diff --git a/base-infrastructure/terraform/.terraform.lock.hcl b/base-infrastructure/terraform/.terraform.lock.hcl
index 63bd469a..7231e82d 100644
--- a/base-infrastructure/terraform/.terraform.lock.hcl
+++ b/base-infrastructure/terraform/.terraform.lock.hcl
@@ -62,27 +62,6 @@ provider "registry.terraform.io/hashicorp/http" {
   ]
 }
 
-provider "registry.terraform.io/hashicorp/kubernetes" {
-  version     = "2.24.0"
-  constraints = "2.24.0"
-  hashes = [
-    "h1:8Ov9r+eCpuqY9LNjG3I8vKT0hX/FkyzuDxQySZVt9i4=",
-    "h1:u9lRMCdNXcB5/WQTZVMvGhNliW2pKOzj3SOVbu9yPpg=",
-    "zh:0ed83ec390a7e75c4990ebce698f14234de2b6204ed9a01cd042bb7ea5f26564",
-    "zh:195150e4fdab259c70088528006f4604557a051e037ebe8de64e92840f27e40a",
-    "zh:1a334af55f7a74adf033eb871c9fe7e9e648b41ab84321114ef4ca0e7a34fba6",
-    "zh:1ef68c3832691de21a61bf1a4e268123f3e08850712eda0b893cac908a0d1bc1",
-    "zh:44a1c58e5a6646e62b0bad653319c245f3b635dd03554dea2707a38f553e4a52",
-    "zh:54b5b374c4386f7f05b3fe986f9cb57bde4beab3bdf6ee33444f2b9a81b8af64",
-    "zh:aa8c2687ab784b72f8cdad8d3c3673dea83b33561e7b3f2d287ef0d06ff2a9e5",
-    "zh:e6ecba0503052ef3ad49ad56e17b2a73d9b55e30fcb82b040189d281e25e1a3b",
-    "zh:f105393f6487d3eb1f1636ba42d10c82950ddfef852244c1bca8d526fa23a9a3",
-    "zh:f17a8f1914ec66d80ccacecd40123362cf093abee3d3aa1ff9f8f687d8736f85",
-    "zh:f394b12ef01fa0bdf666a43ad152eb3890134f35e635ea056b18771c292de46e",
-    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-  ]
-}
-
 provider "registry.terraform.io/hashicorp/random" {
   version     = "3.5.1"
   constraints = "~> 3.5.1"
diff --git a/base-infrastructure/terraform/imports.tf b/base-infrastructure/terraform/imports.tf
index 07079a3f..e69de29b 100644
--- a/base-infrastructure/terraform/imports.tf
+++ b/base-infrastructure/terraform/imports.tf
@@ -1,28 +0,0 @@
-# One-off adoption of resources that predate this configuration.
-#
-# The go-api workload identity was created outside Terraform for the legacy
-# `go-api-<environment>-workload-sa` federation, under the same name
-# module.go_api_resources derives from app_name and environment, so the first
-# apply of that module fails with "resource already exists".
-#
-# The identity holds no role assignments, and the federated credential the legacy
-# deployment uses stays unmanaged: the module adds a second credential rather than
-# replacing it, so both service accounts keep working during the parallel run.
-#
-# NOTE: Terraform owns the identity once this is imported, so destroying
-# module.go_api_resources also removes the legacy credential along with its parent.
-#
-# TODO: Clear this file once staging and production have both been applied.
-
-locals {
-  # Every environment in this configuration lives in the same subscription.
-  subscription_id = "39308fb0-9929-4b29-aafa-b3c78a8b0658"
-
-  # Mirrors azurerm_user_assigned_identity.workload in ./app_resources/iam.tf
-  go_api_workload_identity_name = "${replace(title("go-api"), "-", "")}${title(var.environment)}WorkloadIdentity"
-}
-
-import {
-  to = module.go_api_resources.azurerm_user_assigned_identity.workload
-  id = "/subscriptions/${local.subscription_id}/resourceGroups/${module.resources.resource_group}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/${local.go_api_workload_identity_name}"
-}
diff --git a/base-infrastructure/terraform/resources/.terraform.lock.hcl b/base-infrastructure/terraform/resources/.terraform.lock.hcl
index f5131290..7231e82d 100644
--- a/base-infrastructure/terraform/resources/.terraform.lock.hcl
+++ b/base-infrastructure/terraform/resources/.terraform.lock.hcl
@@ -62,26 +62,6 @@ provider "registry.terraform.io/hashicorp/http" {
   ]
 }
 
-provider "registry.terraform.io/hashicorp/kubernetes" {
-  version     = "2.24.0"
-  constraints = "2.24.0"
-  hashes = [
-    "h1:u9lRMCdNXcB5/WQTZVMvGhNliW2pKOzj3SOVbu9yPpg=",
-    "zh:0ed83ec390a7e75c4990ebce698f14234de2b6204ed9a01cd042bb7ea5f26564",
-    "zh:195150e4fdab259c70088528006f4604557a051e037ebe8de64e92840f27e40a",
-    "zh:1a334af55f7a74adf033eb871c9fe7e9e648b41ab84321114ef4ca0e7a34fba6",
-    "zh:1ef68c3832691de21a61bf1a4e268123f3e08850712eda0b893cac908a0d1bc1",
-    "zh:44a1c58e5a6646e62b0bad653319c245f3b635dd03554dea2707a38f553e4a52",
-    "zh:54b5b374c4386f7f05b3fe986f9cb57bde4beab3bdf6ee33444f2b9a81b8af64",
-    "zh:aa8c2687ab784b72f8cdad8d3c3673dea83b33561e7b3f2d287ef0d06ff2a9e5",
-    "zh:e6ecba0503052ef3ad49ad56e17b2a73d9b55e30fcb82b040189d281e25e1a3b",
-    "zh:f105393f6487d3eb1f1636ba42d10c82950ddfef852244c1bca8d526fa23a9a3",
-    "zh:f17a8f1914ec66d80ccacecd40123362cf093abee3d3aa1ff9f8f687d8736f85",
-    "zh:f394b12ef01fa0bdf666a43ad152eb3890134f35e635ea056b18771c292de46e",
-    "zh:f569b65999264a9416862bca5cd2a6177d94ccb0424f3a4ef424428912b9cb3c",
-  ]
-}
-
 provider "registry.terraform.io/hashicorp/random" {
   version     = "3.5.1"
   constraints = "~> 3.5.1"
diff --git a/base-infrastructure/terraform/resources/aks.tf b/base-infrastructure/terraform/resources/aks.tf
index db487179..bad36c7a 100644
--- a/base-infrastructure/terraform/resources/aks.tf
+++ b/base-infrastructure/terraform/resources/aks.tf
@@ -58,14 +58,3 @@ resource "azurerm_role_assignment" "storage" {
   role_definition_name = "Storage Account Contributor"
   principal_id         = azurerm_kubernetes_cluster.ifrcgo.identity[0].principal_id
 }
-
-# Kubernetes provider. No resource in this configuration uses it, and it cannot be deleted
-# while an orphaned kubernetes_* resource is still in state. This block sits inside a child
-# module, so its provider address cannot be implied; destroying such an orphan without it
-# fails with "Provider configuration not present".
-provider "kubernetes" {
-  host                   = azurerm_kubernetes_cluster.ifrcgo.kube_config[0].host
-  client_certificate     = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_certificate)
-  client_key             = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].client_key)
-  cluster_ca_certificate = base64decode(azurerm_kubernetes_cluster.ifrcgo.kube_config[0].cluster_ca_certificate)
-}
diff --git a/base-infrastructure/terraform/resources/bastion.tf b/base-infrastructure/terraform/resources/bastion.tf
index 1c384dc5..0bc61bc2 100644
--- a/base-infrastructure/terraform/resources/bastion.tf
+++ b/base-infrastructure/terraform/resources/bastion.tf
@@ -5,11 +5,6 @@
 # applied via this helm_release (matching how the other cluster components — traefik,
 # argocd, cert-manager, etc. — are deployed).
 #
-# TODO: An older copy of this bastion is still shipped by the go-api Helm chart
-# (deploy/helm/ifrcgo-helm/templates/bastion.yaml) and runs in the `default` namespace.
-# Both run in parallel for now; users should migrate to the new IP exposed by this
-# resource. The go-api copy will be removed in the upcoming go-api updates.
-#
 # NOTE: after editing anything under charts/ssh-bastion, bump the chart `version` in
 # Chart.yaml so the helm provider detects the change and redeploys.
 
diff --git a/base-infrastructure/terraform/resources/helm-ifrcgo.tf b/base-infrastructure/terraform/resources/helm-ifrcgo.tf
deleted file mode 100644
index 97be89a2..00000000
--- a/base-infrastructure/terraform/resources/helm-ifrcgo.tf
+++ /dev/null
@@ -1,9 +0,0 @@
-# Drops the `ifrcgo-helm` release from Terraform's state without uninstalling it from the
-# cluster's `default` namespace.
-removed {
-  from = helm_release.ifrcgo
-
-  lifecycle {
-    destroy = false
-  }
-}
diff --git a/base-infrastructure/terraform/resources/providers.tf b/base-infrastructure/terraform/resources/providers.tf
index 1b1e68cb..2f5f903e 100644
--- a/base-infrastructure/terraform/resources/providers.tf
+++ b/base-infrastructure/terraform/resources/providers.tf
@@ -14,10 +14,6 @@ terraform {
       source  = "hashicorp/helm"
       version = "~> 2.17.0"
     }
-    kubernetes = {
-      source  = "hashicorp/kubernetes"
-      version = "=2.24.0"
-    }
     random = {
       source  = "hashicorp/random"
       version = "~> 3.5.1"