diff --git a/internal/bridge/bridge_test.go b/internal/bridge/bridge_test.go
index c224c567..9aaa6f2d 100644
--- a/internal/bridge/bridge_test.go
+++ b/internal/bridge/bridge_test.go
@@ -536,8 +536,8 @@ func withBridge(
 	mocks := bridge.NewMocks(t, v2_3_0, v2_3_0)
 	defer mocks.Close()
 
-	// Bridge will enable the proxy by default at startup.
-	mocks.ProxyCtl.EXPECT().AllowProxy()
+	// Bridge will disable the proxy by default at startup.
+	mocks.ProxyCtl.EXPECT().DisallowProxy()
 
 	// Get the path to the vault.
 	vaultDir, err := locator.ProvideSettingsPath()
diff --git a/internal/bridge/settings_test.go b/internal/bridge/settings_test.go
index b4c96f13..6da2cdb7 100644
--- a/internal/bridge/settings_test.go
+++ b/internal/bridge/settings_test.go
@@ -119,14 +119,14 @@ func TestBridge_Settings_Proxy(t *testing.T) {
 	withEnv(t, func(ctx context.Context, s *server.Server, netCtl *proton.NetCtl, locator bridge.Locator, storeKey []byte) {
 		withBridge(ctx, t, s.GetHostURL(), netCtl, locator, storeKey, func(bridge *bridge.Bridge, mocks *bridge.Mocks) {
 			// By default, proxy is allowed.
-			require.True(t, bridge.GetProxyAllowed())
+			require.False(t, bridge.GetProxyAllowed())
 
 			// Disallow proxy.
-			mocks.ProxyCtl.EXPECT().DisallowProxy()
-			require.NoError(t, bridge.SetProxyAllowed(false))
+			mocks.ProxyCtl.EXPECT().AllowProxy()
+			require.NoError(t, bridge.SetProxyAllowed(true))
 
 			// Get the new setting.
-			require.False(t, bridge.GetProxyAllowed())
+			require.True(t, bridge.GetProxyAllowed())
 		})
 	})
 }
diff --git a/internal/vault/settings_test.go b/internal/vault/settings_test.go
index 0de5675d..f75b64d8 100644
--- a/internal/vault/settings_test.go
+++ b/internal/vault/settings_test.go
@@ -124,13 +124,13 @@ func TestVault_Settings_ProxyAllowed(t *testing.T) {
 	s := newVault(t)
 
 	// Check the default proxy allowed setting.
-	require.Equal(t, true, s.GetProxyAllowed())
+	require.Equal(t, false, s.GetProxyAllowed())
 
 	// Modify the proxy allowed setting.
-	require.NoError(t, s.SetProxyAllowed(false))
+	require.NoError(t, s.SetProxyAllowed(true))
 
 	// Check the new proxy allowed setting.
-	require.Equal(t, false, s.GetProxyAllowed())
+	require.Equal(t, true, s.GetProxyAllowed())
 }
 
 func TestVault_Settings_ShowAllMail(t *testing.T) {
diff --git a/internal/vault/types_settings.go b/internal/vault/types_settings.go
index ffe7bb62..907315b1 100644
--- a/internal/vault/types_settings.go
+++ b/internal/vault/types_settings.go
@@ -76,7 +76,7 @@ func newDefaultSettings(gluonDir string) Settings {
 		UpdateRollout: rand.Float64(), //nolint:gosec
 
 		ColorScheme:  "",
-		ProxyAllowed: true,
+		ProxyAllowed: false,
 		ShowAllMail:  true,
 		Autostart:    true,
 		AutoUpdate:   true,
diff --git a/tests/ctx_bridge_test.go b/tests/ctx_bridge_test.go
index 1f454d36..531ca864 100644
--- a/tests/ctx_bridge_test.go
+++ b/tests/ctx_bridge_test.go
@@ -90,8 +90,8 @@ func (t *testCtx) initBridge() (<-chan events.Event, error) {
 		return nil, fmt.Errorf("bridge is already started")
 	}
 
-	// Bridge will enable the proxy by default at startup.
-	t.mocks.ProxyCtl.EXPECT().AllowProxy()
+	// Bridge will disable the proxy by default at startup.
+	t.mocks.ProxyCtl.EXPECT().DisallowProxy()
 
 	// Get the path to the vault.
 	vaultDir, err := t.locator.ProvideSettingsPath()