diff --git a/crates/navigator-cli/src/completers.rs b/crates/navigator-cli/src/completers.rs
index 5aa76d048..bff0f5218 100644
--- a/crates/navigator-cli/src/completers.rs
+++ b/crates/navigator-cli/src/completers.rs
@@ -176,7 +176,6 @@ mod tests {
                     gateway_endpoint: "https://alpha.example.com".to_string(),
                     is_remote: true,
                     gateway_port: 0,
-                    kube_port: None,
                     remote_host: None,
                     resolved_host: None,
                     auth_mode: Some("cloudflare_jwt".to_string()),
diff --git a/crates/navigator-cli/src/main.rs b/crates/navigator-cli/src/main.rs
index d7647929c..a1b88ef41 100644
--- a/crates/navigator-cli/src/main.rs
+++ b/crates/navigator-cli/src/main.rs
@@ -851,26 +851,6 @@ enum GatewayCommands {
         #[arg(long, env = "OPENSHELL_GATEWAY", add = ArgValueCompleter::new(completers::complete_gateway_names))]
         name: Option<String>,
     },
-
-    /// Print or start an SSH tunnel for kubectl access to a remote gateway.
-    #[command(help_template = LEAF_HELP_TEMPLATE, next_help_heading = "FLAGS")]
-    Tunnel {
-        /// Gateway name (defaults to active gateway).
-        #[arg(long, env = "OPENSHELL_GATEWAY", add = ArgValueCompleter::new(completers::complete_gateway_names))]
-        name: Option<String>,
-
-        /// Override SSH destination (auto-resolved from gateway metadata).
-        #[arg(long)]
-        remote: Option<String>,
-
-        /// Path to SSH private key.
-        #[arg(long, value_hint = ValueHint::FilePath)]
-        ssh_key: Option<String>,
-
-        /// Only print the SSH command instead of running it.
-        #[arg(long)]
-        print_command: bool,
-    },
 }
 
 // -----------------------------------------------------------------------
@@ -1405,7 +1385,9 @@ async fn main() -> Result<()> {
         // -----------------------------------------------------------
         // Doctor (diagnostic) commands
         // -----------------------------------------------------------
-        Some(Commands::Doctor { command: Some(command) }) => match command {
+        Some(Commands::Doctor {
+            command: Some(command),
+        }) => match command {
             DoctorCommands::Logs {
                 name,
                 lines,
diff --git a/crates/navigator-cli/src/run.rs b/crates/navigator-cli/src/run.rs
index a9a57ae2a..5e003e16a 100644
--- a/crates/navigator-cli/src/run.rs
+++ b/crates/navigator-cli/src/run.rs
@@ -1184,14 +1184,6 @@ pub async fn gateway_admin_deploy(
         .with_disable_tls(disable_tls)
         .with_disable_gateway_auth(disable_gateway_auth)
         .with_gpu(gpu);
-    if let Some(kp) = kube_port {
-        let resolved_kp = if kp == 0 {
-            navigator_bootstrap::pick_available_port()?
-        } else {
-            kp
-        };
-        options = options.with_kube_port(resolved_kp);
-    }
     if let Some(dest) = remote {
         let mut remote_opts = RemoteOptions::new(dest);
         if let Some(key) = ssh_key {
@@ -4042,7 +4034,6 @@ mod tests {
                 gateway_endpoint: "http://127.0.0.1:8080".to_string(),
                 is_remote: false,
                 gateway_port: 8080,
-                kube_port: None,
                 remote_host: None,
                 resolved_host: None,
                 auth_mode: None,