diff --git a/doc/configuration.txt b/doc/configuration.txt
index edd9e79..f9bdf2a 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -10413,6 +10413,11 @@
   an established connection while the proxy will only see it in SYN_RECV. This
   option is only supported on TCPv4/TCPv6 sockets and ignored by other ones.
 
+expose-fd listeners
+  This option is only usable with the stats socket. It gives your stats socket
+  the capability to pass listeners FD to another HAProxy process.
+  See alors "-x" in the management guide.
+
 force-sslv3
   This option enforces use of SSLv3 only on SSL connections instantiated from
   this listener. SSLv3 is generally less expensive than the TLS counterparts
diff --git a/doc/management.txt b/doc/management.txt
index d1ea1f6..565813e 100644
--- a/doc/management.txt
+++ b/doc/management.txt
@@ -280,7 +280,8 @@
   -x <unix_socket> : connect to the specified socket and try to retrieve any
     listening sockets from the old process, and use them instead of trying to
     bind new ones. This is useful to avoid missing any new connection when
-    reloading the configuration on Linux.
+    reloading the configuration on Linux. The capability must be enable on the
+    stats socket using "expose-fd listeners" in your configuration.
 
 A safe way to start HAProxy from an init file consists in forcing the daemon
 mode, storing existing pids to a pid file and using this pid file to notify
diff --git a/include/types/global.h b/include/types/global.h
index cd5fda3..aeb82ea 100644
--- a/include/types/global.h
+++ b/include/types/global.h
@@ -71,6 +71,7 @@
 #define ACCESS_LVL_ADMIN    3
 #define ACCESS_LVL_MASK     0x3
 
+#define ACCESS_FD_LISTENERS 0x4  /* expose listeners FDs on stats socket */
 
 /* SSL server verify mode */
 enum {
diff --git a/src/cli.c b/src/cli.c
index cdbaf2b..55115d6 100644
--- a/src/cli.c
+++ b/src/cli.c
@@ -993,6 +993,24 @@
 	return 1;
 }
 
+/* parse the "expose-fd" argument on the bind lines */
+static int bind_parse_expose_fd(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
+{
+	if (!*args[cur_arg + 1]) {
+		memprintf(err, "'%s' : missing fd type", args[cur_arg]);
+		return ERR_ALERT | ERR_FATAL;
+	}
+	if (!strcmp(args[cur_arg+1], "listeners")) {
+		conf->level |= ACCESS_FD_LISTENERS;
+	} else {
+		memprintf(err, "'%s' only supports 'listeners' (got '%s')",
+			  args[cur_arg], args[cur_arg+1]);
+		return ERR_ALERT | ERR_FATAL;
+	}
+
+	return 0;
+}
+
 /* parse the "level" argument on the bind lines */
 static int bind_parse_level(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
 {
@@ -1026,6 +1044,7 @@
 	unsigned char *tmpbuf = NULL;
 	struct cmsghdr *cmsg;
 	struct stream_interface *si = appctx->owner;
+	struct stream *s = si_strm(si);
 	struct connection *remote = objt_conn(si_opposite(si)->end);
 	struct msghdr msghdr;
 	struct iovec iov;
@@ -1057,7 +1076,7 @@
 	setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (void *)&tv, sizeof(tv));
 	iov.iov_base = &tot_fd_nb;
 	iov.iov_len = sizeof(tot_fd_nb);
-	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
+	if (!(strm_li(s)->bind_conf->level & ACCESS_FD_LISTENERS))
 		goto out;
 	memset(&msghdr, 0, sizeof(msghdr));
 	/*
@@ -1224,7 +1243,8 @@
 }};
 
 static struct bind_kw_list bind_kws = { "STAT", { }, {
-	{ "level",    bind_parse_level,    1 }, /* set the unix socket admin level */
+	{ "level",     bind_parse_level,    1 }, /* set the unix socket admin level */
+	{ "expose-fd", bind_parse_expose_fd, 1 }, /* set the unix socket expose fd rights */
 	{ NULL, NULL, 0 },
 }};