diff --git a/.changeset/admin-api-default-off.md b/.changeset/admin-api-default-off.md
new file mode 100644
index 00000000..f09ecb01
--- /dev/null
+++ b/.changeset/admin-api-default-off.md
@@ -0,0 +1,5 @@
+---
+"counterfact": minor
+---
+
+Admin API is now disabled by default. Use the `--admin-api` flag to opt in.
diff --git a/docs/reference.md b/docs/reference.md
index 396f9aa6..c4ad606c 100644
--- a/docs/reference.md
+++ b/docs/reference.md
@@ -312,7 +312,7 @@ npx counterfact@latest [spec] [output] [options]
 | `--watch-routes` | `false` | Watch and regenerate routes only |
 | `--always-fake-optionals` | `false` | Include optional fields in random responses |
 | `--prune` | `false` | Remove route files that no longer exist in the spec |
-| `--no-admin-api` | — | Disable the Admin API at `/_counterfact/api/*` |
+| `--admin-api` | `false` | Enable the Admin API at `/_counterfact/api/*` |
 | `--admin-api-token <token>` | _(none)_ | Bearer token required for Admin API endpoints |
 | `--no-update-check` | — | Disable the npm update check on startup |
 | `--config <path>` | `counterfact.yaml` | Path to a config file |
diff --git a/src/cli/run.ts b/src/cli/run.ts
index e7b2ac0a..354744f3 100644
--- a/src/cli/run.ts
+++ b/src/cli/run.ts
@@ -394,7 +394,7 @@ function buildProgram(version: string, taglines: string[]): Command {
       "-b, --build-cache",
       "builds the cache of compiled routes and types",
     )
-    .option("--no-admin-api", "disable the admin API at /_counterfact/api/*")
+    .option("--admin-api", "enable the admin API at /_counterfact/api/*")
     .option("-r, --repl", "start the REPL")
     .option("--proxy-url <string>", "proxy URL")
     .option(