diff --git a/app/graphql/mutations/ci/project_ci_cd_settings_update.rb b/app/graphql/mutations/ci/project_ci_cd_settings_update.rb
index b0cffa2c088ee478dfd78979210e2ad37ea06fa8..27b066ffcf6f6a71bd102b11a171d2d5303930be 100644
--- a/app/graphql/mutations/ci/project_ci_cd_settings_update.rb
+++ b/app/graphql/mutations/ci/project_ci_cd_settings_update.rb
@@ -19,7 +19,13 @@ class ProjectCiCdSettingsUpdate < BaseMutation
 
       argument :job_token_scope_enabled, GraphQL::Types::Boolean,
         required: false,
-        description: 'Indicates CI job tokens generated in this project have restricted access to resources.'
+        description: 'Indicates CI/CD job tokens generated in this project ' \
+          'have restricted access to other projects.'
+
+      argument :inbound_job_token_scope_enabled, GraphQL::Types::Boolean,
+        required: false,
+        description: 'Indicates CI/CD job tokens generated in other projects ' \
+          'have restricted access to this project.'
 
       field :ci_cd_settings,
         Types::Ci::CiCdSettingType,
@@ -28,6 +34,9 @@ class ProjectCiCdSettingsUpdate < BaseMutation
 
       def resolve(full_path:, **args)
         project = authorized_find!(full_path)
+
+        args.delete(:inbound_job_token_scope_enabled) unless Feature.enabled?(:ci_inbound_job_token_scope, project)
+
         settings = project.ci_cd_settings
         settings.update(args)
 
diff --git a/app/graphql/types/ci/ci_cd_setting_type.rb b/app/graphql/types/ci/ci_cd_setting_type.rb
index bec8c72e78326238f7e6b308c0fd6be9e484eb7c..574791b79e6b7f6654b1da30b3286fdbf7c6760f 100644
--- a/app/graphql/types/ci/ci_cd_setting_type.rb
+++ b/app/graphql/types/ci/ci_cd_setting_type.rb
@@ -10,8 +10,17 @@ class CiCdSettingType < BaseObject
       field :job_token_scope_enabled,
             GraphQL::Types::Boolean,
             null: true,
-            description: 'Indicates CI job tokens generated in this project have restricted access to resources.',
+            description: 'Indicates CI/CD job tokens generated in this project ' \
+              'have restricted access to other projects.',
             method: :job_token_scope_enabled?
+
+      field :inbound_job_token_scope_enabled,
+            GraphQL::Types::Boolean,
+            null: true,
+            description: 'Indicates CI/CD job tokens generated in other projects ' \
+              'have restricted access to this project.',
+            method: :inbound_job_token_scope_enabled?
+
       field :keep_latest_artifact, GraphQL::Types::Boolean, null: true,
                                                             description: 'Whether to keep the latest builds artifacts.',
                                                             method: :keep_latest_artifacts_available?
diff --git a/config/feature_flags/development/ci_inbound_job_token_scope.yml b/config/feature_flags/development/ci_inbound_job_token_scope.yml
new file mode 100644
index 0000000000000000000000000000000000000000..0a7a618531cd33672075581e5ca124843f5b09d2
--- /dev/null
+++ b/config/feature_flags/development/ci_inbound_job_token_scope.yml
@@ -0,0 +1,8 @@
+---
+name: ci_inbound_job_token_scope
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/99165
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/376063
+milestone: '15.5'
+type: development
+group: group::pipeline execution
+default_enabled: false
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index b9a0be19fa14317f1533ac6f5b452b3ba3890de9..5494671938099939c8f517830f89d1dfb3147d51 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1028,7 +1028,8 @@ Input type: `CiCdSettingsUpdateInput`
 | ---- | ---- | ----------- |
 | <a id="mutationcicdsettingsupdateclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
 | <a id="mutationcicdsettingsupdatefullpath"></a>`fullPath` | [`ID!`](#id) | Full Path of the project the settings belong to. |
-| <a id="mutationcicdsettingsupdatejobtokenscopeenabled"></a>`jobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI job tokens generated in this project have restricted access to resources. |
+| <a id="mutationcicdsettingsupdateinboundjobtokenscopeenabled"></a>`inboundJobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI/CD job tokens generated in other projects have restricted access to this project. |
+| <a id="mutationcicdsettingsupdatejobtokenscopeenabled"></a>`jobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI/CD job tokens generated in this project have restricted access to other projects. |
 | <a id="mutationcicdsettingsupdatekeeplatestartifact"></a>`keepLatestArtifact` | [`Boolean`](#boolean) | Indicates if the latest artifact should be kept for this project. |
 | <a id="mutationcicdsettingsupdatemergepipelinesenabled"></a>`mergePipelinesEnabled` | [`Boolean`](#boolean) | Indicates if merge pipelines are enabled for the project. |
 | <a id="mutationcicdsettingsupdatemergetrainsenabled"></a>`mergeTrainsEnabled` | [`Boolean`](#boolean) | Indicates if merge trains are enabled for the project. |
@@ -4168,7 +4169,8 @@ Input type: `ProjectCiCdSettingsUpdateInput`
 | ---- | ---- | ----------- |
 | <a id="mutationprojectcicdsettingsupdateclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
 | <a id="mutationprojectcicdsettingsupdatefullpath"></a>`fullPath` | [`ID!`](#id) | Full Path of the project the settings belong to. |
-| <a id="mutationprojectcicdsettingsupdatejobtokenscopeenabled"></a>`jobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI job tokens generated in this project have restricted access to resources. |
+| <a id="mutationprojectcicdsettingsupdateinboundjobtokenscopeenabled"></a>`inboundJobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI/CD job tokens generated in other projects have restricted access to this project. |
+| <a id="mutationprojectcicdsettingsupdatejobtokenscopeenabled"></a>`jobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI/CD job tokens generated in this project have restricted access to other projects. |
 | <a id="mutationprojectcicdsettingsupdatekeeplatestartifact"></a>`keepLatestArtifact` | [`Boolean`](#boolean) | Indicates if the latest artifact should be kept for this project. |
 | <a id="mutationprojectcicdsettingsupdatemergepipelinesenabled"></a>`mergePipelinesEnabled` | [`Boolean`](#boolean) | Indicates if merge pipelines are enabled for the project. |
 | <a id="mutationprojectcicdsettingsupdatemergetrainsenabled"></a>`mergeTrainsEnabled` | [`Boolean`](#boolean) | Indicates if merge trains are enabled for the project. |
@@ -17248,7 +17250,8 @@ four standard [pagination arguments](#connection-pagination-arguments):
 
 | Name | Type | Description |
 | ---- | ---- | ----------- |
-| <a id="projectcicdsettingjobtokenscopeenabled"></a>`jobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI job tokens generated in this project have restricted access to resources. |
+| <a id="projectcicdsettinginboundjobtokenscopeenabled"></a>`inboundJobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI/CD job tokens generated in other projects have restricted access to this project. |
+| <a id="projectcicdsettingjobtokenscopeenabled"></a>`jobTokenScopeEnabled` | [`Boolean`](#boolean) | Indicates CI/CD job tokens generated in this project have restricted access to other projects. |
 | <a id="projectcicdsettingkeeplatestartifact"></a>`keepLatestArtifact` | [`Boolean`](#boolean) | Whether to keep the latest builds artifacts. |
 | <a id="projectcicdsettingmergepipelinesenabled"></a>`mergePipelinesEnabled` | [`Boolean`](#boolean) | Whether merge pipelines are enabled. |
 | <a id="projectcicdsettingmergetrainsenabled"></a>`mergeTrainsEnabled` | [`Boolean`](#boolean) | Whether merge trains are enabled. |
diff --git a/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb b/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb
index c19defa37e8a74a4cd2b8e97e1e188abed90176a..2dc7b9764fe9791c9418b734dc6eb9c94130635a 100644
--- a/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb
+++ b/spec/requests/api/graphql/ci/ci_cd_setting_spec.rb
@@ -48,6 +48,8 @@
       expect(settings_data['mergeTrainsEnabled']).to eql project.ci_cd_settings.merge_trains_enabled?
       expect(settings_data['keepLatestArtifact']).to eql project.keep_latest_artifacts_available?
       expect(settings_data['jobTokenScopeEnabled']).to eql project.ci_cd_settings.job_token_scope_enabled?
+      expect(settings_data['inboundJobTokenScopeEnabled']).to eql(
+        project.ci_cd_settings.inbound_job_token_scope_enabled?)
     end
   end
 end
diff --git a/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb b/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb
index 394d9ff53d12fb356a99ea9218bd05de7bbef581..6cca618726bd4a67463bdb1ccc9f59adc6739d31 100644
--- a/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb
@@ -6,15 +6,19 @@
   include GraphqlHelpers
 
   let_it_be(:project) do
-    create(:project, keep_latest_artifact: true, ci_job_token_scope_enabled: true)
-      .tap(&:save!)
+    create(:project,
+      keep_latest_artifact: true,
+      ci_job_token_scope_enabled: true,
+      ci_inbound_job_token_scope_enabled: true
+    ).tap(&:save!)
   end
 
   let(:variables) do
     {
       full_path: project.full_path,
       keep_latest_artifact: false,
-      job_token_scope_enabled: false
+      job_token_scope_enabled: false,
+      inbound_job_token_scope_enabled: false
     }
   end
 
@@ -76,6 +80,43 @@
       expect(project.ci_job_token_scope_enabled).to eq(true)
     end
 
+    describe 'inbound_job_token_scope_enabled' do
+      it 'updates inbound_job_token_scope_enabled' do
+        post_graphql_mutation(mutation, current_user: user)
+
+        project.reload
+
+        expect(response).to have_gitlab_http_status(:success)
+        expect(project.ci_inbound_job_token_scope_enabled).to eq(false)
+      end
+
+      it 'does not update inbound_job_token_scope_enabled if not specified' do
+        variables.except!(:inbound_job_token_scope_enabled)
+
+        post_graphql_mutation(mutation, current_user: user)
+
+        project.reload
+
+        expect(response).to have_gitlab_http_status(:success)
+        expect(project.ci_inbound_job_token_scope_enabled).to eq(true)
+      end
+
+      context 'when ci_inbound_job_token_scope disabled' do
+        before do
+          stub_feature_flags(ci_inbound_job_token_scope: false)
+        end
+
+        it 'does not update inbound_job_token_scope_enabled' do
+          post_graphql_mutation(mutation, current_user: user)
+
+          project.reload
+
+          expect(response).to have_gitlab_http_status(:success)
+          expect(project.ci_inbound_job_token_scope_enabled).to eq(true)
+        end
+      end
+    end
+
     context 'when bad arguments are provided' do
       let(:variables) { { full_path: '', keep_latest_artifact: false } }