diff --git a/manifests/profile/prometheus.pp b/manifests/profile/prometheus.pp
index 9f337279e..6974188e0 100644
--- a/manifests/profile/prometheus.pp
+++ b/manifests/profile/prometheus.pp
@@ -180,19 +180,6 @@
     }
   }
 
-  # Delete this once nothing is importing it. It's only here for the
-  # sake of hosts that aren't in production.
-  # Referenced in branches: fulcrum_demo, tdx_7298538
-  # ** intentionally retains puppetlabs/firewall v6.0.0 semantics **
-  @@firewall { "010 prometheus legacy node exporter ${::hostname}":
-    tag    => "${::datacenter}_prometheus_node_exporter",
-    proto  => 'tcp',
-    dport  => 9100,
-    source => $::ipaddress,
-    state  => 'NEW',
-    jump   => 'accept',
-  }
-
   case $facts["mlibrary_ip_addresses"] {
     Hash[String, Array[String]]: {
       $all_public_addresses = $facts["mlibrary_ip_addresses"]["public"]
diff --git a/spec/classes/profile/prometheus_spec.rb b/spec/classes/profile/prometheus_spec.rb
index e77da9f62..ddcc9ced1 100644
--- a/spec/classes/profile/prometheus_spec.rb
+++ b/spec/classes/profile/prometheus_spec.rb
@@ -193,14 +193,8 @@
         end
       end
 
-      it 'exports a firewall so that nodes can open 9100' do
-        expect(exported_resources).to contain_firewall("010 prometheus legacy node exporter #{facts[:hostname]}")
-          .with_tag('mydatacenter_prometheus_node_exporter')
-          .with_proto('tcp')
-          .with_dport(9100)
-          .with_source(facts[:ipaddress])
-          .with_state('NEW')
-          .with_action('accept')
+      it 'does not export legacy port 9100 firewall resource' do
+        expect(exported_resources).not_to contain_firewall("010 prometheus legacy node exporter #{facts[:hostname]}")
       end
 
       context 'with no mlibrary_ip_addresses fact' do