diff --git a/server/lib/blueprints/publicResources.ts b/server/lib/blueprints/publicResources.ts
index 6a52a9872..76bf7fa82 100644
--- a/server/lib/blueprints/publicResources.ts
+++ b/server/lib/blueprints/publicResources.ts
@@ -279,20 +279,6 @@ export async function updatePublicResources(
             ? JSON.stringify(resourceData.responseHeaders)
             : null;
 
-        // mTLS is a security control: refuse (rather than silently drop) a
-        // blueprint that asks for it on a plan that doesn't include it.
-        if (resourceData.mtls?.enabled) {
-            const mtlsLicensed = await isLicensedOrSubscribed(
-                orgId,
-                tierMatrix.mtls
-            );
-            if (!mtlsLicensed) {
-                throw new Error(
-                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
-                );
-            }
-        }
-
         if (resourceData.policy) {
             const isLicensed = await isLicensedOrSubscribed(
                 orgId,
@@ -1695,7 +1681,10 @@ async function syncResourceMtlsCertificates(
     trx: Transaction
 ) {
     // A PEM entry may itself be a bundle; flatten and dedupe by fingerprint.
-    const desired = new Map<string, ReturnType<typeof parseCaCertificates>[0]>();
+    const desired = new Map<
+        string,
+        ReturnType<typeof parseCaCertificates>[0]
+    >();
     for (const pem of caCertificates) {
         for (const cert of parseCaCertificates(pem)) {
             desired.set(cert.fingerprint, cert);
@@ -1960,13 +1949,9 @@ async function syncInlinePolicyRules(
                     .update(resourcePolicyRules)
                     .set({
                         action: getRuleAction(rule.action) as
-                            | "ACCEPT"
-                            | "DROP"
-                            | "PASS",
+                            "ACCEPT" | "DROP" | "PASS",
                         match: rule.match.toUpperCase() as
-                            | "CIDR"
-                            | "IP"
-                            | "PATH",
+                            "CIDR" | "IP" | "PATH",
                         value: getRuleValue(
                             rule.match.toUpperCase(),
                             rule.value
@@ -1980,9 +1965,7 @@ async function syncInlinePolicyRules(
             await trx.insert(resourcePolicyRules).values({
                 resourcePolicyId: policyId,
                 action: getRuleAction(rule.action) as
-                    | "ACCEPT"
-                    | "DROP"
-                    | "PASS",
+                    "ACCEPT" | "DROP" | "PASS",
                 match: rule.match.toUpperCase() as "CIDR" | "IP" | "PATH",
                 value: getRuleValue(rule.match.toUpperCase(), rule.value),
                 priority: intendedPriority
diff --git a/server/private/routers/billing/featureLifecycle.ts b/server/private/routers/billing/featureLifecycle.ts
index b26d6afe5..a7bf59bf0 100644
--- a/server/private/routers/billing/featureLifecycle.ts
+++ b/server/private/routers/billing/featureLifecycle.ts
@@ -295,18 +295,10 @@ async function disableFeature(
                 await disableAISessionLogs(orgId);
                 break;
 
-            case TierFeature.RotateCredentials:
-                await disableRotateCredentials(orgId);
-                break;
-
             case TierFeature.MaintenancePage:
                 await disablemaintenancePage(orgId);
                 break;
 
-            case TierFeature.Mtls:
-                await disableMtls(orgId);
-                break;
-
             case TierFeature.DevicePosture:
                 await disableDevicePosture(orgId);
                 break;
diff --git a/server/routers/resource/createResourceMtlsCertificate.ts b/server/routers/resource/createResourceMtlsCertificate.ts
index 5ad04b55d..2f32ed89d 100644
--- a/server/routers/resource/createResourceMtlsCertificate.ts
+++ b/server/routers/resource/createResourceMtlsCertificate.ts
@@ -8,8 +8,6 @@ import createHttpError from "http-errors";
 import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
-import { isLicensedOrSubscribed } from "#private/lib/isLicencedOrSubscribed";
-import { tierMatrix } from "@server/lib/billing/tierMatrix";
 import {
     MAX_MTLS_CERTIFICATES_PER_RESOURCE,
     parseCaCertificates
@@ -120,19 +118,6 @@ export async function createResourceMtlsCertificate(
             );
         }
 
-        const isLicensed = await isLicensedOrSubscribed(
-            resource.orgId,
-            tierMatrix.mtls
-        );
-        if (!isLicensed) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
-                )
-            );
-        }
-
         let parsedCerts;
         try {
             parsedCerts = parseCaCertificates(certificate);
diff --git a/server/routers/resource/updateResource.ts b/server/routers/resource/updateResource.ts
index a366cc7a2..a55b08ec4 100644
--- a/server/routers/resource/updateResource.ts
+++ b/server/routers/resource/updateResource.ts
@@ -534,23 +534,12 @@ async function updateHttpResource(
             );
         }
 
-        const isMtlsLicensed = await isLicensedOrSubscribed(
-            resource.orgId,
-            tierMatrix.mtls
-        );
-        if (!isMtlsLicensed) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "mTLS is not supported on your current plan. Please upgrade to access this feature."
-                )
-            );
-        }
-
         const [{ certificateCount }] = await db
             .select({ certificateCount: count() })
             .from(resourceMtlsCertificates)
-            .where(eq(resourceMtlsCertificates.resourceId, resource.resourceId));
+            .where(
+                eq(resourceMtlsCertificates.resourceId, resource.resourceId)
+            );
 
         if (certificateCount === 0) {
             return next(
@@ -572,8 +561,10 @@ async function updateHttpResource(
     }
 
     // catch when the resource policy changes or gets cleared
-    if (updateData.resourcePolicyId !== undefined &&
-        resource.resourcePolicyId !== updateData.resourcePolicyId) {
+    if (
+        updateData.resourcePolicyId !== undefined &&
+        resource.resourcePolicyId !== updateData.resourcePolicyId
+    ) {
         await clearResourceSpecificSettings(
             resource.resourceId,
             resource.orgId,