diff --git a/cmd/fleet/serve.go b/cmd/fleet/serve.go
index af6eac2452..79429442ba 100644
--- a/cmd/fleet/serve.go
+++ b/cmd/fleet/serve.go
@@ -508,10 +508,14 @@ the way that the Fleet server works.
 				cancel()
 			}
 
-			if len(config.Server.PrivateKey) > 0 && len([]byte(config.Server.PrivateKey)) != 32 {
-				initFatal(errors.New("private key must be 32 bytes long"), "validate private key")
+			if len([]byte(config.Server.PrivateKey)) < 32 {
+				initFatal(errors.New("private key must be at least 32 bytes long"), "validate private key")
 			}
 
+			// We truncate to 32 bytes because AES-256 requires a 32 byte (256 bit) PK, but some
+			// infra setups generate keys that are longer than 32 bytes.
+			config.Server.PrivateKey = config.Server.PrivateKey[:32]
+
 			appCfg, err := ds.AppConfig(context.Background())
 			if err != nil {
 				initFatal(err, "loading app config")
diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md
index 2714cce7b9..4b1f0f7d86 100644
--- a/docs/Configuration/fleet-server-configuration.md
+++ b/docs/Configuration/fleet-server-configuration.md
@@ -678,6 +678,21 @@ Setting to true will disable the origin check.
     websockets_allow_unsafe_origin: true
   ```
 
+##### server_private_key
+
+The private key used to encrypt sensitive data in Fleet, for example, MDM certificates and keys.
+The key must be at least 32 bytes long. If the key is longer than 32 bytes, only the first 32 bytes
+will be used (the data is encrypted using AES-256, which requires a 32 byte key). This key is
+required for enabling MDM features in Fleet.
+
+- Default value: ""
+- Environment variable: FLEET_SERVER_PRIVATE_KEY
+- Config file format:
+  ```yaml
+  server:
+    private_key: 72414F4A688151F75D032F5CDA095FC4
+  ```
+
 ##### Example YAML
 
 ```yaml