diff --git a/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilder.java b/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilder.java
index 71b0db0b74..7de0a3c4a0 100644
--- a/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilder.java
+++ b/cluster-operator/src/main/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilder.java
@@ -550,10 +550,6 @@ public KafkaBrokerConfigurationBuilder withAuthorization(String clusterName, Kaf
                 superUsers.add(String.format("User:system:serviceaccount:%s:%s", reconciliation.namespace(), KafkaExporterResources.serviceAccountName(clusterName)));
                 superUsers.add(String.format("User:system:serviceaccount:%s:%s", reconciliation.namespace(), CruiseControlResources.serviceAccountName(clusterName)));
                 superUsers.add(String.format("User:system:serviceaccount:%s:%s", reconciliation.namespace(), KafkaResources.clusterOperatorServiceAccount(clusterName)));
-            } else {
-                // When authentication is disabled, all internal synchronization is using the ANONYMOUS user. In order
-                // to support authorization, we have to make this user a super-user.
-                superUsers.add("User:ANONYMOUS");
             }
 
             printSectionHeader("Authorization");
diff --git a/cluster-operator/src/test/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilderTest.java b/cluster-operator/src/test/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilderTest.java
index 1756651155..f68ce74749 100644
--- a/cluster-operator/src/test/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilderTest.java
+++ b/cluster-operator/src/test/java/io/strimzi/operator/cluster/model/KafkaBrokerConfigurationBuilderTest.java
@@ -424,7 +424,7 @@ public void testSimpleAuthorizationWithoutMtls()  {
 
         assertThat(configuration, isEquivalent("node.id=2",
                 "authorizer.class.name=org.apache.kafka.metadata.authorizer.StandardAuthorizer",
-                "super.users=User:ANONYMOUS;User:jakub;User:CN=kuba"));
+                "super.users=User:jakub;User:CN=kuba"));
     }
 
     @Test
diff --git a/documentation/modules/security/con-internal-cluster-security.adoc b/documentation/modules/security/con-internal-cluster-security.adoc
index b7f3e95495..2d3a5843a5 100644
--- a/documentation/modules/security/con-internal-cluster-security.adoc
+++ b/documentation/modules/security/con-internal-cluster-security.adoc
@@ -69,9 +69,10 @@ The supported combinations are:
 * No encryption with service account authentication
 * And no encryption with no authentication
 
-WARNING: When the authentication type is `none` and Kafka authorization is configured, Strimzi automatically makes the `ANONYMOUS` user a super user so that internal components can operate.
-This gives unrestricted access to any connection that Kafka identifies as `ANONYMOUS`, including connections through an unauthenticated client listener.
+WARNING: When the authentication type is set to `none`, all internal connections between the Kafka cluster components are unauthenticated and use the `ANONYMOUS` principal.
 Disable authentication only if other controls, such as network isolation or a service mesh, prevent unauthorized access.
+If you want to enable Kafka authorization in such a cluster, you must configure the `ANONYMOUS` user as a super user to make the internal components operate correctly.
+This gives unrestricted access to any connection that Kafka identifies as `ANONYMOUS`, including connections through an unauthenticated client listener.
 
 == Default internal cluster security
 
@@ -145,7 +146,6 @@ The service account exists only while service account authentication is enabled.
 |===
 
 When Kafka authorization is configured, Strimzi adds these principals to the list of Kafka super users so that internal components can operate.
-Unlike the `none` authentication type, the `ANONYMOUS` user is not made a super user.
 
 Service account authentication has the following requirements: