diff --git a/content/en/docs/setup/install/istioctl/index.md b/content/en/docs/setup/install/istioctl/index.md
index 9bb26dc508..47d4ea2324 100644
--- a/content/en/docs/setup/install/istioctl/index.md
+++ b/content/en/docs/setup/install/istioctl/index.md
@@ -45,7 +45,7 @@ If you want to enable security on top of the `default` profile, you can set the
 security related configuration parameters:
 
 {{< text bash >}}
-$ istioctl manifest apply --set values.global.mtls.enabled=true --set values.global.controlPlaneSecurityEnabled=true
+$ istioctl manifest apply --set values.global.mtls.enabled=true
 {{< /text >}}
 
 In general, you can use the `--set` flag in `istioctl` as you would with
@@ -259,7 +259,7 @@ The configuration parameters in this API can be set individually using `--set` o
 line. For example, to enable the security feature in a default configuration profile, use this command:
 
 {{< text bash >}}
-$ istioctl manifest apply --set values.global.mtls.enabled=true --set values.global.controlPlaneSecurityEnabled=true
+$ istioctl manifest apply --set values.global.mtls.enabled=true
 {{< /text >}}
 
 Alternatively, the `IstioControlPlane` configuration can be specified in a YAML file and passed to
diff --git a/content/en/docs/setup/install/multicluster/shared-gateways/index.md b/content/en/docs/setup/install/multicluster/shared-gateways/index.md
index dc29867ba2..1da30763d7 100644
--- a/content/en/docs/setup/install/multicluster/shared-gateways/index.md
+++ b/content/en/docs/setup/install/multicluster/shared-gateways/index.md
@@ -182,7 +182,6 @@ This will be used to access pilot on `cluster1` securely using the ingress gatew
       --set values.global.mtls.enabled=true \
       --set values.gateways.enabled=true \
       --set values.security.selfSigned=false \
-      --set values.global.controlPlaneSecurityEnabled=true \
       --set values.global.createRemoteSvcEndpoints=true \
       --set values.global.remotePilotCreateSvcEndpoint=true \
       --set values.global.remotePilotAddress=${LOCAL_GW_ADDR} \
@@ -431,7 +430,6 @@ $ istioctl manifest generate --context=$CTX_CLUSTER2 \
   --set values.global.mtls.enabled=true \
   --set values.gateways.enabled=true \
   --set values.security.selfSigned=false \
-  --set values.global.controlPlaneSecurityEnabled=true \
   --set values.global.createRemoteSvcEndpoints=true \
   --set values.global.remotePilotCreateSvcEndpoint=true \
   --set values.global.remotePilotAddress=${LOCAL_GW_ADDR} \
diff --git a/content/en/docs/setup/install/multicluster/shared-vpn/index.md b/content/en/docs/setup/install/multicluster/shared-vpn/index.md
index 00fc309c9e..2ee75d5222 100644
--- a/content/en/docs/setup/install/multicluster/shared-vpn/index.md
+++ b/content/en/docs/setup/install/multicluster/shared-vpn/index.md
@@ -459,8 +459,7 @@ and endpoint to allow the remote sidecars to resolve the
     {{< text bash >}}
     $ istioctl manifest apply \
       --set values.global.mtls.enabled=true \
-      --set values.security.selfSigned=false \
-      --set values.global.controlPlaneSecurityEnabled=true
+      --set values.security.selfSigned=false
     {{< /text >}}
 
 #### Remote cluster: deploy Istio components
@@ -486,7 +485,6 @@ and endpoint to allow the remote sidecars to resolve the
       --set profile=remote \
       --set values.global.mtls.enabled=true \
       --set values.security.selfSigned=false \
-      --set values.global.controlPlaneSecurityEnabled=true \
       --set values.global.createRemoteSvcEndpoints=true \
       --set values.global.remotePilotCreateSvcEndpoint=true \
       --set values.global.remotePilotAddress=${PILOT_POD_IP} \
diff --git a/content/en/docs/tasks/security/citadel-config/plugin-ca-cert/index.md b/content/en/docs/tasks/security/citadel-config/plugin-ca-cert/index.md
index 69abf81aa4..96fa041e95 100644
--- a/content/en/docs/tasks/security/citadel-config/plugin-ca-cert/index.md
+++ b/content/en/docs/tasks/security/citadel-config/plugin-ca-cert/index.md
@@ -128,7 +128,7 @@ This requires you have `openssl` installed on your machine.
 
     {{< text bash >}}
     $ kubectl delete secret cacerts -n istio-system
-    $ istioctl manifest apply --set values.global.mtls.enabled=true --set values.global.controlPlaneSecurityEnabled=true
+    $ istioctl manifest apply --set values.global.mtls.enabled=true
     {{< /text >}}
 
 *   To remove the Istio components: follow the [uninstall instructions](/docs/setup/getting-started/#uninstall) to remove.