diff --git a/pkg/oonimkall/internal/tasks/runner.go b/pkg/oonimkall/internal/tasks/runner.go
index eb2a352..ebc01df 100644
--- a/pkg/oonimkall/internal/tasks/runner.go
+++ b/pkg/oonimkall/internal/tasks/runner.go
@@ -5,6 +5,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"net/url"
 	"time"
 
 	engine "github.com/ooni/probe-cli/v3/internal/engine"
@@ -74,9 +75,21 @@ func (r *Runner) newsession(ctx context.Context, logger *ChanLogger) (*engine.Se
 	if err != nil {
 		return nil, err
 	}
+
+	// TODO(bassosimone): write tests for this functionality
+	var proxyURL *url.URL
+	if r.settings.Proxy != "" {
+		var err error
+		proxyURL, err = url.Parse(r.settings.Proxy)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	config := engine.SessionConfig{
 		KVStore:         kvstore,
 		Logger:          logger,
+		ProxyURL:        proxyURL,
 		SoftwareName:    r.settings.Options.SoftwareName,
 		SoftwareVersion: r.settings.Options.SoftwareVersion,
 		TempDir:         r.settings.TempDir,
diff --git a/pkg/oonimkall/internal/tasks/settings.go b/pkg/oonimkall/internal/tasks/settings.go
index 1093637..8cbc8c6 100644
--- a/pkg/oonimkall/internal/tasks/settings.go
+++ b/pkg/oonimkall/internal/tasks/settings.go
@@ -32,6 +32,19 @@ type Settings struct {
 	// Options contains the task options.
 	Options SettingsOptions `json:"options"`
 
+	// Proxy allows you to optionally force a specific proxy
+	// rather than using no proxy (the default).
+	//
+	// Use `psiphon:///` to force using Psiphon with the
+	// embedded configuration file. Not all builds have
+	// an embedded configuration file, but OONI builds have
+	// such a file, so they can use this functionality.
+	//
+	// Use `socks5://10.0.0.1:9050/` to connect to a SOCKS5
+	// proxy running on 10.0.0.1:9050. This could be, for
+	// example, a suitably configured `tor` instance.
+	Proxy string
+
 	// StateDir is the directory where to store persistent data. This
 	// field is an extension of MK's specification. If
 	// this field is empty, the task won't start.
diff --git a/pkg/oonimkall/session.go b/pkg/oonimkall/session.go
index ea2c99b..7706434 100644
--- a/pkg/oonimkall/session.go
+++ b/pkg/oonimkall/session.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"net/url"
 	"runtime"
 	"sync"
 
@@ -65,6 +66,19 @@ type SessionConfig struct {
 	// then the session will not emit any log message.
 	Logger Logger
 
+	// Proxy allows you to optionally force a specific proxy
+	// rather than using no proxy (the default).
+	//
+	// Use `psiphon:///` to force using Psiphon with the
+	// embedded configuration file. Not all builds have
+	// an embedded configuration file, but OONI builds have
+	// such a file, so they can use this functionality.
+	//
+	// Use `socks5://10.0.0.1:9050/` to connect to a SOCKS5
+	// proxy running on 10.0.0.1:9050. This could be, for
+	// example, a suitably configured `tor` instance.
+	Proxy string
+
 	// ProbeServicesURL allows you to optionally force the
 	// usage of an alternative probe service instance. This setting
 	// should only be used for implementing integration tests.
@@ -153,10 +167,22 @@ func newSessionWithContext(ctx context.Context, config *SessionConfig) (*Session
 			Type:    "https",
 		})
 	}
+
+	// TODO(bassosimone): write tests for this functionality.
+	var proxyURL *url.URL
+	if config.Proxy != "" {
+		var err error
+		proxyURL, err = url.Parse(config.Proxy)
+		if err != nil {
+			return nil, err
+		}
+	}
+
 	engineConfig := engine.SessionConfig{
 		AvailableProbeServices: availableps,
 		KVStore:                kvstore,
 		Logger:                 newLogger(config.Logger, config.Verbose),
+		ProxyURL:               proxyURL,
 		SoftwareName:           config.SoftwareName,
 		SoftwareVersion:        config.SoftwareVersion,
 		TempDir:                config.TempDir,