diff --git a/cipher_suites.go b/cipher_suites.go
index 687acc4..9cffca0 100644
--- a/cipher_suites.go
+++ b/cipher_suites.go
@@ -350,13 +350,9 @@ var disabledCipherSuites = map[uint16]bool{
 	TLS_RSA_WITH_AES_256_CBC_SHA:    true,
 	TLS_RSA_WITH_AES_128_GCM_SHA256: true,
 	TLS_RSA_WITH_AES_256_GCM_SHA384: true,
-}
 
-// tdesCiphers contains 3DES ciphers,
-// which we also disable by default unless a GODEBUG is set.
-var tdesCiphers = map[uint16]bool{
+	// 3DES
 	TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: true,
-	TLS_RSA_WITH_3DES_EDE_CBC_SHA:       true,
 }
 
 var (
diff --git a/common.go b/common.go
index 0c594db..de26472 100644
--- a/common.go
+++ b/common.go
@@ -748,9 +748,7 @@ type Config struct {
 	// the list is ignored. Note that TLS 1.3 ciphersuites are not configurable.
 	//
 	// If CipherSuites is nil, a safe default list is used. The default cipher
-	// suites might change over time. In Go 1.23 3DES cipher suites were removed
-	// from the default list, but can be re-added with the GODEBUG setting
-	// tls3des=1.
+	// suites might change over time.
 	CipherSuites []uint16
 
 	// PreferServerCipherSuites is a legacy field and has no effect.
diff --git a/defaults.go b/defaults.go
index 5fb65f8..0829e75 100644
--- a/defaults.go
+++ b/defaults.go
@@ -66,8 +66,6 @@ func defaultSupportedSignatureAlgorithms() []SignatureScheme {
 	}
 }
 
-//var tls3des = godebug.New("tls3des")
-
 func supportedCipherSuites(aesGCMPreferred bool) []uint16 {
 	if aesGCMPreferred {
 		return slices.Clone(cipherSuitesPreferenceOrder)
@@ -79,8 +77,7 @@ func supportedCipherSuites(aesGCMPreferred bool) []uint16 {
 func defaultCipherSuites(aesGCMPreferred bool) []uint16 {
 	cipherSuites := supportedCipherSuites(aesGCMPreferred)
 	return slices.DeleteFunc(cipherSuites, func(c uint16) bool {
-		return disabledCipherSuites[c] ||
-			tdesCiphers[c]
+		return disabledCipherSuites[c]
 	})
 }