--- a/cmd/prometheus/config.go
+++ b/cmd/prometheus/config.go
@@ -80,6 +80,10 @@ func init() {
 		&cfg.web.ListenAddress, "web.listen-address", ":9090",
 		"Address to listen on for the web interface, API, and telemetry.",
 	)
+	cfg.fs.DurationVar(
+		&cfg.web.ReadTimeout, "web.read-timeout", 30*time.Second,
+		"Maximum duration before timing out read of the request, and closing idle connections.",
+	)
 	cfg.fs.StringVar(
 		&cfg.prometheusURL, "web.external-url", "",
 		"The URL under which Prometheus is externally reachable (for example, if Prometheus is served via a reverse proxy). Used for generating relative and absolute links back to Prometheus itself. If the URL has a path portion, it will be used to prefix all HTTP endpoints served by Prometheus. If omitted, relevant URL components will be derived automatically.",
diff --git a/web/web.go b/web/web.go
index 828839eb0..ea571abac 100644
--- a/web/web.go
+++ b/web/web.go
@@ -111,6 +111,7 @@ type Options struct {
 	Flags         map[string]string
 
 	ListenAddress        string
+	ReadTimeout          time.Duration
 	ExternalURL          *url.URL
 	RoutePrefix          string
 	MetricsPath          string
@@ -247,9 +248,10 @@ func (h *Handler) Reload() <-chan chan error {
 func (h *Handler) Run() {
 	log.Infof("Listening on %s", h.options.ListenAddress)
 	server := &http.Server{
-		Addr:     h.options.ListenAddress,
-		Handler:  h.router,
-		ErrorLog: log.NewErrorLogger(),
+		Addr:        h.options.ListenAddress,
+		Handler:     h.router,
+		ErrorLog:    log.NewErrorLogger(),
+		ReadTimeout: h.options.ReadTimeout,
 	}
 	h.listenErrCh <- server.ListenAndServe()
 }