diff --git a/src/lib/devboot/devboot.go b/src/lib/devboot/devboot.go
index 80d5869..ebc8e42 100644
--- a/src/lib/devboot/devboot.go
+++ b/src/lib/devboot/devboot.go
@@ -15,17 +15,12 @@
 
 // Package devboot provisions the dev fleet the DCNTRLIZED_DEV way: Maestro
 // issues the identities its docker-compose.dev/debug.yaml peers bind-mount at
-// /dcntrlized/pki, and approves those satellites in the auth service trust
-// store. Dev mode runs the real security mechanisms (mTLS peer edges,
-// authorized-keys enforcement) — this only removes the human-in-the-loop for
-// the *known* dev fleet; any unknown peer still records a pending
-// authorization and is refused.
+// /dcntrlized/pki. There is no approval shortcut — a satellite's first mTLS
+// contact records a pending authorization and is refused (403) until the owner
+// approves it via /api/peers, exactly the real trust-store flow.
 package devboot
 
 import (
-	"context"
-
-	"git.dcntrlized.org/Dcntrlized/Maestro/lib/authmgmt"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/containers"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/logger"
 	"git.dcntrlized.org/Dcntrlized/Maestro/lib/pki"
@@ -36,8 +31,8 @@ import (
 // trust-store owner, Maestro uses the internal RequireMaestro endpoints).
 var Infra = []string{"dcntrlized-auth"}
 
-// Fleet lists the dev-mode satellite identities Maestro issues and approves.
-// Their CNs must match the service names used in the dev composes' pki mounts.
+// Fleet lists the dev-mode satellite identities Maestro issues. Their CNs must
+// match the service names used in the dev composes' pki mounts.
 var Fleet = []string{"keepnote", "calendar", "testservice"}
 
 // EnsureIdentities provisions the instance CA identities the dev composes
@@ -63,40 +58,3 @@ func EnsureIdentities() {
 	}
 	logger.Info("devboot: ensured dev fleet identities (%d infra + %d satellites)", len(Infra), len(Fleet))
 }
-
-// ApproveFleet approves the dev satellites in the auth service trust store —
-// the owner decision a fresh first-contact would pend, made once for the known
-// fleet. Best-effort: if the auth service is not up yet, the first-contact
-// no-op path records the pendings and the next boot approves them.
-func ApproveFleet(ctx context.Context) {
-	if len(Fleet) == 0 {
-		return
-	}
-	client, err := authmgmt.New()
-	if err != nil {
-		logger.Warn("devboot: build auth client: %v", err)
-		return
-	}
-	dataRoot, err := containers.DataRoot()
-	if err != nil {
-		logger.Warn("devboot: resolve data root: %v", err)
-		return
-	}
-	ca, err := pki.EnsureCA(dataRoot)
-	if err != nil {
-		logger.Warn("devboot: ensure instance CA: %v", err)
-		return
-	}
-	for _, name := range Fleet {
-		identity, err := pki.EnsureServiceIdentity(ca, name)
-		if err != nil {
-			logger.Warn("devboot: load identity for %s: %v", name, err)
-			continue
-		}
-		if err := client.Approve(ctx, name, identity.Meta.Fingerprint); err != nil {
-			logger.Warn("devboot: approve %s: %v", name, err)
-			continue
-		}
-		logger.Info("devboot: approved dev peer %s (%s)", name, identity.Meta.Fingerprint)
-	}
-}
diff --git a/src/main.go b/src/main.go
index d8d6a88..8b1081d 100644
--- a/src/main.go
+++ b/src/main.go
@@ -86,12 +86,9 @@ func main() {
 		if err := libcontainers.EnsureAuthRunning(ctx); err != nil {
 			log.Printf("Warning: failed to ensure shared auth service: %v", err)
 		}
-		// Dev mode: approve the known fleet in the auth trust store once the
-		// auth service is up, so the compose-managed satellites' mTLS proxies
-		// are authorized (the decision a first contact would pend).
-		if env.IsDev() {
-			devboot.ApproveFleet(ctx)
-		}
+		// No dev pre-approval: the fleet's first mTLS contact records a pending
+		// authorization and is refused (403) until the owner approves it via
+		// /api/peers — dev runs the real trust-store flow.
 		cache.ReconcileContainers(ctx, dc)
 		go cache.WatchContainers(ctx, dc)
 	}