diff --git a/doc/man/man5/lloadd.conf.5 b/doc/man/man5/lloadd.conf.5
index 649156c906..d6e5ade030 100644
--- a/doc/man/man5/lloadd.conf.5
+++ b/doc/man/man5/lloadd.conf.5
@@ -598,6 +598,7 @@ option. The authentication configuration is shared between them.
 .B [secprops=<properties>]
 .B [timeout=<seconds>]
 .B [network\-timeout=<seconds>]
+.B [tcp\-user\-timeout=<milliseconds>]
 
 Specifies the bind credentials
 .B lloadd
@@ -656,6 +657,14 @@ Bind request to complete.
 Timeout set to 0 means no timeout is in effect and by default, no timeouts are
 in effect.
 
+The
+.B tcp\-user\-timeout
+parameter, if non-zero, corresponds to the
+.B TCP_USER_TIMEOUT
+set on the upstream connections, overriding the operating system setting.
+Only some systems support the customization of this parameter, it is
+ignored otherwise and system-wide settings are used.
+
 .SH BACKEND OPTIONS
 
 .TP
@@ -830,6 +839,7 @@ default lloadd configuration file
 .BR ldap (3),
 .BR gnutls\-cli (1),
 .BR slapd.conf (5),
+.BR tcp (7),
 .BR lloadd (8),
 .BR slapd (8).
 .LP
diff --git a/servers/lloadd/backend.c b/servers/lloadd/backend.c
index 5050548d4b..4df22ac14d 100644
--- a/servers/lloadd/backend.c
+++ b/servers/lloadd/backend.c
@@ -192,6 +192,22 @@ upstream_name_cb( int result, struct evutil_addrinfo *res, void *arg )
 #endif /* TCP_KEEPINTVL */
         }
 #endif /* SO_KEEPALIVE */
+        if ( bindconf.sb_tcp_user_timeout > 0 ) {
+#ifdef TCP_USER_TIMEOUT
+            if ( setsockopt( s, IPPROTO_TCP, TCP_USER_TIMEOUT,
+                         (void *)&bindconf.sb_tcp_user_timeout,
+                         sizeof(bindconf.sb_tcp_user_timeout) ) ==
+                    AC_SOCKET_ERROR ) {
+                Debug( LDAP_DEBUG_TRACE, "upstream_name_cb: "
+                        "setsockopt(%d, TCP_USER_TIMEOUT) failed (ignored).\n",
+                        s );
+            }
+#else
+            Debug( LDAP_DEBUG_TRACE, "upstream_name_cb: "
+                    "sockopt TCP_USER_TIMEOUT not supported on this "
+                    "system.\n" );
+#endif /* TCP_USER_TIMEOUT */
+        }
 #ifdef TCP_NODELAY
         if ( setsockopt( s, IPPROTO_TCP, TCP_NODELAY, (char *)&dummy,
                      sizeof(dummy) ) == AC_SOCKET_ERROR ) {
diff --git a/servers/lloadd/config.c b/servers/lloadd/config.c
index ba827bfe2b..dad2670b5e 100644
--- a/servers/lloadd/config.c
+++ b/servers/lloadd/config.c
@@ -2774,10 +2774,11 @@ static slap_cf_aux_table bindkey[] = {
     { BER_BVC("authcID="), offsetof(slap_bindconf, sb_authcId), 'b', 1, NULL },
     { BER_BVC("authzID="), offsetof(slap_bindconf, sb_authzId), 'b', 1, NULL },
     { BER_BVC("keepalive="), offsetof(slap_bindconf, sb_keepalive), 'x', 0, (slap_verbmasks *)lload_keepalive_parse },
+    { BER_BVC("tcp-user-timeout="), offsetof(slap_bindconf, sb_tcp_user_timeout), 'u', 0, NULL },
 #ifdef HAVE_TLS
-    /* NOTE: replace "11" with the actual index
+    /* NOTE: replace "12" with the actual index
      * of the first TLS-related line */
-#define aux_TLS (bindkey+11) /* beginning of TLS keywords */
+#define aux_TLS (bindkey+12) /* beginning of TLS keywords */
 
     { BER_BVC("tls_cert="), offsetof(slap_bindconf, sb_tls_cert), 's', 1, NULL },
     { BER_BVC("tls_key="), offsetof(slap_bindconf, sb_tls_key), 's', 1, NULL },