diff --git a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx
index 5c1a9bf5752d1..ebcf2b3248fd0 100644
--- a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx
+++ b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPage.tsx
@@ -14,6 +14,9 @@ const SecuritySettingsPage: FC = () => {
 
 			<SecuritySettingsPageView
 				options={deploymentConfig.options}
+				isBrowserOnlyEntitled={
+					entitlements.features.browser_only.entitlement !== "not_entitled"
+				}
 				featureBrowserOnlyEnabled={entitlements.features.browser_only.enabled}
 			/>
 		</>
diff --git a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx
index 654ba812359aa..1af6d1d14362f 100644
--- a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx
+++ b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.stories.tsx
@@ -49,6 +49,7 @@ const meta: Meta<typeof SecuritySettingsPageView> = {
 				hidden: false,
 			},
 		],
+		isBrowserOnlyEntitled: true,
 		featureBrowserOnlyEnabled: true,
 	},
 };
@@ -66,6 +67,50 @@ export const Page: Story = {
 			"href",
 			docs("/admin/networking#browser-only-connections"),
 		);
+		await expect(
+			canvas.getByRole("heading", {
+				name: /Browser-Only Connections Enabled/,
+			}),
+		).toBeInTheDocument();
+		await expect(
+			canvas.queryByRole("link", { name: /Start trial for free/ }),
+		).not.toBeInTheDocument();
+	},
+};
+
+export const EntitledAndTurnedOff: Story = {
+	args: {
+		isBrowserOnlyEntitled: true,
+		featureBrowserOnlyEnabled: false,
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+		await expect(
+			canvas.getByRole("heading", {
+				name: /Browser-Only Connections Disabled/,
+			}),
+		).toBeInTheDocument();
+		await expect(
+			canvas.queryByRole("link", { name: /Start trial for free/ }),
+		).not.toBeInTheDocument();
+	},
+};
+
+export const NotEntitled: Story = {
+	args: {
+		isBrowserOnlyEntitled: false,
+		featureBrowserOnlyEnabled: false,
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+		await expect(
+			canvas.getByRole("heading", {
+				name: /Browser-Only Connections Disabled/,
+			}),
+		).toBeInTheDocument();
+		await expect(
+			canvas.getByRole("link", { name: /Start trial for free/ }),
+		).toBeInTheDocument();
 	},
 };
 
diff --git a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
index 2e30086a1662f..0e535de0b7254 100644
--- a/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/SecuritySettingsPage/SecuritySettingsPageView.tsx
@@ -21,11 +21,15 @@ import OptionsTable from "../OptionsTable";
 
 type SecuritySettingsPageViewProps = {
 	options: SerpentOption[];
+	/** True when the license covers browser-only connections. */
+	isBrowserOnlyEntitled: boolean;
+	/** True when the deployment has browser-only connections turned on. */
 	featureBrowserOnlyEnabled: boolean;
 };
 
 export const SecuritySettingsPageView: FC<SecuritySettingsPageViewProps> = ({
 	options,
+	isBrowserOnlyEntitled,
 	featureBrowserOnlyEnabled,
 }) => {
 	const tlsOptions = options.filter((o) =>
@@ -78,7 +82,7 @@ export const SecuritySettingsPageView: FC<SecuritySettingsPageViewProps> = ({
 					</SettingsHeaderDescription>
 				</SettingsHeader>
 
-				{!featureBrowserOnlyEnabled ? (
+				{!isBrowserOnlyEntitled ? (
 					<PremiumPaywallSmall
 						source="browser_only"
 						message="Browser-Only Connections"