diff --git a/CHANGELOG.md b/CHANGELOG.md
index fcc8d8b3f6..72a55a77b0 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -34,6 +34,7 @@ ENHANCEMENTS:
 * Update Guacamole dependencies ([[#4232](https://github.com/microsoft/AzureTRE/issues/4232)])
 * Add option to force tunnel TRE's Firewall ([#4237](https://github.com/microsoft/AzureTRE/issues/4237))
 * Add EventGrid diagnostics to identify airlock issues ([#4258](https://github.com/microsoft/AzureTRE/issues/4258))
+* Surface the server-layout parameter of Guacamole [server-layout](https://guacamole.apache.org/doc/gug/configuring-guacamole.html#session-settings) ([#4234](https://github.com/microsoft/AzureTRE/issues/4234))
 
 BUG FIXES:
 * Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))
diff --git a/templates/workspace_services/guacamole/guacamole-server/docker/version.txt b/templates/workspace_services/guacamole/guacamole-server/docker/version.txt
index c5981731c5..e94731c0f2 100644
--- a/templates/workspace_services/guacamole/guacamole-server/docker/version.txt
+++ b/templates/workspace_services/guacamole/guacamole-server/docker/version.txt
@@ -1 +1 @@
-__version__ = "0.9.3"
+__version__ = "0.9.4"
diff --git a/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/src/main/java/org/apache/guacamole/auth/azuretre/connection/ConnectionService.java b/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/src/main/java/org/apache/guacamole/auth/azuretre/connection/ConnectionService.java
index fa1792c82c..26f798ef14 100644
--- a/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/src/main/java/org/apache/guacamole/auth/azuretre/connection/ConnectionService.java
+++ b/templates/workspace_services/guacamole/guacamole-server/guacamole-auth-azure/src/main/java/org/apache/guacamole/auth/azuretre/connection/ConnectionService.java
@@ -111,6 +111,13 @@ private static void setConfig(
         config.setParameter("drive-path", System.getenv("GUAC_DRIVE_PATH"));
         config.setParameter("disable-download", System.getenv("GUAC_DISABLE_DOWNLOAD"));
         config.setParameter("disable-upload", System.getenv("GUAC_DISABLE_UPLOAD"));
+
+        String serverLayout = System.getenv("GUAC_SERVER_LAYOUT");
+        if (serverLayout != null) {
+            if (!serverLayout.isEmpty()) {
+                config.setParameter("server-layout", serverLayout);
+            }
+        }
     }
 
     private static JSONArray getVMsFromProjectAPI(final AzureTREAuthenticatedUser user) throws GuacamoleException {
diff --git a/templates/workspace_services/guacamole/parameters.json b/templates/workspace_services/guacamole/parameters.json
index 253f44127d..4e61f8cbb2 100755
--- a/templates/workspace_services/guacamole/parameters.json
+++ b/templates/workspace_services/guacamole/parameters.json
@@ -94,6 +94,12 @@
         "env": "GUAC_ENABLE_DRIVE"
       }
     },
+    {
+      "name": "guac_server_layout",
+      "source": {
+        "env": "GUAC_SERVER_LAYOUT"
+      }
+    },
     {
       "name": "image_tag",
       "source": {
diff --git a/templates/workspace_services/guacamole/porter.yaml b/templates/workspace_services/guacamole/porter.yaml
index c7009d1c04..7f6b523b6b 100644
--- a/templates/workspace_services/guacamole/porter.yaml
+++ b/templates/workspace_services/guacamole/porter.yaml
@@ -1,7 +1,7 @@
 ---
 schemaVersion: 1.0.0
 name: tre-service-guacamole
-version: 0.12.6
+version: 0.12.7
 description: "An Azure TRE service for Guacamole"
 dockerfile: Dockerfile.tmpl
 registry: azuretre
@@ -75,6 +75,11 @@ parameters:
     type: boolean
     default: true
     env: GUAC_DISABLE_UPLOAD
+  - name: guac_server_layout
+    type: string
+    default: ""
+    env: GUAC_SERVER_LAYOUT
+    description: "Guacamole server keyboard layout  (defaults to en-us-qwerty when not set)"
   - name: is_exposed_externally
     type: boolean
     default: true
@@ -144,6 +149,7 @@ install:
         guac_drive_path: ${ bundle.parameters.guac_drive_path }
         guac_disable_download: ${ bundle.parameters.guac_disable_download }
         guac_disable_upload: ${ bundle.parameters.guac_disable_upload }
+        guac_server_layout: ${ bundle.parameters.guac_server_layout }
         is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
         tre_resource_id: ${ bundle.parameters.id }
         aad_authority_url: ${ bundle.parameters.aad_authority_url }
@@ -177,6 +183,7 @@ upgrade:
         guac_drive_path: ${ bundle.parameters.guac_drive_path }
         guac_disable_download: ${ bundle.parameters.guac_disable_download }
         guac_disable_upload: ${ bundle.parameters.guac_disable_upload }
+        guac_server_layout: ${ bundle.parameters.guac_server_layout }
         is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
         tre_resource_id: ${ bundle.parameters.id }
         aad_authority_url: ${ bundle.parameters.aad_authority_url }
@@ -210,6 +217,7 @@ uninstall:
         guac_drive_path: ${ bundle.parameters.guac_drive_path }
         guac_disable_download: ${ bundle.parameters.guac_disable_download }
         guac_disable_upload: ${ bundle.parameters.guac_disable_upload }
+        guac_server_layout: ${ bundle.parameters.guac_server_layout }
         is_exposed_externally: ${ bundle.parameters.is_exposed_externally }
         tre_resource_id: ${ bundle.parameters.id }
         aad_authority_url: ${ bundle.parameters.aad_authority_url }
diff --git a/templates/workspace_services/guacamole/terraform/variables.tf b/templates/workspace_services/guacamole/terraform/variables.tf
index 26fcbb2f05..b62991b3c5 100644
--- a/templates/workspace_services/guacamole/terraform/variables.tf
+++ b/templates/workspace_services/guacamole/terraform/variables.tf
@@ -54,6 +54,10 @@ variable "guac_disable_upload" {
   type        = bool
   description = "Disable upload to the Guacamole workspace"
 }
+variable "guac_server_layout" {
+  type        = string
+  description = "Server keyboard layout"
+}
 variable "is_exposed_externally" {
   type        = bool
   description = "Is the Guacamole workspace to be exposed externally?"
diff --git a/templates/workspace_services/guacamole/terraform/web_app.tf b/templates/workspace_services/guacamole/terraform/web_app.tf
index c92190b9e1..ac6a2ceb05 100644
--- a/templates/workspace_services/guacamole/terraform/web_app.tf
+++ b/templates/workspace_services/guacamole/terraform/web_app.tf
@@ -55,6 +55,7 @@ resource "azurerm_linux_web_app" "guacamole" {
     GUAC_DRIVE_PATH       = var.guac_drive_path
     GUAC_DISABLE_DOWNLOAD = var.guac_disable_download
     GUAC_DISABLE_UPLOAD   = var.guac_disable_upload
+    GUAC_SERVER_LAYOUT    = var.guac_server_layout
 
     AUDIENCE = "@Microsoft.KeyVault(SecretUri=${data.azurerm_key_vault_secret.workspace_client_id.id})"
     ISSUER   = local.issuer