diff --git a/rustls/src/client/client_conn.rs b/rustls/src/client/client_conn.rs
index 86937c9f193..a1dce97f9d8 100644
--- a/rustls/src/client/client_conn.rs
+++ b/rustls/src/client/client_conn.rs
@@ -510,7 +510,6 @@ pub enum Tls12Resumption {
 ///
 /// Note: differs from the protocol-encoded EchConfig (`EchConfigMsg`).
 #[derive(Clone, Debug)]
-#[allow(dead_code)] // TODO(@cpu): remove in subsequent commit.
 pub struct EchConfig {
     /// The provider to use for HPKE operations.
     pub(crate) hpke_provider: &'static dyn HpkeProvider,
@@ -557,7 +556,6 @@ impl EchConfig {
         })
     }
 
-    #[allow(dead_code)] // TODO(@cpu): remove in subsequent commit.
     pub(crate) fn hpke_info(&self) -> Vec<u8> {
         // "tls ech" || 0x00 || ECHConfig
         // https://datatracker.ietf.org/doc/html/draft-ietf-tls-esni-17#section-6.1
diff --git a/rustls/src/client/ech.rs b/rustls/src/client/ech.rs
index dec05ecf370..64e36cae875 100644
--- a/rustls/src/client/ech.rs
+++ b/rustls/src/client/ech.rs
@@ -1,4 +1,3 @@
-#![allow(dead_code)] // TODO(@cpu): remove in subsequent commit.
 use alloc::boxed::Box;
 use alloc::vec;
 use alloc::vec::Vec;
diff --git a/rustls/src/msgs/handshake.rs b/rustls/src/msgs/handshake.rs
index ea8b762a472..b21ea87e84d 100644
--- a/rustls/src/msgs/handshake.rs
+++ b/rustls/src/msgs/handshake.rs
@@ -1150,7 +1150,6 @@ impl HelloRetryRequest {
         }
     }
 
-    #[allow(dead_code)] // TODO(@cpu): remove in subsequent commits.
     pub(crate) fn ech_retry_request(&self) -> Option<&Vec<u8>> {
         let ext = self.find_extension(ExtensionType::EncryptedClientHello)?;
         match *ext {
@@ -1204,7 +1203,6 @@ pub(crate) enum Encoding {
     /// Standard RFC 8446 encoding.
     Standard,
     /// Encoding for ECH confirmation.
-    #[allow(dead_code)] // TODO(@cpu): Remove in subsequent commits.
     EchConfirmation,
 }
 
@@ -1896,7 +1894,6 @@ pub(crate) trait HasServerExtensions {
         }
     }
 
-    #[allow(dead_code)]
     fn server_ech_extension(&self) -> Option<ServerEncryptedClientHello> {
         let ext = self.find_extension(ExtensionType::EncryptedClientHello)?;
         match ext {
@@ -2599,7 +2596,6 @@ pub struct EchConfigContents {
     pub extensions: Vec<EchConfigExtension>,
 }
 
-#[allow(dead_code)] // TODO(@cpu): Remove in subsequent commits.
 impl EchConfigContents {
     /// Returns true if there is more than one extension of a given
     /// type.
diff --git a/rustls/src/tls13/key_schedule.rs b/rustls/src/tls13/key_schedule.rs
index 0109e4e36d7..8db085c3c4f 100644
--- a/rustls/src/tls13/key_schedule.rs
+++ b/rustls/src/tls13/key_schedule.rs
@@ -211,7 +211,6 @@ impl KeyScheduleHandshakeStart {
         new
     }
 
-    #[allow(dead_code)] // TODO(@cpu): remove in subsequent commit.
     pub(crate) fn server_ech_confirmation_secret(
         &mut self,
         client_hello_inner_random: &[u8],
@@ -805,7 +804,6 @@ fn hkdf_expand_label_slice(
     })
 }
 
-#[allow(dead_code)] // TODO(@cpu): remove in subsequent commit.
 pub(crate) fn server_ech_hrr_confirmation_secret(
     hkdf_provider: &'static dyn Hkdf,
     client_hello_inner_random: &[u8],