diff --git a/Annex/Url.hs b/Annex/Url.hs
index 9a9eff24a5..303e98e798 100644
--- a/Annex/Url.hs
+++ b/Annex/Url.hs
@@ -6,8 +6,6 @@
  - Licensed under the GNU AGPL version 3 or higher.
  -}
 
-{-# LANGUAGE CPP #-}
-
 module Annex.Url (
 	withUrlOptions,
 	withUrlOptionsPromptingCreds,
@@ -36,11 +34,7 @@ import qualified Annex
 import qualified Utility.Url as U
 import Utility.Hash (IncrementalVerifier)
 import Utility.IPAddress
-#ifdef WITH_HTTP_CLIENT_RESTRICTED
 import Network.HTTP.Client.Restricted
-#else
-import Utility.HttpManagerRestricted
-#endif
 import Utility.Metered
 import Git.Credential
 import qualified BuildInfo
diff --git a/CHANGELOG b/CHANGELOG
index cf4ac0303b..8bc5aae986 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -35,6 +35,8 @@ git-annex (10.20220223) UNRELEASED; urgency=medium
     standalone linux tarball or OSX app.
   * test: Runs tests in parallel to speed up the test suite.
   * test: Added --jobs option.
+  * Removed vendored copy of http-client-restricted, and removed the
+    HttpClientRestricted build flag that avoided that dependency.
 
  -- Joey Hess <id@joeyh.name>  Wed, 23 Feb 2022 14:14:09 -0400
 
diff --git a/Utility/Url.hs b/Utility/Url.hs
index 54608d505c..88a8e6a713 100644
--- a/Utility/Url.hs
+++ b/Utility/Url.hs
@@ -9,7 +9,6 @@
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE FlexibleContexts #-}
 {-# LANGUAGE BangPatterns #-}
-{-# LANGUAGE CPP #-}
 
 module Utility.Url (
 	newManager,
@@ -46,11 +45,7 @@ module Utility.Url (
 import Common
 import Utility.Debug
 import Utility.Metered
-#ifdef WITH_HTTP_CLIENT_RESTRICTED
 import Network.HTTP.Client.Restricted
-#else
-import Utility.HttpManagerRestricted
-#endif
 import Utility.IPAddress
 import qualified Utility.RawFilePath as R
 import Utility.Hash (IncrementalVerifier(..))
diff --git a/debian/control b/debian/control
index 34c0f16e4a..762052186a 100644
--- a/debian/control
+++ b/debian/control
@@ -56,6 +56,7 @@ Build-Depends:
 	libghc-case-insensitive-dev,
 	libghc-http-types-dev,
 	libghc-http-conduit-dev,
+	libghc-http-client-restricted-dev,
 	libghc-blaze-builder-dev,
 	libghc-crypto-api-dev,
 	libghc-network-multicast-dev,
diff --git a/git-annex.cabal b/git-annex.cabal
index 0a015d4415..9d32ee349b 100644
--- a/git-annex.cabal
+++ b/git-annex.cabal
@@ -292,10 +292,6 @@ Flag GitLfs
   Description: Build with git-lfs library (rather than vendored copy)
   Default: True
 
-Flag HttpClientRestricted
-  Description: Build with http-client-restricted library (rather than vendored copy)
-  Default: True
-
 source-repository head
   type: git
   location: git://git-annex.branchable.com/
@@ -348,6 +344,7 @@ Executable git-annex
    http-client-tls,
    http-types (>= 0.7),
    http-conduit (>= 2.3.0),
+   http-client-restricted (>= 0.0.2),
    conduit,
    time (>= 1.5.0),
    old-locale,
@@ -425,12 +422,6 @@ Executable git-annex
   else
     Other-Modules: Utility.GitLFS
   
-  if flag(HttpClientRestricted)
-    Build-Depends: http-client-restricted (>= 0.0.2)
-    CPP-Options: -DWITH_HTTP_CLIENT_RESTRICTED
-  else
-    Other-Modules: Utility.HttpManagerRestricted
-
   if flag(Assistant) && ! os(solaris) && ! os(gnu)
     Build-Depends: mountpoints
     CPP-Options: -DWITH_ASSISTANT
diff --git a/stack.yaml b/stack.yaml
index 8dac87c153..a37078e5ec 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -11,7 +11,6 @@ flags:
     benchmark: true
     networkbsd: true
     gitlfs: true
-    httpclientrestricted: true
 packages:
 - '.'
 resolver: lts-18.13
diff --git a/standalone/linux/stack-i386ancient.yaml b/standalone/linux/stack-i386ancient.yaml
index fe713a81f7..e8f2acecb8 100644
--- a/standalone/linux/stack-i386ancient.yaml
+++ b/standalone/linux/stack-i386ancient.yaml
@@ -11,7 +11,6 @@ flags:
     benchmark: false
     networkbsd: true
     gitlfs: true
-    httpclientrestricted: true
 packages:
 - '.'
 extra-deps: