diff --git a/testing/README.md b/testing/README.md
index 6933a43..bd1ba48 100644
--- a/testing/README.md
+++ b/testing/README.md
@@ -16,7 +16,6 @@ configurations.
 | ----------- | ----- | --------- | -------------------------------- |
 | mesh        | 5     | UDP       | Sparse mesh, 6 links, multi-hop  |
 | chain       | 5     | UDP       | Linear chain, max 4-hop paths    |
-| mesh-public | 5+1   | UDP       | Mesh with external public node   |
 | tcp-chain   | 3     | TCP       | Linear chain over TCP (port 8443) |
 | rekey       | 5     | UDP       | Rekey integration test topology  |
 
diff --git a/testing/static/README.md b/testing/static/README.md
index bde3f05..27980ed 100644
--- a/testing/static/README.md
+++ b/testing/static/README.md
@@ -119,15 +119,12 @@ testing/static/
 │   └── topologies/
 │       ├── mesh.yaml                   # Mesh topology definition
 │       ├── chain.yaml                  # Chain topology definition
-│       ├── mesh-public.yaml            # Mesh + external public node
 │       ├── tcp-chain.yaml             # TCP chain (3 nodes, port 8443)
 │       └── rekey.yaml                 # Rekey integration test (5 nodes)
 ├── generated-configs/                  # Auto-generated, run-scoped (gitignored)
 │   ├── npubs.env                       # NPUB_A=..., NPUB_B=..., etc.
 │   ├── mesh/
 │   │   ├── node-a.yaml ... node-e.yaml
-│   ├── mesh-public/
-│   │   ├── node-a.yaml ... node-e.yaml
 │   ├── chain/
 │   │   ├── node-a.yaml ... node-e.yaml
 │   └── tcp-chain/
@@ -219,7 +216,7 @@ each mesh needs unique node identities to avoid key conflicts. The optional
 
 # Or generate configs directly
 ./testing/static/scripts/generate-configs.sh mesh my-mesh-1
-./testing/static/scripts/generate-configs.sh mesh-public my-mesh-1
+./testing/static/scripts/generate-configs.sh chain my-mesh-1
 ```
 
 ### How It Works
diff --git a/testing/static/configs/topologies/mesh-public.yaml b/testing/static/configs/topologies/mesh-public.yaml
deleted file mode 100644
index 1630241..0000000
--- a/testing/static/configs/topologies/mesh-public.yaml
+++ /dev/null
@@ -1,51 +0,0 @@
-# Mesh Topology Definition
-# 
-# Five nodes with 6 bidirectional UDP links forming a sparse, fully connected
-# graph. Not all nodes are direct peers — non-adjacent pairs require
-# discovery-driven multi-hop routing to establish end-to-end sessions.
-
-nodes:
-  a:
-    nsec: "0102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20"
-    npub: "npub1sjlh2c3x9w7kjsqg2ay080n2lff2uvt325vpan33ke34rn8l5jcqawh57m"
-    docker_ip: "172.20.0.10"
-    peers: [d, e, pub]
-
-  b:
-    nsec: "b102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fb0"
-    npub: "npub1tdwa4vjrjl33pcjdpf2t4p027nl86xrx24g4d3avg4vwvayr3g8qhd84le"
-    docker_ip: "172.20.0.11"
-    peers: [c, pub]
-
-  c:
-    nsec: "c102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fc0"
-    npub: "npub1cld9yay0u24davpu6c35l4vldrhzvaq66pcqtg9a0j2cnjrn9rtsxx2pe6"
-    docker_ip: "172.20.0.12"
-    peers: [b, d, e, pub]
-
-  d:
-    nsec: "d102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fd0"
-    npub: "npub1n9lpnv0592cc2ps6nm0ca3qls642vx7yjsv35rkxqzj2vgds52sqgpverl"
-    docker_ip: "172.20.0.13"
-    peers: [a, c, e]
-
-  e:
-    nsec: "e102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1fe0"
-    npub: "npub1wf8akf8lu2zdkjkmwhl75pqvven654mpv4sz2x2tprl5265mgrzq8nhak4"
-    docker_ip: "172.20.0.14"
-    peers: [a, c, d]
-
-  # External/public node (not a Docker container)
-  pub:
-    npub: "npub1qmc3cvfz0yu2hx96nq3gp55zdan2qclealn7xshgr448d3nh6lks7zel98"
-    external_ip: "test-us01.fips.network"
-    peers: [a, b, c]
-
-# Spanning Tree Structure (rooted at node A):
-# - A — D (tree edge, D's parent is A)
-# - A — E (tree edge, E's parent is A)
-# - C — D (tree edge, C's parent is D)
-# - B — C (tree edge, B's parent is C)
-# - D — E (non-tree link)
-# - C — E (non-tree link)
-
diff --git a/testing/static/docker-compose.yml b/testing/static/docker-compose.yml
index 602c037..74b7912 100644
--- a/testing/static/docker-compose.yml
+++ b/testing/static/docker-compose.yml
@@ -98,62 +98,6 @@ services:
     networks:
       fips-net:
 
-  # ── Mesh-public topology (mesh + external public node) ────────
-  pub-a:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-a${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-a
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-a.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-b:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-b${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-b
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-b.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-c:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-c${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-c
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-c.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-d:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-d${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-d
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-d.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
-  pub-e:
-    <<: *fips-common
-    profiles: ["mesh-public"]
-    container_name: fips-node-e${FIPS_CI_NAME_SUFFIX:-}
-    hostname: node-e
-    volumes:
-      - ../docker/resolv.conf:/etc/resolv.conf:ro
-      - ./generated-configs${FIPS_CI_NAME_SUFFIX:-}/mesh-public/node-e.yaml:/etc/fips/fips.yaml:ro
-    networks:
-      fips-net:
-
   # ── Chain topology (A-B-C-D-E) ────────────────────────────────
   chain-a:
     <<: *fips-common
diff --git a/testing/static/scripts/bench-multirun.sh b/testing/static/scripts/bench-multirun.sh
index d2a138b..a96186a 100755
--- a/testing/static/scripts/bench-multirun.sh
+++ b/testing/static/scripts/bench-multirun.sh
@@ -137,7 +137,7 @@ ping_path() {
 # steady state, which is what real-world FIPS deployments see. To
 # force on-wire multihop, isolate nodes on distinct docker networks.
 case "$PROFILE" in
-    mesh|mesh-public)
+    mesh)
         # Static-peer paths only — without mDNS / a Nostr relay in the
         # test container set, non-adjacent pairs (A↔B, A↔C) can't
         # establish direct UDP and the bench would either fail
diff --git a/testing/static/scripts/generate-configs.sh b/testing/static/scripts/generate-configs.sh
index 529ec12..696a432 100755
--- a/testing/static/scripts/generate-configs.sh
+++ b/testing/static/scripts/generate-configs.sh
@@ -2,7 +2,7 @@
 # Generate FIPS node configuration files from template and topology definition.
 #
 # Usage: ./generate-configs.sh <topology> [mesh-name]
-#   topology:  mesh, mesh-public, chain, etc.
+#   topology:  mesh, chain, etc.
 #   mesh-name: optional; when given, docker node identities are derived
 #              deterministically via sha256(mesh-name|node-id)
 
diff --git a/testing/static/scripts/iperf-test.sh b/testing/static/scripts/iperf-test.sh
index 124803e..9cf30ad 100755
--- a/testing/static/scripts/iperf-test.sh
+++ b/testing/static/scripts/iperf-test.sh
@@ -89,7 +89,7 @@ echo ""
 # nodes — labels DO NOT encode hop count, since peer discovery
 # converges every same-subnet pair onto a direct UDP path within a
 # few ticks regardless of the static `peers:` list.
-if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+if [ "$PROFILE" = "mesh" ]; then
     echo "Topology (static \`peers:\` from mesh.yaml):"
     echo "  A peers with: D, E"
     echo "  B peers with: C"
@@ -109,7 +109,7 @@ echo ""
 echo "Waiting ${SETTLE_SECONDS}s for mesh convergence..."
 sleep "$SETTLE_SECONDS"
 
-if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+if [ "$PROFILE" = "mesh" ]; then
     echo ""
     echo "Testing mesh topology paths:"
     iperf_test node-d node-a "$NPUB_D" "A→D"
diff --git a/testing/static/scripts/ping-test.sh b/testing/static/scripts/ping-test.sh
index fb6069c..2c2e383 100755
--- a/testing/static/scripts/ping-test.sh
+++ b/testing/static/scripts/ping-test.sh
@@ -93,7 +93,7 @@ if [ "$PROFILE" = "chain" ]; then
     wait_for_peers fips-node-c${FIPS_CI_NAME_SUFFIX:-} 2 20 || true
     wait_for_peers fips-node-d${FIPS_CI_NAME_SUFFIX:-} 2 20 || true
     wait_for_peers fips-node-e${FIPS_CI_NAME_SUFFIX:-} 1 20 || true
-elif [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+elif [ "$PROFILE" = "mesh" ]; then
     # Mesh: check all nodes reach their configured peer counts
     wait_for_peers fips-node-a${FIPS_CI_NAME_SUFFIX:-} 2 20 || true
     wait_for_peers fips-node-b${FIPS_CI_NAME_SUFFIX:-} 1 20 || true
@@ -105,7 +105,7 @@ else
     # section below is guarded by these same profile names, so the script
     # ran no assertion at all and exited 0. A typo in the caller's profile
     # argument produced a green run that tested nothing.
-    echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh, mesh-public)" >&2
+    echo "ERROR: unknown profile '$PROFILE' (expected: chain, mesh)" >&2
     exit 2
 fi
 # Wait for full pairwise connectivity, progress-aware: the actual pings
@@ -119,7 +119,7 @@ wait_until_connected ping_all_quiet 45 15 || true
 PASSED=0
 FAILED=0
 
-if [ "$PROFILE" = "mesh" ] || [ "$PROFILE" = "mesh-public" ]; then
+if [ "$PROFILE" = "mesh" ]; then
     # Sparse mesh topology: A-B, B-C, C-D, D-E, E-A, A-D
     # Test all 20 directed pairs (5 nodes × 4 targets each)
     echo ""