diff --git a/ietf/ietfauth/utils.py b/ietf/ietfauth/utils.py
index 03b9d9a77..f84d430ce 100644
--- a/ietf/ietfauth/utils.py
+++ b/ietf/ietfauth/utils.py
@@ -18,7 +18,6 @@ from django.core.exceptions import PermissionDenied
 from django.db.models import Q
 from django.http import HttpResponseRedirect
 from django.shortcuts import get_object_or_404
-from django.urls import reverse as urlreverse
 from django.utils.decorators import available_attrs
 from django.utils.http import urlquote
 
@@ -211,8 +210,7 @@ def openid_userinfo(claims, user):
     person = get_object_or_404(Person, user=user)
     email = person.email()
     if person.photo:
-        photo_path = urlreverse('ietf.person.views.photo', kwargs={'email_or_name': person.email()})
-        photo_url = settings.IDTRACKER_BASE_URL + photo_path
+        photo_url = person.cdn_photo_url()
     else:
         photo_url = ''
     claims.update( {
diff --git a/ietf/person/models.py b/ietf/person/models.py
index cd25f4d0e..c21d1b582 100644
--- a/ietf/person/models.py
+++ b/ietf/person/models.py
@@ -244,6 +244,20 @@ class Person(models.Model):
         from ietf.ietfauth.utils import has_role
         return list(set([ (v, n) for (v, n, r) in PERSON_API_KEY_VALUES if r==None or has_role(self.user, r) ]))
 
+    def cdn_photo_url(self, size=80):
+        if self.photo:
+            if settings.SERVE_CDN_PHOTOS:
+                source_url = self.photo.url
+                if source_url.startswith(settings.IETF_HOST_URL):
+                    source_url = source_url[len(settings.IETF_HOST_URL):]
+                return f'{settings.IETF_HOST_URL}cdn-cgi/image/fit=scale-down,width={size},height={size}{source_url}'
+            else:
+                datatracker_photo_path = urlreverse('ietf.person.views.photo', kwargs={'email_or_name': self.email()})
+                datatracker_photo_url = settings.IDTRACKER_BASE_URL + datatracker_photo_path
+            return datatracker_photo_url
+        else:
+            return ''
+
 
 class PersonExtResource(models.Model):
     person = ForeignKey(Person) 
diff --git a/ietf/person/tests.py b/ietf/person/tests.py
index 48fd715c9..2f6023394 100644
--- a/ietf/person/tests.py
+++ b/ietf/person/tests.py
@@ -11,6 +11,7 @@ from pyquery import PyQuery
 
 
 from django.http import HttpRequest
+from django.test import override_settings
 from django.urls import reverse as urlreverse
 from django.utils.encoding import iri_to_uri
 
@@ -179,6 +180,16 @@ class PersonTests(TestCase):
         p = PersonFactory()
         self.assertEqual(p.get_absolute_url(), iri_to_uri('/person/%s' % p.name))
 
+    @override_settings(SERVE_CDN_PHOTOS=True)
+    def test_cdn_photo_url_cdn_on(self):
+        p = PersonFactory(with_bio=True)
+        self.assertIn('cdn-cgi/image',p.cdn_photo_url())
+
+    @override_settings(SERVE_CDN_PHOTOS=False)
+    def test_cdn_photo_url_cdn_off(self):
+        p = PersonFactory(with_bio=True)
+        self.assertNotIn('cdn-cgi/photo',p.cdn_photo_url())
+
 class PersonUtilsTests(TestCase):
     def test_determine_merge_order(self):
         p1 = get_person_no_user()
diff --git a/ietf/settings.py b/ietf/settings.py
index 51eaecded..4e9e05023 100644
--- a/ietf/settings.py
+++ b/ietf/settings.py
@@ -152,6 +152,7 @@ IETF_AUDIO_URL = IETF_HOST_URL + 'audio/'
 # Example: "/var/www/example.com/static/"
 
 
+SERVE_CDN_PHOTOS = True
 
 SERVE_CDN_FILES_LOCALLY_IN_DEV_MODE = True