diff --git a/CHANGELOG.md b/CHANGELOG.md
index e218bc4608309..01adcf7e26150 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -85,6 +85,7 @@
 * [5777](https://github.com/grafana/loki/pull/5777) **tatchiuleung**: storage: make Azure blobID chunk delimiter configurable
 * [5650](https://github.com/grafana/loki/pull/5650) **cyriltovena**: Remove more chunkstore and schema version below v9
 * [5643](https://github.com/grafana/loki/pull/5643) **simonswine**: Introduce a ChunkRef type as part of logproto
+* [6349](https://github.com/grafana/loki/pull/6349) **simonswine**: Update the default HTTP listen port from 80 to 3100. Make sure to configure the port explicitly if you are using port 80.
 #### Promtail
 
 ##### Enhancements
diff --git a/docs/sources/upgrading/_index.md b/docs/sources/upgrading/_index.md
index f8408c6914151..849d568a80a04 100644
--- a/docs/sources/upgrading/_index.md
+++ b/docs/sources/upgrading/_index.md
@@ -38,6 +38,10 @@ The output is incredibly verbose as it shows the entire internal config struct u
 
 This value now defaults to `loki`, it was previously set to `cortex`. If you are relying on this container name for your chunks or ruler storage, you will have to manually specify `-azure.container-name=cortex` or `-ruler.storage.azure.container-name=cortex` respectively.
 
+#### Default value for `server.http-listen-port` changed
+
+This value now defaults to 3100, so the Loki process doesn't require special privileges. Previously, it had been set to port 80, which is a privileged port. If you need Loki to listen on port 80, you can set it back to the previous default using `-server.http-listen-port=80`.
+
 ## 2.5.0
 
 ### Loki
diff --git a/pkg/loki/config_wrapper_test.go b/pkg/loki/config_wrapper_test.go
index 88bf2bcc1b8bd..62e3806a7cbbb 100644
--- a/pkg/loki/config_wrapper_test.go
+++ b/pkg/loki/config_wrapper_test.go
@@ -969,7 +969,7 @@ func TestDefaultUnmarshal(t *testing.T) {
 		require.NoError(t, err)
 
 		assert.True(t, config.AuthEnabled)
-		assert.Equal(t, 80, config.Server.HTTPListenPort)
+		assert.Equal(t, 3100, config.Server.HTTPListenPort)
 		assert.Equal(t, 9095, config.Server.GRPCListenPort)
 	})
 }
diff --git a/pkg/loki/loki.go b/pkg/loki/loki.go
index 42a042e1f12cf..1d884d3d1b913 100644
--- a/pkg/loki/loki.go
+++ b/pkg/loki/loki.go
@@ -137,6 +137,9 @@ func (c *Config) registerServerFlagsWithChangedDefaultValues(fs *flag.FlagSet) {
 
 		case "server.grpc.keepalive.ping-without-stream-allowed":
 			_ = f.Value.Set("true")
+
+		case "server.http-listen-port":
+			_ = f.Value.Set("3100")
 		}
 
 		fs.Var(f.Value, f.Name, f.Usage)
diff --git a/pkg/loki/loki_test.go b/pkg/loki/loki_test.go
index 93a86a4ee04ae..5a1020058af16 100644
--- a/pkg/loki/loki_test.go
+++ b/pkg/loki/loki_test.go
@@ -57,6 +57,11 @@ func TestFlagDefaults(t *testing.T) {
 	require.Contains(t, gotFlags, flagToCheck)
 	require.Equal(t, c.Server.GRPCServerPingWithoutStreamAllowed, true)
 	require.Contains(t, gotFlags[flagToCheck], "(default true)")
+
+	flagToCheck = "-server.http-listen-port"
+	require.Contains(t, gotFlags, flagToCheck)
+	require.Equal(t, c.Server.HTTPListenPort, 3100)
+	require.Contains(t, gotFlags[flagToCheck], "(default 3100)")
 }
 
 func TestLoki_isModuleEnabled(t1 *testing.T) {