diff --git a/conf/insideout/sip_profiles/internal.xml b/conf/insideout/sip_profiles/internal.xml
index 158d5974a7..b64b5cea86 100644
--- a/conf/insideout/sip_profiles/internal.xml
+++ b/conf/insideout/sip_profiles/internal.xml
@@ -129,6 +129,8 @@
     <!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
     <!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
     <param name="auth-calls" value="$${internal_auth_calls}"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <!-- Force the user and auth-user to match. -->
     <param name="inbound-reg-force-matching-username" value="true"/>
     <!-- on authed calls, authenticate *all* the packets not just invite -->
diff --git a/conf/minimal/sip_profiles/internal.xml b/conf/minimal/sip_profiles/internal.xml
index f9d1f56338..8ac59684fc 100644
--- a/conf/minimal/sip_profiles/internal.xml
+++ b/conf/minimal/sip_profiles/internal.xml
@@ -1,6 +1,8 @@
 <profile name="internal">
   <settings>
     <param name="auth-calls" value="true"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <param name="apply-nat-acl" value="nat.auto"/>
 
     <param name="debug" value="0"/>
diff --git a/conf/testing/sip_profiles/internal.xml b/conf/testing/sip_profiles/internal.xml
index a5749324c5..2a3564ebb4 100644
--- a/conf/testing/sip_profiles/internal.xml
+++ b/conf/testing/sip_profiles/internal.xml
@@ -267,6 +267,8 @@
     <!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
     <!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
     <param name="auth-calls" value="$${internal_auth_calls}"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <!-- Force the user and auth-user to match. -->
     <param name="inbound-reg-force-matching-username" value="true"/>
     <!-- on authed calls, authenticate *all* the packets not just invite -->
diff --git a/conf/vanilla/sip_profiles/internal.xml b/conf/vanilla/sip_profiles/internal.xml
index da7abc07a6..58350e827b 100644
--- a/conf/vanilla/sip_profiles/internal.xml
+++ b/conf/vanilla/sip_profiles/internal.xml
@@ -267,6 +267,8 @@
     <!-- add a ;received="<ip>:<port>" to the contact when replying to register for nat handling -->
     <!--<param name="NDLB-received-in-nat-reg-contact" value="true"/>-->
     <param name="auth-calls" value="$${internal_auth_calls}"/>
+    <!-- Force subscription requests to require authentication -->
+    <param name="auth-subscriptions" value="true"/>
     <!-- Force the user and auth-user to match. -->
     <param name="inbound-reg-force-matching-username" value="true"/>
     <!-- on authed calls, authenticate *all* the packets not just invite -->