diff --git a/CMakeLists.txt b/CMakeLists.txt
index 79c74717..191ca9f1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -20,7 +20,12 @@ option(ENABLE_PARANOID "Enable paranoid checking in the code" OFF)
 option(ENABLE_UTILS "Build util programs" OFF)
 option(ENABLE_EXAMPLES "Build example programs" OFF)
 option(ENABLE_MULTITHREADING "Enable multithreading support" OFF)
-option(ENABLE_INSECURE_AUTH_FOR_DEVTEST "Enable AZAUTH for non-TLS connections" OFF)
+#
+# RPC-with-TLS support (and its GnuTLS dependency) has been removed, so the only
+# supported transport is non-TLS and AZAUTH is sent over that non-TLS connection.
+# That requires ENABLE_INSECURE_AUTH_FOR_DEVTEST, hence it defaults to ON here.
+#
+option(ENABLE_INSECURE_AUTH_FOR_DEVTEST "Enable AZAUTH for non-TLS connections" ON)
 
 if(ENABLE_TESTS)
   set(ENABLE_UTILS ON CACHE BOOL "Building utils required by tests" FORCE)
@@ -36,6 +41,16 @@ endif()
 
 if(ENABLE_INSECURE_AUTH_FOR_DEVTEST)
   add_definitions(-DENABLE_INSECURE_AUTH_FOR_DEVTEST)
+else()
+  #
+  # RPC-with-TLS support (and its GnuTLS dependency) has been removed, so the
+  # only supported transport is non-TLS and AZAUTH is sent over that non-TLS
+  # connection. That is only permitted when ENABLE_INSECURE_AUTH_FOR_DEVTEST is
+  # enabled, so bail out here (static gate) if it is disabled.
+  #
+  message(FATAL_ERROR "ENABLE_INSECURE_AUTH_FOR_DEVTEST must be enabled: TLS "
+                      "support has been removed and AZAUTH is sent over the "
+                      "non-TLS connection.")
 endif()
 
 include(cmake/Macros.cmake)
@@ -70,6 +85,8 @@ if(CMAKE_SYSTEM_NAME STREQUAL Linux)
   # RPC-with-TLS support (and its GnuTLS dependency) has been removed. Only the
   # non-TLS transport (xprtsec=none) is supported. This avoids depending on
   # gnutls which is not an allowed package on some distros (e.g. Azure Linux).
+  # HAVE_TLS is intentionally never defined; a static gate in libnfs-private.h
+  # bails out at compile time if HAVE_TLS is ever enabled.
   #
 elseif(CMAKE_SYSTEM_NAME STREQUAL Windows OR CMAKE_SYSTEM_NAME STREQUAL WindowsStore)
   add_definitions("-D_U_=" -D_CRT_SECURE_NO_WARNINGS -D_CRT_NONSTDC_NO_DEPRECATE)
diff --git a/include/libnfs-private.h b/include/libnfs-private.h
index ea3bd917..abcbec26 100644
--- a/include/libnfs-private.h
+++ b/include/libnfs-private.h
@@ -39,6 +39,25 @@
 #include <gnutls/gnutls.h>
 #endif
 
+/*
+ * Static configuration gates.
+ *
+ * RPC-with-TLS support (and its GnuTLS dependency) has been removed, so the
+ * only supported transport is non-TLS (xprtsec=none) and AZAUTH is sent over
+ * that non-TLS connection. That is only permitted when
+ * ENABLE_INSECURE_AUTH_FOR_DEVTEST is enabled. These gates bail out at compile
+ * time (rather than fail mysteriously later) if the build is not configured
+ * as expected:
+ * - HAVE_TLS must NOT be enabled.
+ * - ENABLE_INSECURE_AUTH_FOR_DEVTEST must be enabled.
+ */
+#ifdef HAVE_TLS
+#error "HAVE_TLS must not be enabled: RPC-with-TLS support has been removed."
+#endif
+#ifndef ENABLE_INSECURE_AUTH_FOR_DEVTEST
+#error "ENABLE_INSECURE_AUTH_FOR_DEVTEST must be enabled: TLS support has been removed and AZAUTH is sent over the non-TLS connection."
+#endif
+
 #if defined(WIN32) && !defined(IFNAMSIZ)
 #define IFNAMSIZ 255
 #endif
diff --git a/lib/libnfs.c b/lib/libnfs.c
index caaf2a02..14e73eb9 100755
--- a/lib/libnfs.c
+++ b/lib/libnfs.c
@@ -358,10 +358,10 @@ nfs_set_context_args(struct nfs_context *nfs, const char *arg, const char *val)
 		}
 	} else if (nfs->rpc && !strcmp(arg, "xprtsec")) {
 		if (!strcmp(val, "none")) {
-#ifdef HAVE_TLS
-			nfs_set_xprtsecurity(nfs, RPC_XPRTSEC_NONE);
-#endif
-			/* Non-TLS transport, nothing to configure. */
+			/*
+			 * Non-TLS is the only supported transport, so there
+			 * is nothing to configure for xprtsec=none.
+			 */
 #ifdef HAVE_TLS
 		} else if (!strcmp(val, "tls")) {
 			nfs_set_xprtsecurity(nfs, RPC_XPRTSEC_TLS);
@@ -603,11 +603,9 @@ int nfs_set_auth_context(struct nfs_context *nfs,
         assert(client_id);
 
         if (nfs->rpc) {
-#if defined(HAVE_TLS) && !defined(ENABLE_INSECURE_AUTH_FOR_DEVTEST)
+#ifndef ENABLE_INSECURE_AUTH_FOR_DEVTEST
                 /*
                  * If not devtest, don't allow auth unless transport is secure.
-                 * Note: When TLS support is not compiled in (no gnutls), only
-                 * the non-TLS transport exists, so auth is always allowed.
                  */
                 if (nfs->rpc->wanted_xprtsec == RPC_XPRTSEC_NONE) {
                         RPC_LOG(nfs->rpc, 1, "Cannot enable auth for xprtsec=none");
@@ -1099,6 +1097,7 @@ rpc_connect_program_5_cb(struct rpc_context *rpc, int status,
 	free_rpc_cb_data(data);
 }
 
+#ifdef HAVE_TLS
 static void
 rpc_connect_program_5_0_cb(struct rpc_context *rpc, int status,
                            void *command_data, void *private_data)
@@ -1139,6 +1138,7 @@ rpc_connect_program_5_0_cb(struct rpc_context *rpc, int status,
                 return;
         }
 }
+#endif /* HAVE_TLS */
 
 static void
 rpc_connect_program_4_cb(struct rpc_context *rpc, int status,
@@ -1185,14 +1185,13 @@ rpc_connect_program_4_cb(struct rpc_context *rpc, int status,
 	} else
 #endif /* HAVE_TLS */
 
+#ifdef ENABLE_INSECURE_AUTH_FOR_DEVTEST
         if (rpc->use_azauth) {
                 /*
-                 * TLS support has been removed, so AZAUTH is always sent over a
-                 * non-TLS connection. When the context has azauth enabled we
-                 * send the AZAUTH RPC (AzAuthNone/AzAuthAAD) as the very first
-                 * RPC on the connection. If the server does not have azauth
-                 * enabled it will not respond and the AZAUTH RPC will time out;
-                 * rpc_connect_program_4_2_cb() reports that case clearly.
+                 * Insecure connection, if azauth is enabled perform auth.
+                 *
+                 * Note: THIS WOULD SEND THE TOKEN OVER AN INSECURE CONNECTION
+                 *       AND MUST ONLY BE USED IN DEVTEST ON TRUSTED NETWORKS.
                  */
                 if (rpc_perform_azauth(rpc, rpc_connect_program_5_cb, data) == NULL) {
                         data->cb(rpc, RPC_STATUS_ERROR, command_data, data->private_data);
@@ -1200,6 +1199,7 @@ rpc_connect_program_4_cb(struct rpc_context *rpc, int status,
                         return;
                 }
         } else
+#endif
         if (rpc_null_task(rpc, data->program, data->version,
                           rpc_connect_program_5_cb, data) == NULL) {
                 data->cb(rpc, RPC_STATUS_ERROR, command_data, data->private_data);
diff --git a/lib/socket.c b/lib/socket.c
index 0a1872a1..c779705d 100644
--- a/lib/socket.c
+++ b/lib/socket.c
@@ -2095,13 +2095,15 @@ reconnect_cb(struct rpc_context *rpc, int status, void *data,
 		}
 	} else
 #endif /* HAVE_TLS */
+#ifdef ENABLE_INSECURE_AUTH_FOR_DEVTEST
         if (rpc->use_azauth) {
                 /*
-                 * TLS support has been removed, so AZAUTH is sent over the
-                 * non-TLS connection on reconnect too. This re-authorizes the
-                 * reconnected connection before any other RPC is sent on it.
+                 * Insecure connection, if azauth is enabled perform auth.
+                 *
+                 * Note: THIS WOULD SEND THE TOKEN OVER AN INSECURE CONNECTION
+                 *       AND MUST ONLY BE USED IN DEVTEST ON TRUSTED NETWORKS.
                  */
-                RPC_LOG(rpc, 2, "reconnect_cb: sending AZAUTH RPC");
+                RPC_LOG(rpc, 2, "reconnect_cb: sending insecure AZAUTH RPC");
 
                 if (rpc_perform_azauth(rpc, reconnect_cb_azauth, NULL) == NULL) {
                         RPC_LOG(rpc, 1, "reconnect_cb: rpc_perform_azauth() failed, "
@@ -2114,6 +2116,7 @@ reconnect_cb(struct rpc_context *rpc, int status, void *data,
                         rpc_reconnect_requeue(rpc);
                 }
         }
+#endif
 }
 
 /* Disconnect but do not error all PDUs, just move pdus in-flight back to the