diff --git a/go.mod b/go.mod
index e5e4c00309..23843085fc 100644
--- a/go.mod
+++ b/go.mod
@@ -29,6 +29,7 @@ require (
 	github.com/radovskyb/watcher v1.0.2
 	github.com/stretchr/testify v1.5.1
 	go.opencensus.io v0.22.0 // indirect
+	go.uber.org/zap v1.10.0
 	golang.org/x/net v0.0.0-20200625001655-4c5254603344 // indirect
 	golang.org/x/oauth2 v0.0.0-20191202225959-858c2ad4c8b6 // indirect
 	golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208 // indirect
diff --git a/subcommand/controller/command.go b/subcommand/controller/command.go
index 8d14c00d81..d95cfeef5f 100644
--- a/subcommand/controller/command.go
+++ b/subcommand/controller/command.go
@@ -10,6 +10,7 @@ import (
 	"github.com/hashicorp/consul-k8s/controller"
 	"github.com/hashicorp/consul-k8s/subcommand/flags"
 	"github.com/mitchellh/cli"
+	"go.uber.org/zap/zapcore"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -29,6 +30,7 @@ type Command struct {
 	flagEnableLeaderElection bool
 	flagEnableWebhooks       bool
 	flagDatacenter           string
+	flagLogLevel             string
 
 	// Flags to support Consul Enterprise namespaces.
 	flagEnableNamespaces           bool
@@ -46,6 +48,13 @@ var (
 	setupLog = ctrl.Log.WithName("setup")
 )
 
+const (
+	LogLevelDebug = "debug"
+	LogLevelInfo  = "info"
+	LogLevelWarn  = "warn"
+	LogLevelError = "error"
+)
+
 func init() {
 	utilruntime.Must(clientgoscheme.AddToScheme(scheme))
 	utilruntime.Must(v1alpha1.AddToScheme(scheme))
@@ -75,6 +84,9 @@ func (c *Command) init() {
 		"Directory that contains the TLS cert and key required for the webhook. The cert and key files must be named 'tls.crt' and 'tls.key' respectively.")
 	c.flagSet.BoolVar(&c.flagEnableWebhooks, "enable-webhooks", true,
 		"Enable webhooks. Disable when running locally since Kube API server won't be able to route to local server.")
+	c.flagSet.StringVar(&c.flagLogLevel, "log-level", LogLevelInfo,
+		fmt.Sprintf("Log verbosity level. Supported values (in order of detail) are "+
+			"%q, %q, %q, and %q.", LogLevelDebug, LogLevelInfo, LogLevelWarn, LogLevelError))
 
 	c.httpFlags = &flags.HTTPFlags{}
 	flags.Merge(c.flagSet, c.httpFlags.Flags())
@@ -82,7 +94,6 @@ func (c *Command) init() {
 }
 
 func (c *Command) Run(args []string) int {
-	ctrl.SetLogger(zap.New(zap.UseDevMode(true)))
 	c.once.Do(c.init)
 	if err := c.flagSet.Parse(args); err != nil {
 		c.UI.Error(fmt.Sprintf("Parsing flagset: %s", err.Error()))
@@ -101,6 +112,13 @@ func (c *Command) Run(args []string) int {
 		return 1
 	}
 
+	zapLevel, useDevMode, err := toLevel(c.flagLogLevel)
+	if err != nil {
+		c.UI.Error(err.Error())
+		return 1
+	}
+	ctrl.SetLogger(zap.New(zap.UseDevMode(useDevMode), zap.Level(zapLevel)))
+
 	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
 		Scheme:           scheme,
 		Port:             9443,
@@ -231,6 +249,25 @@ func (c *Command) Run(args []string) int {
 	return 0
 }
 
+// toLevel returns the zapcore level, a boolean to indicate if we should
+// use dev mode and an error if lvl is not supported.
+func toLevel(lvl string) (zapcore.Level, bool, error) {
+	switch lvl {
+	case LogLevelDebug:
+		return zapcore.DebugLevel, true, nil
+	case LogLevelInfo:
+		return zapcore.InfoLevel, false, nil
+	case LogLevelWarn:
+		return zapcore.WarnLevel, false, nil
+	case LogLevelError:
+		return zapcore.ErrorLevel, false, nil
+	default:
+		return zapcore.DebugLevel, false,
+			fmt.Errorf("invalid -log-level %q, must be one of %q, %q, %q, %q",
+				lvl, LogLevelDebug, LogLevelInfo, LogLevelWarn, LogLevelError)
+	}
+}
+
 func (c *Command) Help() string {
 	c.once.Do(c.init)
 	return c.help
diff --git a/subcommand/controller/command_test.go b/subcommand/controller/command_test.go
index b5bf76619e..4aaa772a78 100644
--- a/subcommand/controller/command_test.go
+++ b/subcommand/controller/command_test.go
@@ -26,6 +26,10 @@ func TestRun_FlagValidation(t *testing.T) {
 			flags:  []string{"-webhook-tls-cert-dir", "/foo"},
 			expErr: "-datacenter must be set",
 		},
+		{
+			flags:  []string{"-webhook-tls-cert-dir", "/foo", "-datacenter", "foo", "-log-level", "invalid"},
+			expErr: `invalid -log-level "invalid", must be one of "debug", "info", "warn", "error"`,
+		},
 	}
 
 	for _, c := range cases {