diff --git a/docs/usage/self-hosted-configuration.md b/docs/usage/self-hosted-configuration.md
index a46d563be6d49e69b4a4d82f7e8f8bfff1fea548..342cc4b221e4577d490b9031976d33ade510d611 100644
--- a/docs/usage/self-hosted-configuration.md
+++ b/docs/usage/self-hosted-configuration.md
@@ -415,9 +415,25 @@ In practice, it is implemented by converting the `force` configuration into a `p
 This is set to `true` by default, meaning that any settings (such as `schedule`) take maximum priority even against custom settings existing inside individual repositories.
 It will also override any settings in `packageRules`.
 
-## forkToken
+## forkCreate
+
+If you're using an app token which is _not_ allowed to fork, set this to `false`.
+
+## forkOrgs
+
+This configuration option lets you choose which organization or account you want repositories forked into when "fork mode" is enabled.
+
+You may set more than one organization or account.
+This can be handy if you're migrating from user-based forks to organization-based forks.
 
-You probably don't need this option - it is an experimental setting developed for the Forking Renovate hosted GitHub App.
+If you've set multiple `forkOrgs` then Renovate will:
+
+1. Check if a fork exists in the preferred organization
+1. If no fork exists in the preferred org: Renovate checks the fallback organizations
+
+Renovate always creates the new fork in the _first_ organization in the `forkOrgs` list.
+
+## forkToken
 
 If this value is configured then Renovate:
 
diff --git a/lib/config/options/index.ts b/lib/config/options/index.ts
index ce143bdf4c053d6217ac4e798e5310c06c24dd56..d1beac3bb6240e16d1215ada49df74d40cb439cd 100644
--- a/lib/config/options/index.ts
+++ b/lib/config/options/index.ts
@@ -444,6 +444,28 @@ const options: RenovateOptions[] = [
     supportedPlatforms: ['github'],
     experimental: true,
   },
+  {
+    name: 'forkOrgs',
+    description:
+      'The preferred organizations to create or find forked repositories, when in fork mode.',
+    stage: 'repository',
+    type: 'array',
+    subType: 'string',
+    globalOnly: true,
+    supportedPlatforms: ['github'],
+    experimental: true,
+  },
+  {
+    name: 'forkCreate',
+    description:
+      'Decide if Renovate creates a fork at runtime when in fork mode.',
+    stage: 'repository',
+    type: 'boolean',
+    default: true,
+    globalOnly: true,
+    supportedPlatforms: ['github'],
+    experimental: true,
+  },
   {
     name: 'githubTokenWarn',
     description: 'Display warnings about GitHub token not being set.',
diff --git a/lib/constants/error-messages.ts b/lib/constants/error-messages.ts
index 95daa453ee8ecbe07ee1f182e5c694a037fe3c26..4e047fac01dce2f3f4f104511bebe118ac15fff7 100644
--- a/lib/constants/error-messages.ts
+++ b/lib/constants/error-messages.ts
@@ -23,6 +23,7 @@ export const REPOSITORY_ACCESS_FORBIDDEN = 'forbidden';
 export const REPOSITORY_ARCHIVED = 'archived';
 export const REPOSITORY_BLOCKED = 'blocked';
 export const REPOSITORY_CANNOT_FORK = 'cannot-fork';
+export const REPOSITORY_NO_FORK = 'no-fork';
 export const REPOSITORY_DISABLED = 'disabled';
 export const REPOSITORY_CLOSED_ONBOARDING = 'disabled-closed-onboarding';
 export const REPOSITORY_DISABLED_BY_CONFIG = 'disabled-by-config';
diff --git a/lib/modules/platform/github/index.spec.ts b/lib/modules/platform/github/index.spec.ts
index fd917c0a98daa33aa82b8fc8bc9e61c25a2603a1..cc52c835e56d0bd67709322443751992f2a631ea 100644
--- a/lib/modules/platform/github/index.spec.ts
+++ b/lib/modules/platform/github/index.spec.ts
@@ -7,6 +7,7 @@ import {
   PLATFORM_UNKNOWN_ERROR,
   REPOSITORY_CANNOT_FORK,
   REPOSITORY_NOT_FOUND,
+  REPOSITORY_NO_FORK,
   REPOSITORY_RENAMED,
 } from '../../../constants/error-messages';
 import * as repository from '../../../util/cache/repository';
@@ -348,10 +349,26 @@ describe('modules/platform/github/index', () => {
       const config = await github.initRepo({
         repository: 'some/repo',
         forkToken: 'true',
+        forkCreate: true,
       });
       expect(config).toMatchSnapshot();
     });
 
+    it('throws when no forking allowed', async () => {
+      const repo = 'some/repo';
+      const branch = 'master';
+      const scope = httpMock.scope(githubApiHost);
+      forkInitRepoMock(scope, repo, false, 200, branch);
+      await expect(
+        github.initRepo({
+          repository: 'some/repo',
+          forkToken: 'true',
+          forkOrgs: ['renovate-bot'],
+          forkCreate: false,
+        })
+      ).rejects.toThrow(REPOSITORY_NO_FORK);
+    });
+
     it('throws when cannot fork due to username error', async () => {
       const repo = 'some/repo';
       const branch = 'master';
@@ -362,6 +379,7 @@ describe('modules/platform/github/index', () => {
         github.initRepo({
           repository: 'some/repo',
           forkToken: 'true',
+          forkCreate: true,
         })
       ).rejects.toThrow(REPOSITORY_CANNOT_FORK);
     });
@@ -397,12 +415,13 @@ describe('modules/platform/github/index', () => {
       scope.get('/user').reply(200, {
         login: 'forked',
       });
-      // getBranchCommit
       scope.post(`/repos/${repo}/forks`).reply(500);
       await expect(
         github.initRepo({
           repository: 'some/repo',
           forkToken: 'true',
+          forkOrgs: ['forked'],
+          forkCreate: true,
         })
       ).rejects.toThrow(REPOSITORY_CANNOT_FORK);
     });
@@ -410,10 +429,10 @@ describe('modules/platform/github/index', () => {
     it('should update fork when using forkToken', async () => {
       const scope = httpMock.scope(githubApiHost);
       forkInitRepoMock(scope, 'some/repo', true);
+      scope.patch('/repos/forked/repo/git/refs/heads/master').reply(200);
       scope.get('/user').reply(200, {
         login: 'forked',
       });
-      scope.patch('/repos/forked/repo/git/refs/heads/master').reply(200);
       const config = await github.initRepo({
         repository: 'some/repo',
         forkToken: 'true',
@@ -2288,6 +2307,7 @@ describe('modules/platform/github/index', () => {
         await github.initRepo({
           repository: 'some/repo',
           forkToken: 'true',
+          forkCreate: true,
         });
       });
 
diff --git a/lib/modules/platform/github/index.ts b/lib/modules/platform/github/index.ts
index d00cc2df6365c34883116a1c4bedd7710f711356..8768bcb1d7077b958c51b02cd8090ae16c27eb45 100644
--- a/lib/modules/platform/github/index.ts
+++ b/lib/modules/platform/github/index.ts
@@ -20,6 +20,7 @@ import {
   REPOSITORY_EMPTY,
   REPOSITORY_FORKED,
   REPOSITORY_NOT_FOUND,
+  REPOSITORY_NO_FORK,
   REPOSITORY_RENAMED,
 } from '../../../constants/error-messages';
 import { logger } from '../../../logger';
@@ -257,18 +258,29 @@ export async function getJsonFile(
   return JSON5.parse(raw);
 }
 
-export async function getForkOrgs(token: string): Promise<string[]> {
-  // This function will be adapted later to support configured forkOrgs
-  if (!config.renovateForkUser) {
-    try {
-      logger.debug('Determining fork user from API');
-      const userDetails = await getUserDetails(platformConfig.endpoint, token);
-      config.renovateForkUser = userDetails.username;
-    } catch (err) {
-      logger.debug({ err }, 'Error getting username for forkToken');
+export async function getForkOrgs(
+  token: string,
+  forkOrgs?: string[]
+): Promise<string[]> {
+  const destinationOrgs = forkOrgs ?? [];
+  if (!destinationOrgs.length) {
+    if (!config.renovateForkUser) {
+      try {
+        logger.debug('Determining fork user from API');
+        const userDetails = await getUserDetails(
+          platformConfig.endpoint,
+          token
+        );
+        config.renovateForkUser = userDetails.username;
+      } catch (err) {
+        logger.debug({ err }, 'Error getting username for forkToken');
+      }
+    }
+    if (config.renovateForkUser) {
+      destinationOrgs.push(config.renovateForkUser);
     }
   }
-  return config.renovateForkUser ? [config.renovateForkUser] : [];
+  return destinationOrgs;
 }
 
 export async function listForks(
@@ -299,10 +311,11 @@ export async function listForks(
 
 export async function findFork(
   token: string,
-  repository: string
+  repository: string,
+  forkOrgs?: string[]
 ): Promise<GhRestRepo | null> {
   const forks = await listForks(token, repository);
-  const orgs = await getForkOrgs(token);
+  const orgs = await getForkOrgs(token, forkOrgs);
   if (!orgs.length) {
     throw new Error(REPOSITORY_CANNOT_FORK);
   }
@@ -320,14 +333,17 @@ export async function findFork(
 
 export async function createFork(
   token: string,
-  repository: string
+  repository: string,
+  forkOrgs?: string[]
 ): Promise<GhRestRepo> {
   let forkedRepo: GhRestRepo | undefined;
   try {
+    const organization = (await getForkOrgs(token, forkOrgs))[0];
     forkedRepo = (
       await githubApi.postJson<GhRestRepo>(`repos/${repository}/forks`, {
         token,
         body: {
+          organization,
           name: config.parentRepo!.replace('/', '-_-'),
           default_branch_only: true, // no baseBranches support yet
         },
@@ -348,6 +364,8 @@ export async function createFork(
 export async function initRepo({
   endpoint,
   repository,
+  forkCreate,
+  forkOrgs,
   forkToken,
   renovateUsername,
   cloneSubmodules,
@@ -489,7 +507,7 @@ export async function initRepo({
     // save parent name then delete
     config.parentRepo = config.repository;
     config.repository = null;
-    let forkedRepo = await findFork(forkToken, repository);
+    let forkedRepo = await findFork(forkToken, repository, forkOrgs);
     if (forkedRepo) {
       config.repository = forkedRepo.full_name;
       const forkDefaultBranch = forkedRepo.default_branch;
@@ -565,10 +583,15 @@ export async function initRepo({
         }
         throw new ExternalHostError(err);
       }
-    } else {
+    } else if (forkCreate) {
       logger.debug('Forked repo is not found - attempting to create it');
       forkedRepo = await createFork(forkToken, repository);
       config.repository = forkedRepo.full_name;
+    } else {
+      logger.debug(
+        'Forked repo is not found and forkCreate=false so need to abort'
+      );
+      throw new Error(REPOSITORY_NO_FORK);
     }
   }
 
diff --git a/lib/modules/platform/github/types.ts b/lib/modules/platform/github/types.ts
index ef01406661370ba3fb352567642a5a84a8b13d08..0f0af37526f90fcf0a15f8ef0227407540948599 100644
--- a/lib/modules/platform/github/types.ts
+++ b/lib/modules/platform/github/types.ts
@@ -90,6 +90,7 @@ export interface LocalRepoConfig {
   prReviewsRequired: boolean;
   repoForceRebase?: boolean;
   parentRepo: string | null;
+  forkOrgs?: string[];
   forkToken?: string;
   prList: GhPr[] | null;
   issueList: any[] | null;
diff --git a/lib/modules/platform/types.ts b/lib/modules/platform/types.ts
index 4a0d5a825b9cb28f5c48c8f61b04df79561e2598..09b546400938d584a0429d15ad5799d4979b20f7 100644
--- a/lib/modules/platform/types.ts
+++ b/lib/modules/platform/types.ts
@@ -37,6 +37,8 @@ export interface RepoParams {
   repository: string;
   endpoint?: string;
   gitUrl?: GitUrlOption;
+  forkCreate?: boolean;
+  forkOrgs?: string[];
   forkToken?: string;
   forkProcessing?: 'enabled' | 'disabled';
   renovateUsername?: string;
diff --git a/lib/workers/repository/error.spec.ts b/lib/workers/repository/error.spec.ts
index 07cd0838ed650c36c869f74c294e404a6c792f9d..ea625ea47398fd5449bf72a7f80b75f28c48282f 100644
--- a/lib/workers/repository/error.spec.ts
+++ b/lib/workers/repository/error.spec.ts
@@ -20,6 +20,7 @@ import {
   REPOSITORY_FORKED,
   REPOSITORY_MIRRORED,
   REPOSITORY_NOT_FOUND,
+  REPOSITORY_NO_FORK,
   REPOSITORY_NO_PACKAGE_FILES,
   REPOSITORY_RENAMED,
   REPOSITORY_UNINITIATED,
@@ -53,6 +54,7 @@ describe('workers/repository/error', () => {
       CONFIG_VALIDATION,
       REPOSITORY_ARCHIVED,
       REPOSITORY_MIRRORED,
+      REPOSITORY_NO_FORK,
       REPOSITORY_RENAMED,
       REPOSITORY_BLOCKED,
       REPOSITORY_NOT_FOUND,
diff --git a/lib/workers/repository/error.ts b/lib/workers/repository/error.ts
index bcb0cffc9122817c1d97c48c0df6b6378f7d1637..a15a55b2e908de0ad6432b47980f2081d74e397b 100644
--- a/lib/workers/repository/error.ts
+++ b/lib/workers/repository/error.ts
@@ -24,6 +24,7 @@ import {
   REPOSITORY_MIRRORED,
   REPOSITORY_NOT_FOUND,
   REPOSITORY_NO_CONFIG,
+  REPOSITORY_NO_FORK,
   REPOSITORY_NO_PACKAGE_FILES,
   REPOSITORY_RENAMED,
   REPOSITORY_UNINITIATED,
@@ -68,6 +69,11 @@ export default async function handleError(
     delete config.branchList;
     return err.message;
   }
+  if (err.message === REPOSITORY_NO_FORK) {
+    logger.info('Repository has no fork - skipping');
+    delete config.branchList;
+    return err.message;
+  }
   if (err.message === REPOSITORY_MIRRORED) {
     logger.info('Repository is a mirror - skipping');
     delete config.branchList;