diff --git a/cmd/frontend/main.go b/cmd/frontend/main.go
index e8340df1..6d30b002 100644
--- a/cmd/frontend/main.go
+++ b/cmd/frontend/main.go
@@ -107,6 +107,7 @@ func main() {
 		ThirdPartyPath:       *thirdPartyPath,
 		DevMode:              *devMode,
 		AppVersionLabel:      cfg.AppVersionLabel(),
+		GoogleTagManagerID:   cfg.GoogleTagManagerID,
 	})
 	if err != nil {
 		log.Fatalf(ctx, "frontend.NewServer: %v", err)
diff --git a/content/static/html/base.tmpl b/content/static/html/base.tmpl
index f7d70866..1ba62659 100644
--- a/content/static/html/base.tmpl
+++ b/content/static/html/base.tmpl
@@ -10,6 +10,7 @@
 <meta http-equiv="X-UA-Compatible" content="IE=edge">
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="Description" content="Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.">
+<meta class="js-gtmID" data-gtmID="{{.GoogleTagManagerID}}">
 <link href="https://fonts.googleapis.com/css?family=Work+Sans:600|Roboto:400,500,700|Source+Code+Pro" rel="stylesheet">
 <link href="/static/css/stylesheet.css?version={{.AppVersionLabel}}" rel="stylesheet">
 {{if (.Experiments.IsActive "sidenav")}}
@@ -194,8 +195,8 @@
 
 {{if not .DevMode}}
 <script async>
-  var gtmURL = "https://www.googletagmanager.com/gtm.js?id=GTM-W8MVQXG";
-  loadScript(gtmURL);
+  const gtmID = document.querySelector('.js-gtmID');
+  loadScript(`https://www.googletagmanager.com/gtm.js?id=${gtmID.dataset.path}`);
 
   f = document.createElement("iframe")
   f.src = gtmURL;
diff --git a/internal/config/config.go b/internal/config/config.go
index e8bfdc78..c49d63fc 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -76,6 +76,10 @@ type Config struct {
 
 	GaeEnv string
 
+	// GoogleTagManagerID is the ID used for GoogleTagManager. It has the
+	// structure GTM-XXXX.
+	GoogleTagManagerID string
+
 	// AppMonitoredResource is the resource for the current GAE app.
 	// See https://cloud.google.com/monitoring/api/resources#tag_gae_app for more
 	// details:
@@ -221,12 +225,13 @@ func Init(ctx context.Context) (_ *Config, err error) {
 		Port:      os.Getenv("PORT"),
 		DebugPort: os.Getenv("DEBUG_PORT"),
 		// Resolve AppEngine identifiers
-		ProjectID:    os.Getenv("GOOGLE_CLOUD_PROJECT"),
-		ServiceID:    os.Getenv("GAE_SERVICE"),
-		VersionID:    os.Getenv("GAE_VERSION"),
-		InstanceID:   os.Getenv("GAE_INSTANCE"),
-		GaeEnv:       os.Getenv("GAE_ENV"),
-		QueueService: GetEnv("GO_DISCOVERY_QUEUE_SERVICE", os.Getenv("GAE_SERVICE")),
+		ProjectID:          os.Getenv("GOOGLE_CLOUD_PROJECT"),
+		ServiceID:          os.Getenv("GAE_SERVICE"),
+		VersionID:          os.Getenv("GAE_VERSION"),
+		InstanceID:         os.Getenv("GAE_INSTANCE"),
+		GaeEnv:             os.Getenv("GAE_ENV"),
+		GoogleTagManagerID: os.Getenv("GO_DISCOVERY_GOOGLE_TAG_MANAGER_ID"),
+		QueueService:       GetEnv("GO_DISCOVERY_QUEUE_SERVICE", os.Getenv("GAE_SERVICE")),
 		// LocationID is essentially hard-coded until we figure out a good way to
 		// determine it programmatically, but we check an environment variable in
 		// case it needs to be overridden.
diff --git a/internal/frontend/server.go b/internal/frontend/server.go
index 4e83504c..be2ed564 100644
--- a/internal/frontend/server.go
+++ b/internal/frontend/server.go
@@ -40,6 +40,7 @@ type Server struct {
 	devMode              bool
 	errorPage            []byte
 	appVersionLabel      string
+	googleTagManagerID   string
 
 	mu        sync.Mutex // Protects all fields below
 	templates map[string]*template.Template
@@ -55,6 +56,7 @@ type ServerConfig struct {
 	ThirdPartyPath       string
 	DevMode              bool
 	AppVersionLabel      string
+	GoogleTagManagerID   string
 }
 
 // NewServer creates a new Server for the given database and template directory.
@@ -76,6 +78,7 @@ func NewServer(scfg ServerConfig) (_ *Server, err error) {
 		templates:            ts,
 		taskIDChangeInterval: scfg.TaskIDChangeInterval,
 		appVersionLabel:      scfg.AppVersionLabel,
+		googleTagManagerID:   scfg.GoogleTagManagerID,
 	}
 	errorPageBytes, err := s.renderErrorPage(context.Background(), http.StatusInternalServerError, "error.tmpl", nil)
 	if err != nil {
@@ -185,12 +188,13 @@ func (s *Server) staticPageHandler(templateName, title string) http.HandlerFunc
 
 // basePage contains fields shared by all pages when rendering templates.
 type basePage struct {
-	HTMLTitle       string
-	Query           string
-	Experiments     *experiment.Set
-	GodocURL        string
-	DevMode         bool
-	AppVersionLabel string
+	HTMLTitle          string
+	Query              string
+	Experiments        *experiment.Set
+	GodocURL           string
+	DevMode            bool
+	AppVersionLabel    string
+	GoogleTagManagerID string
 }
 
 // licensePolicyPage is used to generate the static license policy page.
@@ -215,12 +219,13 @@ func (s *Server) licensePolicyHandler() http.HandlerFunc {
 // newBasePage returns a base page for the given request and title.
 func (s *Server) newBasePage(r *http.Request, title string) basePage {
 	return basePage{
-		HTMLTitle:       title,
-		Query:           searchQuery(r),
-		Experiments:     experiment.FromContext(r.Context()),
-		GodocURL:        middleware.GodocURLPlaceholder,
-		DevMode:         s.devMode,
-		AppVersionLabel: s.appVersionLabel,
+		HTMLTitle:          title,
+		Query:              searchQuery(r),
+		Experiments:        experiment.FromContext(r.Context()),
+		GodocURL:           middleware.GodocURLPlaceholder,
+		DevMode:            s.devMode,
+		AppVersionLabel:    s.appVersionLabel,
+		GoogleTagManagerID: s.googleTagManagerID,
 	}
 }
 
diff --git a/internal/middleware/secureheaders.go b/internal/middleware/secureheaders.go
index 9bc7562f..66c6a7d5 100644
--- a/internal/middleware/secureheaders.go
+++ b/internal/middleware/secureheaders.go
@@ -11,19 +11,19 @@ import (
 )
 
 var scriptHashes = []string{
-	// From content/static/html/pages/base.tmpl
+	// From content/static/html/base.tmpl
+	"'sha256-Ajmr6RIM6VV5w/AraBIyO4/XRyuqJlFVukc7TL6feog='",
 	"'sha256-d6W7MwuGWbguTHRzQhf5QN1jXmNo9Ao218saZkWLWZI='",
-	"'sha256-CCu0fuIQFBHSCEpfR6ZRzzcczJIS/VGMGrez8LR49WY='",
 	"'sha256-qPGTOKPn+niRiNKQIEX0Ktwuj+D+iPQWIxnlhPicw58='",
 	// From content/static/html/pages/details.tmpl
 	"'sha256-s16e7aT7Gsajq5UH1DbaEFEnNx2VjvS5Xixcxwm4+F8='",
+	// From content/static/html/pages/fetch.tmpl
+	"'sha256-1J6DWwTWs/QDZ2+ORDuUQCibmFnXXaNXYOtc0Jk6VU4='",
 	// From content/static/html/pages/pkg_doc.tmpl
 	"'sha256-gBtJYPzfgw/0FIACORDIAD08i5rxTQ5J0rhIU656A2U='",
 	"'sha256-91GG/273d2LdEV//lJMbTodGN501OuKZKYYphui+wDQ='",
 	// From content/static/html/worker/index.tmpl
 	"'sha256-5EpitFYSzGNQNUsqi5gAaLqnI3ZWfcRo/6gLTO0oCoE='",
-	// From content/static/html/pages/fetch.tmpl
-	"'sha256-1J6DWwTWs/QDZ2+ORDuUQCibmFnXXaNXYOtc0Jk6VU4='",
 }
 
 // SecureHeaders adds a content-security-policy and other security-related