diff --git a/docs/server/quick-start/upgrade-guide.md b/docs/server/quick-start/upgrade-guide.md
index 12c9dfbc340..a1d329db69a 100644
--- a/docs/server/quick-start/upgrade-guide.md
+++ b/docs/server/quick-start/upgrade-guide.md
@@ -397,7 +397,7 @@ KurrentDB 25.0 includes [a plugin](../configuration/networking.md#external-tcp)
 A number of configuration options have been removed as part of this. KurrentDB will not start by default if any of the following options are present in the database configuration:
 
 - `AdvertiseTcpPortToClientAs`
-- `DisableExternalTcpTls`
+- `DisableExternalTcpTls` — this option is now available again under the [TCP plugin](../configuration/networking.md#external-tcp) configuration section as `TcpPlugin:DisableExternalTcpTls`
 - `EnableExternalTcp`
 - `ExtHostAdvertiseAs`
 - `ExtTcpHeartbeatInterval`
diff --git a/src/KurrentDB.Core/ClusterVNode.cs b/src/KurrentDB.Core/ClusterVNode.cs
index f9207b927a2..4eeff646acc 100644
--- a/src/KurrentDB.Core/ClusterVNode.cs
+++ b/src/KurrentDB.Core/ClusterVNode.cs
@@ -294,11 +294,15 @@ public ClusterVNode(ClusterVNodeOptions options,
 		OptionsFormatter.LogConfig("Archive", archiveOptions);
 		archiveOptions.Validate();
 
-		var disableInternalTcpTls = options.Application.Insecure;
-		var disableExternalTcpTls = options.Application.Insecure;
 		var nodeTcpOptions = GetOptions<NodeTcpOptions>("TcpPlugin");
+		var disableInternalTcpTls = options.Application.Insecure;
+		var disableExternalTcpTls = options.Application.Insecure || nodeTcpOptions.DisableExternalTcpTls;
 		var enableExternalTcp = nodeTcpOptions.EnableExternalTcp;
 
+		if (nodeTcpOptions.DisableExternalTcpTls && !options.Application.Insecure)
+			Log.Warning("TLS is disabled for external TCP connections via the DisableExternalTcpTls option. " +
+			            "This is not recommended for production environments.");
+
 		var httpEndPoint = new IPEndPoint(options.Interface.NodeIp, options.Interface.NodePort);
 
 		var intTcp = disableInternalTcpTls
diff --git a/src/KurrentDB.Core/NodeTcpOptions.cs b/src/KurrentDB.Core/NodeTcpOptions.cs
index 6383d84ccae..d26d818fa05 100644
--- a/src/KurrentDB.Core/NodeTcpOptions.cs
+++ b/src/KurrentDB.Core/NodeTcpOptions.cs
@@ -7,5 +7,6 @@ namespace KurrentDB.Core;
 public class NodeTcpOptions {
 	public int NodeTcpPort { get; init; } = 1113;
 	public bool EnableExternalTcp { get; init; }
+	public bool DisableExternalTcpTls { get; init; }
 	public int? NodeTcpPortAdvertiseAs { get; init; }
 }
diff --git a/src/KurrentDB.TcpPlugin.Tests/EventStoreOptionsTests.cs b/src/KurrentDB.TcpPlugin.Tests/EventStoreOptionsTests.cs
index 37a8005370b..91a886fb842 100644
--- a/src/KurrentDB.TcpPlugin.Tests/EventStoreOptionsTests.cs
+++ b/src/KurrentDB.TcpPlugin.Tests/EventStoreOptionsTests.cs
@@ -49,6 +49,19 @@ public void can_be_insecure() {
 		Assert.True(sut.Insecure);
 	}
 
+	[Fact]
+	public void disable_external_tcp_tls_defaults_to_false() {
+		var sut = CreateSut();
+		Assert.False(sut.TcpPlugin.DisableExternalTcpTls);
+	}
+
+	[Fact]
+	public void can_disable_external_tcp_tls() {
+		var sut = CreateSut(
+			($"{KurrentConfigurationKeys.Prefix}:TcpPlugin:DisableExternalTcpTls", "true"));
+		Assert.True(sut.TcpPlugin.DisableExternalTcpTls);
+	}
+
 	[Fact]
 	public void can_set_ip() {
 		var sut = CreateSut(
diff --git a/src/KurrentDB.TcpPlugin/tcp-plugin-example.json b/src/KurrentDB.TcpPlugin/tcp-plugin-example.json
index 096b97c7e78..927c311e992 100644
--- a/src/KurrentDB.TcpPlugin/tcp-plugin-example.json
+++ b/src/KurrentDB.TcpPlugin/tcp-plugin-example.json
@@ -2,6 +2,7 @@
   "KurrentDB": {
     "TcpPlugin": {
       "EnableExternalTcp": true,
+      "DisableExternalTcpTls": false,
       "NodeTcpPort": 1113,
       "NodeTcpPortAdvertiseAs": 1113,
       "NodeHeartbeatInterval": 2000,
diff --git a/src/KurrentDB.TcpPlugin/tcp-plugin-example.yaml b/src/KurrentDB.TcpPlugin/tcp-plugin-example.yaml
index 1d301be8e78..e55a8e5c6bf 100644
--- a/src/KurrentDB.TcpPlugin/tcp-plugin-example.yaml
+++ b/src/KurrentDB.TcpPlugin/tcp-plugin-example.yaml
@@ -1,5 +1,6 @@
 TcpPlugin:
   EnableExternalTcp: true
+  DisableExternalTcpTls: false
   NodeTcpPort: 1113
   NodeTcpPortAdvertiseAs: 1113
   NodeHeartbeatInterval: 2000