diff --git a/package.json b/package.json
index f331e20..e87be07 100644
--- a/package.json
+++ b/package.json
@@ -39,9 +39,6 @@
       },
       "ATTACHMENTS_KV": {
         "description": "Optional KV namespace fallback for attachment/send-file storage"
-      },
-      "WEBSITE_ICONS_ENABLED": {
-        "description": "Optional: set to true to proxy website icons via third-party icon services. Defaults to disabled for vault-domain privacy."
       }
     }
   },
diff --git a/src/router-public.ts b/src/router-public.ts
index 3688282..7b28aef 100644
--- a/src/router-public.ts
+++ b/src/router-public.ts
@@ -50,7 +50,7 @@ export interface WebBootstrapResponse {
 }
 
 function isWebsiteIconProxyEnabled(env: Env): boolean {
-  return ['1', 'true', 'yes', 'on'].includes(String(env.WEBSITE_ICONS_ENABLED || '').trim().toLowerCase());
+  return true;
 }
 
 function isSameOriginWriteRequest(request: Request): boolean {
diff --git a/src/types/index.ts b/src/types/index.ts
index 95a95f4..7865144 100644
--- a/src/types/index.ts
+++ b/src/types/index.ts
@@ -20,7 +20,6 @@ export interface Env {
   'globalSettings__yubico__clientId'?: string;
   'globalSettings__yubico__key'?: string;
   'globalSettings__yubico__validationUrls'?: string;
-  WEBSITE_ICONS_ENABLED?: string;
 }
 
 export type UserRole = 'admin' | 'user';
diff --git a/webapp/src/lib/app-auth.ts b/webapp/src/lib/app-auth.ts
index 1c325a5..65acbf3 100644
--- a/webapp/src/lib/app-auth.ts
+++ b/webapp/src/lib/app-auth.ts
@@ -236,7 +236,7 @@ function normalizeBootstrapResponse(boot: WebBootstrapResponse): Pick<InitialApp
   const defaultKdfIterations = Number(boot.defaultKdfIterations || 600000);
   const registrationInviteRequired =
     typeof boot.registrationInviteRequired === 'boolean' ? boot.registrationInviteRequired : undefined;
-  const websiteIconsEnabled = boot.websiteIconsEnabled === true;
+  const websiteIconsEnabled = boot.websiteIconsEnabled !== false;
   const jwtUnsafeReason = boot.jwtUnsafeReason || null;
   const jwtWarning = jwtUnsafeReason
     ? {
@@ -330,7 +330,7 @@ export async function bootstrapAppSession(initial: InitialAppBootstrapState = re
   const normalizedBoot = normalizeBootstrapResponse(remoteBoot);
   const defaultKdfIterations = normalizedBoot.defaultKdfIterations || initial.defaultKdfIterations;
   const registrationInviteRequired = normalizedBoot.registrationInviteRequired ?? initial.registrationInviteRequired;
-  const websiteIconsEnabled = normalizedBoot.websiteIconsEnabled;
+  const websiteIconsEnabled = normalizedBoot.websiteIconsEnabled !== false;
   setWebsiteIconsEnabled(websiteIconsEnabled);
   const jwtWarning = normalizedBoot.jwtWarning ?? initial.jwtWarning;
 
diff --git a/webapp/src/lib/demo.empty.ts b/webapp/src/lib/demo.empty.ts
index 7d761bf..6a47308 100644
--- a/webapp/src/lib/demo.empty.ts
+++ b/webapp/src/lib/demo.empty.ts
@@ -20,7 +20,7 @@ export function createDemoInitialBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations: 600000,
     registrationInviteRequired: true,
-    websiteIconsEnabled: false,
+    websiteIconsEnabled: true,
     jwtWarning: null,
     session: null,
     phase: 'login',
diff --git a/webapp/src/lib/demo.ts b/webapp/src/lib/demo.ts
index a891823..40d51ae 100644
--- a/webapp/src/lib/demo.ts
+++ b/webapp/src/lib/demo.ts
@@ -790,7 +790,7 @@ export function createDemoInitialBootstrapState(): InitialAppBootstrapState {
   return {
     defaultKdfIterations: 600000,
     registrationInviteRequired: true,
-    websiteIconsEnabled: false,
+    websiteIconsEnabled: true,
     jwtWarning: null,
     session: null,
     phase: 'login',
diff --git a/webapp/src/lib/website-icon-settings.ts b/webapp/src/lib/website-icon-settings.ts
index d865880..7017763 100644
--- a/webapp/src/lib/website-icon-settings.ts
+++ b/webapp/src/lib/website-icon-settings.ts
@@ -1,4 +1,4 @@
-let websiteIconsEnabled = false;
+let websiteIconsEnabled = true;
 
 export function setWebsiteIconsEnabled(enabled: boolean): void {
   websiteIconsEnabled = enabled;