diff --git a/sdk/tdf.go b/sdk/tdf.go
index 552605e51b..99ac2348e6 100644
--- a/sdk/tdf.go
+++ b/sdk/tdf.go
@@ -53,7 +53,6 @@ const (
 	kAssertionSignature    = "assertionSig"
 	kAssertionHash         = "assertionHash"
 	hexSemverThreshold     = "4.3.0"
-	readActionName         = "read"
 
 	// maxPayloadSegments caps the segment count a declared input size may imply.
 	// The archive writer counts segments with an int, so the count has to fit one
diff --git a/sdk/tdf_config.go b/sdk/tdf_config.go
index cb2def9a3b..186ba0d36c 100644
--- a/sdk/tdf_config.go
+++ b/sdk/tdf_config.go
@@ -27,10 +27,16 @@ const (
 	inputSizeUnknown = -1
 )
 
+// TDFFormat once selected a manifest serialization. Only JSON was ever
+// implemented, and nothing reads this.
+//
+// Deprecated: unused; the manifest is always JSON.
 type TDFFormat = int
 
 const (
+	// Deprecated: unused; the manifest is always JSON.
 	JSONFormat = iota
+	// Deprecated: never implemented.
 	XMLFormat
 )
 
@@ -138,12 +144,8 @@ type TDFConfig struct {
 	autoconfigure              bool
 	defaultSegmentSize         int64
 	inputSize                  int64
-	enableEncryption           bool
-	tdfFormat                  TDFFormat
 	metaData                   string
 	mimeType                   string
-	rootIntegrityAlg           RootIntegrityAlg
-	segmentIntegrityAlg        SegmentIntegrityAlg
 	assertions                 []AssertionConfig
 	attributes                 []AttributeValueFQN
 	attributeValues            []*policy.Value
@@ -161,10 +163,6 @@ func newTDFConfig(opt ...TDFOption) (*TDFConfig, error) {
 		autoconfigure:       true,
 		defaultSegmentSize:  defaultSegmentSize,
 		inputSize:           inputSizeUnknown,
-		enableEncryption:    true,
-		tdfFormat:           JSONFormat,
-		rootIntegrityAlg:    RootHS256,
-		segmentIntegrityAlg: SegmentGMAC,
 		addDefaultAssertion: false,
 	}
 
diff --git a/sdk/tdf_helpers_test.go b/sdk/tdf_helpers_test.go
index a4b6d46b76..cdcd090b17 100644
--- a/sdk/tdf_helpers_test.go
+++ b/sdk/tdf_helpers_test.go
@@ -108,15 +108,6 @@ func TestRootIntegrityRejectsNonHS256(t *testing.T) {
 	assert.Equal(t, hex.EncodeToString(ocrypto.CalculateSHA256Hmac(key, aggregate)), legacySig)
 }
 
-// Closing the root off to GMAC must not move the defaults: HS256 root, GMAC
-// segments, which is what every writer has been emitting all along.
-func TestIntegrityAlgDefaults(t *testing.T) {
-	def, err := newTDFConfig()
-	require.NoError(t, err)
-	assert.Equal(t, RootHS256, def.rootIntegrityAlg)
-	assert.Equal(t, SegmentGMAC, def.segmentIntegrityAlg)
-}
-
 // The deprecated constants stay numerically where they were, so an existing
 // caller that converts one into the new types lands on the same algorithm.
 func TestDeprecatedIntegrityAlgorithmConstants(t *testing.T) {
diff --git a/sdk/tdf_test.go b/sdk/tdf_test.go
index 373a447e80..c4fdb7ea80 100644
--- a/sdk/tdf_test.go
+++ b/sdk/tdf_test.go
@@ -2912,6 +2912,12 @@ func (s *TDFSuite) testEncrypt(sdk *SDK, encryptOpts []TDFOption, plainTextFilen
 	tdfObj, err := sdk.CreateTDF(fileWriter, readSeeker, encryptOpts...)
 	s.Require().NoError(err)
 
+	// Every TDF this SDK writes carries an HS256 root over the aggregate hash
+	// and GMAC segment hashes. Nothing configures either, so assert it here
+	// rather than in one test: this runs on every encrypt case there is.
+	s.Equal(hmacIntegrityAlgorithm, tdfObj.manifest.Algorithm)
+	s.Equal(gmacIntegrityAlgorithm, tdfObj.manifest.SegmentHashAlgorithm)
+
 	s.InDelta(float64(test.tdfFileSize), float64(tdfObj.size), .04*float64(test.tdfFileSize))
 	return tdfObj
 }