diff --git a/.github/workflows/subca-clone-test.yml b/.github/workflows/subca-clone-test.yml
index 54964cf1c2d..a9e2b3c26e6 100644
--- a/.github/workflows/subca-clone-test.yml
+++ b/.github/workflows/subca-clone-test.yml
@@ -229,7 +229,6 @@ jobs:
 
           # normalize actual result:
           # - remove params that cannot be compared
-          # - change hierarchy.select from Root to Subordinate (TODO: fix this)
           sed -e '/^installDate=/d' \
               -e '/^dbs.beginReplicaNumber=/d' \
               -e '/^dbs.endReplicaNumber=/d' \
@@ -237,7 +236,6 @@ jobs:
               -e '/^dbs.nextEndReplicaNumber=/d' \
               -e '/^ca.sslserver.cert=/d' \
               -e '/^ca.sslserver.certreq=/d' \
-              -e 's/^\(hierarchy.select\)=.*$/\1=Subordinate/' \
               CS.cfg.secondary \
               | sort > actual
 
diff --git a/base/server/python/pki/server/cli/__init__.py b/base/server/python/pki/server/cli/__init__.py
index 3195aea0d00..340a316719f 100644
--- a/base/server/python/pki/server/cli/__init__.py
+++ b/base/server/python/pki/server/cli/__init__.py
@@ -174,7 +174,7 @@ def print_status(instance):
             print()
             print('  CA Subsystem:')
 
-            subsystem_type = ca.config['hierarchy.select'] + ' CA'
+            subsystem_type = 'CA'
             if ca.config['securitydomain.select'] == 'new':
                 subsystem_type += ' (Security Domain)'
             print('    Type:                %s' % subsystem_type)
diff --git a/base/server/python/pki/server/deployment/__init__.py b/base/server/python/pki/server/deployment/__init__.py
index 0155fd6baf9..3fecd53f7ad 100644
--- a/base/server/python/pki/server/deployment/__init__.py
+++ b/base/server/python/pki/server/deployment/__init__.py
@@ -1078,11 +1078,6 @@ def init_subsystem(self, subsystem):
         # configure CA
         if subsystem.type == 'CA':
 
-            if external or subordinate:
-                subsystem.config['hierarchy.select'] = 'Subordinate'
-            else:
-                subsystem.config['hierarchy.select'] = 'Root'
-
             if subordinate:
                 subsystem.config['preop.cert.signing.type'] = 'remote'
                 subsystem.config['preop.cert.signing.profile'] = 'caInstallCACert'
diff --git a/base/server/upgrade/11.5.0/01-RemoveUnusedParams.py b/base/server/upgrade/11.5.0/01-RemoveUnusedParams.py
index 023f73aaf18..a95cdcbd354 100644
--- a/base/server/upgrade/11.5.0/01-RemoveUnusedParams.py
+++ b/base/server/upgrade/11.5.0/01-RemoveUnusedParams.py
@@ -26,4 +26,8 @@ def upgrade_subsystem(self, instance, subsystem):
         logger.info('Removing subsystem.select')
         subsystem.config.pop('subsystem.select', None)
 
+        # remove hierarchy.select param
+        logger.info('Removing hierarchy.select')
+        subsystem.config.pop('hierarchy.select', None)
+
         subsystem.save()