diff --git a/ee/config/feature_flags/ops/cloud_connector_cut_off_date_expired.yml b/ee/config/feature_flags/ops/cloud_connector_cut_off_date_expired.yml
new file mode 100644
index 0000000000000000000000000000000000000000..f3c0fc310748d2929eca566a84ee617b247b8241
--- /dev/null
+++ b/ee/config/feature_flags/ops/cloud_connector_cut_off_date_expired.yml
@@ -0,0 +1,9 @@
+---
+name: cloud_connector_cut_off_date_expired
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/479121
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/165312
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/483364
+milestone: '17.5'
+group: group::cloud connector
+type: ops
+default_enabled: false
diff --git a/ee/lib/cloud_connector/self_signed/available_service_data.rb b/ee/lib/cloud_connector/self_signed/available_service_data.rb
index 91096de200f973bee49326830950c1c021940836..ec87636937bed2ba2cbb7c35d5843f9256d1afcd 100644
--- a/ee/lib/cloud_connector/self_signed/available_service_data.rb
+++ b/ee/lib/cloud_connector/self_signed/available_service_data.rb
@@ -14,6 +14,11 @@ def initialize(name, cut_off_date, bundled_with, backend)
         @backend = backend
       end
 
+      override :free_access?
+      def free_access?
+        cut_off_date_expired_enabled? ? false : super
+      end
+
       override :access_token
       def access_token(resource = nil, extra_claims: {})
         ::Gitlab::CloudConnector::SelfIssuedToken.new(
@@ -26,6 +31,12 @@ def access_token(resource = nil, extra_claims: {})
 
       private
 
+      def cut_off_date_expired_enabled?
+        return false unless ::Gitlab.dev_or_test_env? || ::Gitlab.staging?
+
+        Feature.enabled?(:cloud_connector_cut_off_date_expired, :instance, type: :ops)
+      end
+
       def scopes_for(resource)
         free_access? ? allowed_scopes_during_free_access : allowed_scopes_from_purchased_bundles_for(resource)
       end
diff --git a/ee/spec/lib/cloud_connector/self_signed/available_service_data_spec.rb b/ee/spec/lib/cloud_connector/self_signed/available_service_data_spec.rb
index eb353085589ff799b0d9ce6af526d188f8d3a71d..f3a80e74d0b93e05d36c352bf74f19a34aaa9c29 100644
--- a/ee/spec/lib/cloud_connector/self_signed/available_service_data_spec.rb
+++ b/ee/spec/lib/cloud_connector/self_signed/available_service_data_spec.rb
@@ -3,16 +3,40 @@
 require 'spec_helper'
 
 RSpec.describe CloudConnector::SelfSigned::AvailableServiceData, feature_category: :cloud_connector do
+  let(:cut_off_date) { 1.month.ago }
+  let(:bundled_with) { {} }
+  let(:backend) { 'gitlab-ai-gateway' }
+  let(:available_service_data) { described_class.new(:duo_chat, cut_off_date, bundled_with, backend) }
+
+  describe '#free_access?' do
+    subject(:free_access) { available_service_data.free_access? }
+
+    let(:cut_off_date) { 1.month.from_now }
+
+    context 'when cloud_connector_cut_off_date_expired feature flag is disabled' do
+      before do
+        stub_feature_flags(cloud_connector_cut_off_date_expired: false)
+      end
+
+      it { is_expected.to be true }
+    end
+
+    context 'when cloud_connector_cut_off_date_expired feature flag is enabled' do
+      before do
+        stub_feature_flags(cloud_connector_cut_off_date_expired: true)
+      end
+
+      it { is_expected.to be false }
+    end
+  end
+
   describe '#access_token' do
     let(:resource) { create(:user) }
     let(:encoded_token_string) { 'token_string' }
-    let(:cut_off_date) { 1.month.ago }
     let(:dc_unit_primitives) { [:duo_chat_up1, :duo_chat_up2] }
     let(:duo_pro_scopes) { dc_unit_primitives + [:duo_chat_up3] }
     let(:duo_extra_scopes) { dc_unit_primitives + [:duo_chat_up4] }
     let(:bundled_with) { { "duo_pro" => duo_pro_scopes, "duo_extra" => duo_extra_scopes } }
-    let(:backend) { 'gitlab-ai-gateway' }
-    let(:available_service_data) { described_class.new(:duo_chat, cut_off_date, bundled_with, backend) }
     let(:extra_claims) { {} }
     let(:expected_token) do
       instance_double('Gitlab::CloudConnector::SelfIssuedToken', encoded: encoded_token_string)
diff --git a/ee/spec/spec_helper.rb b/ee/spec/spec_helper.rb
index a3045a571a80db301dd397a1065f4e6d0dbdcf31..c72a8a860aadd5bf0c5eefaa5683401eb16ac3fc 100644
--- a/ee/spec/spec_helper.rb
+++ b/ee/spec/spec_helper.rb
@@ -29,6 +29,13 @@
     metadata[:without_license] = true
   end
 
+  config.before do |example|
+    if example.metadata.fetch(:stub_feature_flags, true)
+      # Specs should not require cut_off_date to be expired by default for cloud connector features.
+      stub_feature_flags(cloud_connector_cut_off_date_expired: false)
+    end
+  end
+
   config.before(:context, :with_license) do
     License.destroy_all # rubocop: disable Cop/DestroyAll
     TestLicense.init