diff --git a/SecurityService.BusinessLogic/Oidc/OAuthGrantPolicy.cs b/SecurityService.BusinessLogic/Oidc/OAuthGrantPolicy.cs
index fd17531..4194d2e 100644
--- a/SecurityService.BusinessLogic/Oidc/OAuthGrantPolicy.cs
+++ b/SecurityService.BusinessLogic/Oidc/OAuthGrantPolicy.cs
@@ -31,7 +31,7 @@ public static bool IsGrantAllowed(string grantType, string clientId, OAuthOption
             return true;
         }
 
-        if (string.Equals(grantType, "hybrid", StringComparison.OrdinalIgnoreCase) && options.EnableHybridFlow == false)
+        if (LegacyGrantTypes.Contains(grantType) && options.EnableLegacyGrantTypes == false)
         {
             return false;
         }
diff --git a/SecurityService.BusinessLogic/SecurityServiceOptions.cs b/SecurityService.BusinessLogic/SecurityServiceOptions.cs
index ad009f3..9c27309 100644
--- a/SecurityService.BusinessLogic/SecurityServiceOptions.cs
+++ b/SecurityService.BusinessLogic/SecurityServiceOptions.cs
@@ -59,7 +59,7 @@ public ServiceOptions()
 
 public sealed class OAuthOptions
 {
-    public bool EnableHybridFlow { get; set; }
+    public bool EnableLegacyGrantTypes { get; set; } = true;
 
     public Dictionary<string, List<string>> LegacyGrantTypeClients { get; set; } = new(StringComparer.OrdinalIgnoreCase);
 }
diff --git a/SecurityService.IntegrationTests/Common/DockerHelper.cs b/SecurityService.IntegrationTests/Common/DockerHelper.cs
index e9666ea..5e3c3b8 100644
--- a/SecurityService.IntegrationTests/Common/DockerHelper.cs
+++ b/SecurityService.IntegrationTests/Common/DockerHelper.cs
@@ -86,7 +86,7 @@ public override ContainerBuilder SetupSecurityServiceContainer()
             environmentVariables.Add("ServiceOptions:ManagementBootstrap:ClientSecret", "management-bootstrap-secret");
             environmentVariables.Add("ServiceOptions:OAuth:LegacyGrantTypeClients:password:0", "merchantClient");
             environmentVariables.Add("ServiceOptions:OAuth:LegacyGrantTypeClients:hybrid:0", "testclient2");
-            environmentVariables.Add("ServiceOptions:OAuth:EnableHybridFlow", "true");
+            environmentVariables.Add("ServiceOptions:OAuth:EnableLegacyGrantTypes", "true");
             environmentVariables.Add("ConnectionStrings:PersistedGrantDbContext", this.SetConnectionString($"PersistedGrantStore-{this.TestId}", this.UseSecureSqlServerDatabase));
             environmentVariables.Add("ConnectionStrings:ConfigurationDbContext", this.SetConnectionString($"Configuration-{this.TestId}", this.UseSecureSqlServerDatabase));
             environmentVariables.Add("ConnectionStrings:AuthenticationDbContext", this.SetConnectionString($"Authentication-{this.TestId}", this.UseSecureSqlServerDatabase));
diff --git a/SecurityService.UnitTests/Oidc/OAuthGrantPolicyTests.cs b/SecurityService.UnitTests/Oidc/OAuthGrantPolicyTests.cs
index b57b963..591a0e3 100644
--- a/SecurityService.UnitTests/Oidc/OAuthGrantPolicyTests.cs
+++ b/SecurityService.UnitTests/Oidc/OAuthGrantPolicyTests.cs
@@ -59,7 +59,7 @@ public void HybridFlow_IsRejectedWhenFeatureIsDisabled()
     {
         var options = new OAuthOptions
         {
-            EnableHybridFlow = false,
+            EnableLegacyGrantTypes = false,
             LegacyGrantTypeClients = new(StringComparer.OrdinalIgnoreCase)
             {
                 ["hybrid"] = ["browser-client"]
@@ -69,12 +69,29 @@ public void HybridFlow_IsRejectedWhenFeatureIsDisabled()
         OAuthGrantPolicy.IsGrantAllowed("hybrid", "browser-client", options).ShouldBeFalse();
     }
 
+    [Fact]
+    public void LegacyGrantTypes_AreRejectedWhenCompatibilitySwitchIsDisabled()
+    {
+        var options = new OAuthOptions
+        {
+            EnableLegacyGrantTypes = false,
+            LegacyGrantTypeClients = new(StringComparer.OrdinalIgnoreCase)
+            {
+                [GrantTypes.Password] = ["mobile-client"],
+                ["hybrid"] = ["browser-client"]
+            }
+        };
+
+        OAuthGrantPolicy.IsGrantAllowed(GrantTypes.Password, "mobile-client", options).ShouldBeFalse();
+        OAuthGrantPolicy.IsGrantAllowed("hybrid", "browser-client", options).ShouldBeFalse();
+    }
+
     [Fact]
     public void HybridFlow_IsAllowedForConfiguredClientWhenFeatureIsEnabled()
     {
         var options = new OAuthOptions
         {
-            EnableHybridFlow = true,
+            EnableLegacyGrantTypes = true,
             LegacyGrantTypeClients = new(StringComparer.OrdinalIgnoreCase)
             {
                 ["hybrid"] = ["browser-client"]
diff --git a/SecurityService/HostedServices/DatabaseInitializer.cs b/SecurityService/HostedServices/DatabaseInitializer.cs
index 6787316..85e8048 100644
--- a/SecurityService/HostedServices/DatabaseInitializer.cs
+++ b/SecurityService/HostedServices/DatabaseInitializer.cs
@@ -85,10 +85,13 @@ private async Task SynchronizeApplicationPermissionsAsync(IServiceProvider servi
             await applicationManager.PopulateAsync(descriptor, application, cancellationToken);
 
             IReadOnlyCollection<string> allowedGrantTypes = JsonListSerializer.Deserialize(client.AllowedGrantTypesJson);
-            if (this.Options.OAuth.EnableHybridFlow == false)
+            if (this.Options.OAuth.EnableLegacyGrantTypes == false)
             {
                 allowedGrantTypes = allowedGrantTypes
-                    .Where(grantType => string.Equals(grantType, "hybrid", StringComparison.OrdinalIgnoreCase) == false)
+                    .Where(grantType =>
+                        string.Equals(grantType, "password", StringComparison.OrdinalIgnoreCase) == false &&
+                        string.Equals(grantType, "implicit", StringComparison.OrdinalIgnoreCase) == false &&
+                        string.Equals(grantType, "hybrid", StringComparison.OrdinalIgnoreCase) == false)
                     .ToArray();
             }
 
diff --git a/SecurityService/Program.cs b/SecurityService/Program.cs
index 40cbcb0..56d59d6 100644
--- a/SecurityService/Program.cs
+++ b/SecurityService/Program.cs
@@ -304,17 +304,21 @@
                      .AllowClientCredentialsFlow()
                      .AllowRefreshTokenFlow();
 
-         if (options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Password, out List<string>? passwordClients) && passwordClients.Count > 0)
+         if (options.OAuth.EnableLegacyGrantTypes &&
+             options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Password, out List<string>? passwordClients) &&
+             passwordClients.Count > 0)
          {
              serverOptions.AllowPasswordFlow();
          }
 
-         if (options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Implicit, out List<string>? implicitClients) && implicitClients.Count > 0)
+         if (options.OAuth.EnableLegacyGrantTypes &&
+             options.OAuth.LegacyGrantTypeClients.TryGetValue(OpenIddictConstants.GrantTypes.Implicit, out List<string>? implicitClients) &&
+             implicitClients.Count > 0)
          {
              serverOptions.AllowImplicitFlow();
          }
 
-         if (options.OAuth.EnableHybridFlow &&
+         if (options.OAuth.EnableLegacyGrantTypes &&
              options.OAuth.LegacyGrantTypeClients.TryGetValue("hybrid", out List<string>? hybridClients) &&
              hybridClients.Count > 0)
          {
diff --git a/SecurityService/appsettings.json b/SecurityService/appsettings.json
index ea0b27a..af45c13 100644
--- a/SecurityService/appsettings.json
+++ b/SecurityService/appsettings.json
@@ -31,7 +31,7 @@
       "PasswordResetTokenExpiryInHours": 2
     },
     "OAuth": {
-      "EnableHybridFlow": true,
+      "EnableLegacyGrantTypes": true,
       "LegacyGrantTypeClients": {
         "hybrid": [
           "managementUIClient"
diff --git a/SecurityService/appsettings.staging.json b/SecurityService/appsettings.staging.json
index aca7a45..2d7d1fa 100644
--- a/SecurityService/appsettings.staging.json
+++ b/SecurityService/appsettings.staging.json
@@ -3,7 +3,7 @@
     "PublicOrigin": "https://192.168.1.163:5001",
     "IssuerUrl": "https://192.168.1.163:5001",
     "OAuth": {
-      "EnableHybridFlow": true,
+      "EnableLegacyGrantTypes": true,
       "LegacyGrantTypeClients": {
         "hybrid": [
           "managementUIClient"