diff --git a/protect/control/v1/common.proto b/protect/control/v1/common.proto
index 0a409ab..e81a227 100644
--- a/protect/control/v1/common.proto
+++ b/protect/control/v1/common.proto
@@ -36,26 +36,13 @@ message ZoneSpec {
   // When set, this zone is a fork of the named parent zone; the reconciler
   // forks the child from the parent rather than building it from scratch.
   string fork_parent_zone_id = 12;
-  // Configures Control API access for the zone.
-  ZoneControlApiSpec control_api = 13;
   // Boots the zone from a disk image via UEFI firmware instead of the
   // container path. KVM-only; mutually exclusive with `kernel`, `initrd`,
   // `addons`, `scratch_disk` (rejected by the daemon).
   ZoneVmImageSpec vm_image = 14;
-}
-
-// Access control specification on the Control API for a zone.
-enum ZoneControlApiAccess {
-  // Deny access to the Control API for this zone.
-  ZONE_CONTROL_API_ACCESS_DENY = 0;
-  // Allow access to the Control API for this zone.
-  ZONE_CONTROL_API_ACCESS_ALLOW = 1;
-}
 
-// Configures the Control API for a zone.
-message ZoneControlApiSpec {
-  // Controls access to the Control API.
-  ZoneControlApiAccess access = 1;
+  reserved 13;
+  reserved "control_api";
 }
 
 enum ZoneResourceAdjustmentPolicy {