diff --git a/dev/feature_flags.json b/dev/feature_flags.json
index 3027207..8fc10d1 100644
--- a/dev/feature_flags.json
+++ b/dev/feature_flags.json
@@ -1,19 +1,19 @@
 {
   "flags": {
     "bus-auth": {
-      "enabled": false,
-      "state": "off",
+      "enabled": true,
+      "state": "enforce",
       "issue": "0001",
-      "description": "Signed control-plane auth + NATS nkey auth. Rollout: off -> soft (verify+log, allow) -> enforce (reject). 'enabled' mirrors state!=off.",
+      "description": "Signed control-plane auth + NATS nkey auth. Rollout: off -> soft (verify+log, allow) -> enforce (reject). 'enabled' mirrors state!=off. Server opts in via membershipd --bus-auth; clients via client.Connect(caPath).",
       "added": "2026-06-07",
-      "enabled_at": null
+      "enabled_at": "2026-06-07"
     },
     "bus-tls": {
-      "enabled": false,
+      "enabled": true,
       "issue": "0001",
-      "description": "TLS on the NATS data plane using the project's self-signed CA (deploy/tls/). When enabled the server presents its cert and clients pin the CA.",
+      "description": "TLS on the NATS data plane using the project's self-signed CA (deploy/tls/). Server opts in via membershipd --tls-cert/--tls-key; clients pin ca.crt via client.Connect(caPath).",
       "added": "2026-06-07",
-      "enabled_at": null
+      "enabled_at": "2026-06-07"
     }
   }
 }