diff --git a/cipher_suites.go b/cipher_suites.go
index bc508fe..687acc4 100644
--- a/cipher_suites.go
+++ b/cipher_suites.go
@@ -343,16 +343,11 @@ var disabledCipherSuites = map[uint16]bool{
 	TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: true,
 	TLS_ECDHE_RSA_WITH_RC4_128_SHA:   true,
 	TLS_RSA_WITH_RC4_128_SHA:         true,
-}
 
-// rsaKexCiphers contains the ciphers which use RSA based key exchange,
-// which we also disable by default unless a GODEBUG is set.
-var rsaKexCiphers = map[uint16]bool{
-	TLS_RSA_WITH_RC4_128_SHA:        true,
+	// RSA key exchange
 	TLS_RSA_WITH_3DES_EDE_CBC_SHA:   true,
 	TLS_RSA_WITH_AES_128_CBC_SHA:    true,
 	TLS_RSA_WITH_AES_256_CBC_SHA:    true,
-	TLS_RSA_WITH_AES_128_CBC_SHA256: true,
 	TLS_RSA_WITH_AES_128_GCM_SHA256: true,
 	TLS_RSA_WITH_AES_256_GCM_SHA384: true,
 }
diff --git a/common.go b/common.go
index 4b8aba8..0c594db 100644
--- a/common.go
+++ b/common.go
@@ -748,9 +748,7 @@ type Config struct {
 	// the list is ignored. Note that TLS 1.3 ciphersuites are not configurable.
 	//
 	// If CipherSuites is nil, a safe default list is used. The default cipher
-	// suites might change over time. In Go 1.22 RSA key exchange based cipher
-	// suites were removed from the default list, but can be re-added with the
-	// GODEBUG setting tlsrsakex=1. In Go 1.23 3DES cipher suites were removed
+	// suites might change over time. In Go 1.23 3DES cipher suites were removed
 	// from the default list, but can be re-added with the GODEBUG setting
 	// tls3des=1.
 	CipherSuites []uint16
diff --git a/defaults.go b/defaults.go
index ee8f81b..5fb65f8 100644
--- a/defaults.go
+++ b/defaults.go
@@ -66,7 +66,6 @@ func defaultSupportedSignatureAlgorithms() []SignatureScheme {
 	}
 }
 
-//var tlsrsakex = godebug.New("tlsrsakex")
 //var tls3des = godebug.New("tls3des")
 
 func supportedCipherSuites(aesGCMPreferred bool) []uint16 {
@@ -81,7 +80,6 @@ func defaultCipherSuites(aesGCMPreferred bool) []uint16 {
 	cipherSuites := supportedCipherSuites(aesGCMPreferred)
 	return slices.DeleteFunc(cipherSuites, func(c uint16) bool {
 		return disabledCipherSuites[c] ||
-			rsaKexCiphers[c] ||
 			tdesCiphers[c]
 	})
 }