diff --git a/CHANGELOG.md b/CHANGELOG.md
index 64b877fb02..a45cc6df00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -26,6 +26,7 @@ We use *breaking :warning:* to mark changes that are not backward compatible (re
 - [#4612](https://github.com/thanos-io/thanos/pull/4612) Sidecar: add `--prometheus.http-client` and `--prometheus.http-client-file` flag for sidecar to connect Prometheus with basic auth or TLS.
 - [#4847](https://github.com/thanos-io/thanos/pull/4847) Query: add `--alert.query-url` which is used in the user interface for rules/alerts pages. By default the HTTP listen address is used for this URL.
 - [#4856](https://github.com/thanos-io/thanos/pull/4856) Mixin: Add Query Frontend Grafana dashboard.
+- [#4874](https://github.com/thanos-io/thanos/pull/4874) Query: Add `--endpoint-strict` flag to statically configure Thanos API server endpoints. It is similar to `--store-strict` but supports passing any Thanos gRPC APIs: StoreAPI, MetadataAPI, RulesAPI, TargetsAPI and ExemplarsAPI.
 
 ### Fixed
 
diff --git a/cmd/thanos/query.go b/cmd/thanos/query.go
index 3f632db52e..a12382c3df 100644
--- a/cmd/thanos/query.go
+++ b/cmd/thanos/query.go
@@ -121,9 +121,12 @@ func registerQuery(app *extkingpin.App) {
 	targetEndpoints := cmd.Flag("target", "Deprecation Warning - This flag is deprecated and replaced with `endpoint`. Experimental: Addresses of statically configured target API servers (repeatable). The scheme may be prefixed with 'dns+' or 'dnssrv+' to detect target API servers through respective DNS lookups.").
 		Hidden().PlaceHolder("<target>").Strings()
 
-	strictStores := cmd.Flag("store-strict", "Addresses of only statically configured store API servers that are always used, even if the health check fails. Useful if you have a caching layer on top.").
+	strictStores := cmd.Flag("store-strict", "Deprecation Warning - This flag is deprecated and replaced with `endpoint-strict`. Addresses of only statically configured store API servers that are always used, even if the health check fails. Useful if you have a caching layer on top.").
 		PlaceHolder("<staticstore>").Strings()
 
+	strictEndpoints := cmd.Flag("endpoint-strict", "Addresses of only statically configured Thanos API servers that are always used, even if the health check fails. Useful if you have a caching layer on top.").
+		PlaceHolder("<staticendpoint>").Strings()
+
 	fileSDFiles := cmd.Flag("store.sd-files", "Path to files that contain addresses of store API servers. The path can be a glob pattern (repeatable).").
 		PlaceHolder("<path>").Strings()
 
@@ -288,6 +291,7 @@ func registerQuery(app *extkingpin.App) {
 			time.Duration(*instantDefaultMaxSourceResolution),
 			*defaultMetadataTimeRange,
 			*strictStores,
+			*strictEndpoints,
 			*webDisableCORS,
 			enableAtModifier,
 			enableNegativeOffset,
@@ -355,6 +359,7 @@ func runQuery(
 	instantDefaultMaxSourceResolution time.Duration,
 	defaultMetadataTimeRange time.Duration,
 	strictStores []string,
+	strictEndpoints []string,
 	disableCORS bool,
 	enableAtModifier bool,
 	enableNegativeOffset bool,
@@ -392,6 +397,12 @@ func runQuery(
 		}
 	}
 
+	for _, endpoint := range strictEndpoints {
+		if dns.IsDynamicNode(endpoint) {
+			return errors.Errorf("%s is a dynamically specified endpoint i.e. it uses SD and that is not permitted under strict mode. Use --endpoint for this", endpoint)
+		}
+	}
+
 	dnsEndpointProvider := dns.NewProvider(
 		logger,
 		extprom.WrapRegistererWithPrefix("thanos_query_endpoints_", reg),
@@ -432,6 +443,10 @@ func runQuery(
 					specs = append(specs, query.NewGRPCEndpointSpec(addr, true))
 				}
 
+				for _, addr := range strictEndpoints {
+					specs = append(specs, query.NewGRPCEndpointSpec(addr, true))
+				}
+
 				for _, dnsProvider := range []*dns.Provider{
 					dnsStoreProvider,
 					dnsRuleProvider,
diff --git a/docs/components/query.md b/docs/components/query.md
index 72d4308041..cbef1938d6 100644
--- a/docs/components/query.md
+++ b/docs/components/query.md
@@ -263,6 +263,11 @@ Flags:
                                  prefixed with 'dns+' or 'dnssrv+' to detect
                                  Thanos API servers through respective DNS
                                  lookups.
+      --endpoint-strict=<staticendpoint> ...  
+                                 Addresses of only statically configured Thanos
+                                 API servers that are always used, even if the
+                                 health check fails. Useful if you have a
+                                 caching layer on top.
       --grpc-address="0.0.0.0:10901"  
                                  Listen ip:port address for gRPC endpoints
                                  (StoreAPI). Make sure this address is routable
@@ -382,10 +387,12 @@ Flags:
                                  'dns+' or 'dnssrv+' to detect store API servers
                                  through respective DNS lookups.
       --store-strict=<staticstore> ...  
-                                 Addresses of only statically configured store
-                                 API servers that are always used, even if the
-                                 health check fails. Useful if you have a
-                                 caching layer on top.
+                                 Deprecation Warning - This flag is deprecated
+                                 and replaced with `endpoint-strict`. Addresses
+                                 of only statically configured store API servers
+                                 that are always used, even if the health check
+                                 fails. Useful if you have a caching layer on
+                                 top.
       --store.response-timeout=0ms  
                                  If a Store doesn't send any data in this
                                  specified duration then a Store will be ignored