diff --git a/core/src/cli/cli.ts b/core/src/cli/cli.ts
index 65d7519f0a6..c66288cad54 100644
--- a/core/src/cli/cli.ts
+++ b/core/src/cli/cli.ts
@@ -16,7 +16,7 @@ import { shutdown, getPackageVersion } from "../util/util.js"
 import type { Command, CommandResult, BuiltinArgs } from "../commands/base.js"
 import { CommandGroup } from "../commands/base.js"
 import type { GardenError } from "../exceptions.js"
-import { PluginError, toGardenError } from "../exceptions.js"
+import { PluginError, RuntimeError, toGardenError } from "../exceptions.js"
 import type { GardenOpts } from "../garden.js"
 import { Garden, makeDummyGarden } from "../garden.js"
 import { getRootLogger, getTerminalWriterType, LogLevel, parseLogLevel, RootLogger } from "../logger/logger.js"
@@ -276,6 +276,29 @@ ${renderCommands(commands)}
             throw err
           }
         }
+
+        // If there is an ID in the project config and the user is not logged in (no cloudApi)
+        // 0.13 => check if login is required based on the `requireLogin` config value
+        if (!cloudApi && config && config.id) {
+          log.info("")
+
+          // fallback to false if no variables are set
+          // TODO-0.14: requireLogin should default to true
+          const isLoginRequired = (gardenEnv.GARDEN_REQUIRE_LOGIN_OVERRIDE ?? config.requireLogin) || false
+          if (isLoginRequired) {
+            log.warn(dedent`
+            You are running this in a project with a Garden Cloud ID and logging in is required.
+            Please log in via the ${styles.command("garden login")} command.`)
+            throw new RuntimeError({ message: "" })
+          } else {
+            log.warn(
+              `Warning: You are not logged in into Garden Cloud. Please log in via the ${styles.command(
+                "garden login"
+              )} command.`
+            )
+          }
+          log.info("")
+        }
       }
 
       const commandInfo = {
@@ -333,16 +356,6 @@ ${renderCommands(commands)}
 
           gardenLog.info(`Running in environment ${styles.highlight(`${garden.environmentName}.${garden.namespace}`)}`)
 
-          if (!cloudApi && garden.projectId) {
-            log.info("")
-            log.warn(
-              `Warning: You are not logged in into Garden Cloud. Please log in via the ${styles.command(
-                "garden login"
-              )} command.`
-            )
-            log.info("")
-          }
-
           if (processRecord) {
             // Update the db record for the process
             await globalConfigStore.update("activeProcesses", String(processRecord.pid), {
diff --git a/core/src/config/project.ts b/core/src/config/project.ts
index 6a86db36eb8..80d20c57303 100644
--- a/core/src/config/project.ts
+++ b/core/src/config/project.ts
@@ -202,6 +202,7 @@ export interface ProjectConfig extends BaseGardenResource {
   path: string
   id?: string
   domain?: string
+  requireLogin?: boolean
   configPath?: string
   proxy?: ProxyConfig
   defaultEnvironment: string
@@ -321,6 +322,13 @@ export const projectSchema = createSchema({
       .uri()
       .meta({ internal: true })
       .description("The domain to use for cloud features. Should be the full API/backend URL."),
+    // TODO: Refer to enterprise documentation for more details.
+    requireLogin: joi
+      .boolean()
+      .default(false)
+      .meta({ internal: true })
+      .description("Whether the project requires login to Garden Cloud."),
+
     // Note: We provide a different schema below for actual validation, but need to define it this way for docs
     // because joi.alternatives() isn't handled well in the doc generation.
     environments: joi
diff --git a/core/src/constants.ts b/core/src/constants.ts
index 59627479f57..bb88e0bc8be 100644
--- a/core/src/constants.ts
+++ b/core/src/constants.ts
@@ -100,4 +100,5 @@ export const gardenEnv = {
     .required(false)
     .default("https://get.garden.io/releases")
     .asUrlString(),
+  GARDEN_REQUIRE_LOGIN_OVERRIDE: env.get("GARDEN_REQUIRE_LOGIN_OVERRIDE").required(false).asBool(),
 }