diff --git a/implementations/rust/ockam/ockam_command/src/project/ticket.rs b/implementations/rust/ockam/ockam_command/src/project/ticket.rs
index 64012840dd0..ba127a84de3 100644
--- a/implementations/rust/ockam/ockam_command/src/project/ticket.rs
+++ b/implementations/rust/ockam/ockam_command/src/project/ticket.rs
@@ -69,7 +69,7 @@ pub struct TicketCommand {
     enroller: bool,
 
     /// Allows the access to the TLS certificate of the Project, this flag is transformed into the attributes `--attribute ockam-tls-certificate=true`
-    #[arg(long = "tls")]
+    #[arg(long = "tls", hide = true)]
     tls: bool,
 
     #[command(flatten)]
diff --git a/implementations/rust/ockam/ockam_command/src/tcp/inlet/create.rs b/implementations/rust/ockam/ockam_command/src/tcp/inlet/create.rs
index badfbb40a21..7a018f84eba 100644
--- a/implementations/rust/ockam/ockam_command/src/tcp/inlet/create.rs
+++ b/implementations/rust/ockam/ockam_command/src/tcp/inlet/create.rs
@@ -129,14 +129,14 @@ pub struct CreateCommand {
     )]
     pub no_tcp_fallback: bool,
 
-    #[arg(long, value_name = "BOOL", default_value_t = false)]
+    #[arg(long, value_name = "BOOL", default_value_t = false, hide = true)]
     /// Enable TLS for the TCP Inlet.
     /// Uses the default project TLS certificate provider, `/project/default/service/tls_certificate_provider`.
     /// To specify a different certificate provider, use `--tls-certificate-provider`.
     /// Requires `ockam-tls-certificate` credential attribute.
     pub tls: bool,
 
-    #[arg(long, value_name = "ROUTE")]
+    #[arg(long, value_name = "ROUTE", hide = true)]
     /// Enable TLS for the TCP Inlet using the provided certificate provider.
     /// Requires `ockam-tls-certificate` credential attribute.
     pub tls_certificate_provider: Option<MultiAddr>,
diff --git a/implementations/rust/ockam/ockam_command/tests/bats/orchestrator/portals.bats b/implementations/rust/ockam/ockam_command/tests/bats/orchestrator/portals.bats
index 31acd3dc380..71a16928088 100644
--- a/implementations/rust/ockam/ockam_command/tests/bats/orchestrator/portals.bats
+++ b/implementations/rust/ockam/ockam_command/tests/bats/orchestrator/portals.bats
@@ -287,13 +287,14 @@ teardown() {
   kill -QUIT $socat_pid
 }
 
-@test "portals - create a local TLS inlet, https works without skipping verification" {
-  port="$(random_port)"
-
-  run_success "$OCKAM" node create blue
-  run_success "$OCKAM" tcp-outlet create --at /node/blue --to 127.0.0.1:$PYTHON_SERVER_PORT
-  run_success "$OCKAM" tcp-inlet create --tls --from $port --to /secure/api/service/outlet
-
-  project_id="$(jq -r .id $PROJECT_PATH)"
-  run_success curl -sfI --retry-connrefused --retry-delay 5 --retry 10 -m 5 "https://${project_id}.ockam.network:${port}"
-}
+# TODO: uncomment once TLS inlets are ready to be used
+#@test "portals - create a local TLS inlet, https works without skipping verification" {
+#  port="$(random_port)"
+#
+#  run_success "$OCKAM" node create blue
+#  run_success "$OCKAM" tcp-outlet create --at /node/blue --to 127.0.0.1:$PYTHON_SERVER_PORT
+#  run_success "$OCKAM" tcp-inlet create --tls --from $port --to /secure/api/service/outlet
+#
+#  project_id="$(jq -r .id $PROJECT_PATH)"
+#  run_success curl -sfI --retry-connrefused --retry-delay 5 --retry 10 -m 5 "https://${project_id}.ockam.network:${port}"
+#}