diff --git a/crates/walgit-config/src/lib.rs b/crates/walgit-config/src/lib.rs
index e3cdaf15..fd90f0ec 100644
--- a/crates/walgit-config/src/lib.rs
+++ b/crates/walgit-config/src/lib.rs
@@ -40,7 +40,6 @@ pub struct Config {
 #[serde(deny_unknown_fields, default)]
 pub struct ServerConfig {
     pub listen: SocketAddr,
-    pub http2: bool,
     pub max_concurrent_requests: usize,
     /// Per-repo cap on concurrent upload-pack/receive-pack processes.
     pub max_concurrent_per_repo: usize,
@@ -256,7 +255,6 @@ pub enum StoreBackend {
 pub struct GcsConfig {
     /// gRPC endpoint.
     pub endpoint: String,
-    pub direct_connectivity: bool,
     /// Service account for signed URLs; None = ADC/IAM signBlob.
     pub signing_service_account: Option<String>,
     /// Separate data clients (own channels) for bulk traffic — pack/idx/side-
@@ -796,7 +794,6 @@ impl Default for ServerConfig {
     fn default() -> Self {
         ServerConfig {
             listen: std::net::SocketAddr::from(([127, 0, 0, 1], 8080)),
-            http2: true,
             max_concurrent_requests: 512,
             max_concurrent_per_repo: 64,
             request_timeout: Duration::from_hours(1),
@@ -852,7 +849,6 @@ impl Default for GcsConfig {
     fn default() -> Self {
         GcsConfig {
             endpoint: "https://storage.googleapis.com".into(),
-            direct_connectivity: true,
             signing_service_account: None,
             bulk_clients: 4,
             bulk_concurrency: 32,
@@ -1549,6 +1545,16 @@ mod tests {
         );
     }
 
+    #[test]
+    fn removed_transport_switches_are_rejected() {
+        for input in [
+            "[server]\nhttp2 = false\n",
+            "[store.gcs]\ndirect_connectivity = false\n",
+        ] {
+            assert!(Config::parse(input).is_err(), "{input}");
+        }
+    }
+
     #[test]
     fn settings_merge_over_config_and_are_restricted() {
         let mut base = Config::default();
diff --git a/walgit.example.toml b/walgit.example.toml
index 79584aa9..44aa691c 100644
--- a/walgit.example.toml
+++ b/walgit.example.toml
@@ -6,7 +6,6 @@
 
 [server]
 listen = "127.0.0.1:8080"        # default; `mode = none` is refused unless this is loopback. Public bind: 0.0.0.0 with token/oidc.
-http2 = true                      # HTTP/2 (h2c when TLS is off, ALPN when on)
 max_concurrent_requests = 512     # global cap on in-flight git requests
 max_concurrent_per_repo = 64      # per-repo cap (upload-pack / receive-pack)
 request_timeout = "1h"
@@ -80,7 +79,6 @@ force_path_style = false          # true for most self-hosted S3 implementations
 
 [store.gcs]
 endpoint = "https://storage.googleapis.com"  # gRPC endpoint; credentials = Application Default Credentials
-direct_connectivity = true
 # signing_service_account = "sa@project.iam.gserviceaccount.com"   # for lfs serve_via = "signed_url"
 bulk_clients = 4                  # separate data channels for pack/idx/side-file/LFS bytes + ranged reads
 bulk_concurrency = 32             # max concurrent bulk requests per process (control plane never queues behind them)