diff --git a/module/spring-boot-grpc-server/src/main/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurer.java b/module/spring-boot-grpc-server/src/main/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurer.java
index 1b889389bd2..249d9a28fe0 100644
--- a/module/spring-boot-grpc-server/src/main/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurer.java
+++ b/module/spring-boot-grpc-server/src/main/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurer.java
@@ -50,7 +50,7 @@ class GrpcDisableCsrfHttpConfigurer extends AbstractHttpConfigurer<GrpcDisableCs
 	public void init(HttpSecurity http) {
 		ApplicationContext context = http.getSharedObject(ApplicationContext.class);
 		if (context != null && isCsrfConfigurerPresent(http) && hasBean(context, GrpcServiceDiscoverer.class)
-				&& hasBean(context, GrpcServletRegistration.class) && isCsrfEnabled(context)) {
+				&& hasBean(context, GrpcServletRegistration.class) && !isCsrfEnabled(context)) {
 			http.csrf(this::disable);
 		}
 	}
@@ -65,7 +65,7 @@ class GrpcDisableCsrfHttpConfigurer extends AbstractHttpConfigurer<GrpcDisableCs
 	}
 
 	private boolean isCsrfEnabled(ApplicationContext context) {
-		return context.getEnvironment().getProperty("spring.grpc.server.security.csrf.enabled", Boolean.class, true);
+		return context.getEnvironment().getProperty("spring.grpc.server.security.csrf.enabled", Boolean.class, false);
 	}
 
 	private void disable(CsrfConfigurer<HttpSecurity> csrf) {
diff --git a/module/spring-boot-grpc-server/src/main/resources/META-INF/additional-spring-configuration-metadata.json b/module/spring-boot-grpc-server/src/main/resources/META-INF/additional-spring-configuration-metadata.json
index a49d405d6c2..eee3a0253bb 100644
--- a/module/spring-boot-grpc-server/src/main/resources/META-INF/additional-spring-configuration-metadata.json
+++ b/module/spring-boot-grpc-server/src/main/resources/META-INF/additional-spring-configuration-metadata.json
@@ -24,6 +24,13 @@
       "type": "java.lang.Boolean",
       "description": "Whether to enable Reflection on the gRPC server.",
       "defaultValue": true
+    },
+    {
+      "name": "spring.grpc.server.security.csrf.enabled",
+      "type": "java.lang.Boolean",
+      "description": "Whether to enable CSRF protection.",
+      "defaultValue": false
     }
+
   ]
 }
diff --git a/module/spring-boot-grpc-server/src/test/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurerTests.java b/module/spring-boot-grpc-server/src/test/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurerTests.java
index 7d60d3f1c3c..921bc9b45e7 100644
--- a/module/spring-boot-grpc-server/src/test/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurerTests.java
+++ b/module/spring-boot-grpc-server/src/test/java/org/springframework/boot/grpc/server/autoconfigure/security/GrpcDisableCsrfHttpConfigurerTests.java
@@ -112,7 +112,21 @@ class GrpcDisableCsrfHttpConfigurerTests {
 	}
 
 	@Test
-	void initWhenEnabledPropertyFalseDoesNothing() {
+	void initWhenEnabledPropertyTrueDoesNothing() {
+		ObjectPostProcessor<Object> objectPostProcessor = ObjectPostProcessor.identity();
+		AuthenticationManagerBuilder authenticationBuilder = new AuthenticationManagerBuilder(objectPostProcessor);
+		HttpSecurity http = new HttpSecurity(objectPostProcessor, authenticationBuilder, new HashMap<>());
+		StaticApplicationContext applicationContext = addApplicationContext(http);
+		TestPropertyValues.of("spring.grpc.server.security.csrf.enabled=true").applyTo(applicationContext);
+		addServiceDiscoverer(applicationContext);
+		addGrpcServletRegistration(applicationContext);
+		CsrfConfigurer<?> csrf = addCsrf(http);
+		this.configurer.init(http);
+		then(csrf).should(never()).requireCsrfProtectionMatcher(any());
+	}
+
+	@Test
+	void initWhenEnabledPropertyFalseDisablesCsrf() {
 		ObjectPostProcessor<Object> objectPostProcessor = ObjectPostProcessor.identity();
 		AuthenticationManagerBuilder authenticationBuilder = new AuthenticationManagerBuilder(objectPostProcessor);
 		HttpSecurity http = new HttpSecurity(objectPostProcessor, authenticationBuilder, new HashMap<>());
@@ -122,16 +136,17 @@ class GrpcDisableCsrfHttpConfigurerTests {
 		addGrpcServletRegistration(applicationContext);
 		CsrfConfigurer<?> csrf = addCsrf(http);
 		this.configurer.init(http);
-		then(csrf).should(never()).requireCsrfProtectionMatcher(any());
+		ArgumentCaptor<RequestMatcher> matcher = ArgumentCaptor.captor();
+		then(csrf).should().requireCsrfProtectionMatcher(matcher.capture());
+		assertThat(matcher.getValue()).isSameAs(GrpcCsrfRequestMatcher.INSTANCE);
 	}
 
 	@Test
-	void initWhenEnabledPropertyTrueDisablesCsrf() {
+	void initWhenEnabledPropertyMissingDisablesCsrf() {
 		ObjectPostProcessor<Object> objectPostProcessor = ObjectPostProcessor.identity();
 		AuthenticationManagerBuilder authenticationBuilder = new AuthenticationManagerBuilder(objectPostProcessor);
 		HttpSecurity http = new HttpSecurity(objectPostProcessor, authenticationBuilder, new HashMap<>());
 		StaticApplicationContext applicationContext = addApplicationContext(http);
-		TestPropertyValues.of("spring.grpc.server.security.csrf.enabled=true").applyTo(applicationContext);
 		addServiceDiscoverer(applicationContext);
 		addGrpcServletRegistration(applicationContext);
 		CsrfConfigurer<?> csrf = addCsrf(http);