diff --git a/protect/control/v1/control.proto b/protect/control/v1/control.proto
index 56ed58b..783dcae 100644
--- a/protect/control/v1/control.proto
+++ b/protect/control/v1/control.proto
@@ -36,7 +36,6 @@ service ControlService {
   rpc GetZone(GetZoneRequest) returns (GetZoneReply);
   rpc ListZones(ListZonesRequest) returns (stream ListZonesReply);
   rpc DiscoverServices(DiscoverServicesRequest) returns (stream DiscoverServicesReply);
-  rpc GetSpireBundle(SpireBundleRequest) returns (SpireBundleReply);
 
   rpc GetZonesVcpuInfos(GetZonesVcpuInfosRequest) returns (stream GetZonesVcpuInfosReply);
   rpc SetZoneVcpuAffinity(SetZoneVcpuAffinityRequest) returns (SetZoneVcpuAffinityReply);
@@ -74,8 +73,6 @@ service ControlService {
   rpc DialObjectCapability(stream DialObjectCapabilityRequest) returns (stream DialObjectCapabilityReply);
 
   rpc ListObjectCapabilities(ListObjectCapabilitiesRequest) returns (stream ListObjectCapabilitiesReply);
-
-  rpc SpireMetadata(SpireMetadataRequest) returns (SpireMetadataReply);
 }
 
 // Requests info about the current Edera daemon/host on this machine.
@@ -250,18 +247,6 @@ message ZoneKernelEventStreamUpdate {
 // Stops the current syscall event stream subscription.
 message ZoneKernelEventStreamStop {}
 
-message SpireMetadataRequest {
-  string zone_id = 1;
-}
-
-message SpireMetadataReply {
-  string identifier = 1;
-  // The zone the identifier was resolved for. When the request omits zoneID,
-  // the daemon fills it from the authenticated in-zone control channel and
-  // echoes it here so the caller learns its own zone without a side channel.
-  string zone_id = 2;
-}
-
 // roughly maps to libscap's `scap_threadinfo` type.
 // See https://github.com/falcosecurity/libs/blob/af6e6f276bf3a847159b3cdfdbcc9efda9a620b9/userspace/libscap/scap.h#L244
 message ZoneKernelThreadInfo {
@@ -476,12 +461,6 @@ message DiscoverServicesReply {
   repeated ServiceEntry service_entry = 1;
 }
 
-message SpireBundleRequest {}
-
-message SpireBundleReply {
-  string bundle = 1;
-}
-
 // Client stream message for `ExecuteZoneCommand`. The first message sent must be an
 // `ExecuteZoneCommandStart`; subsequent messages carry stdin data or terminal resizes.
 message ExecuteZoneCommandRequest {