diff --git a/changes/turn-off-prom-in-dev-mode b/changes/turn-off-prom-in-dev-mode
new file mode 100644
index 0000000000..53bfe05202
--- /dev/null
+++ b/changes/turn-off-prom-in-dev-mode
@@ -0,0 +1 @@
+* No longer turn on Prometheus serving by default with a hard-coded username and password when the server is started with `--dev`.
diff --git a/cmd/fleet/main.go b/cmd/fleet/main.go
index e4dc313eeb..ab3287146c 100644
--- a/cmd/fleet/main.go
+++ b/cmd/fleet/main.go
@@ -108,9 +108,6 @@ func applyDevFlags(cfg *config.FleetConfig) {
 	// that match our default dev setup.
 	setIfEmpty(&cfg.Mysql.Password, "insecure")
 
-	setIfEmpty(&cfg.Prometheus.BasicAuth.Username, "fleet")
-	setIfEmpty(&cfg.Prometheus.BasicAuth.Password, "insecure")
-
 	setIfEmpty(&cfg.S3.CarvesBucket, "carves-dev")
 	setIfEmpty(&cfg.S3.CarvesRegion, "localhost")
 	setIfEmpty(&cfg.S3.CarvesPrefix, "dev-prefix")