diff --git a/package-lock.json b/package-lock.json
index cb43c39e..92b55f3f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -82,7 +82,6 @@
         "@types/jest": "^29.2.1",
         "@types/js-yaml": "^4.0.5",
         "@types/json-bigint": "^1.0.4",
-        "@types/mustache": "^4.2.2",
         "@types/node": "^22.18.8",
         "@types/pg": "^8.6.4",
         "@types/stream-buffers": "^3.0.7",
@@ -93,7 +92,6 @@
         "jest": "^29.7.0",
         "js-yaml": "^4.1.0",
         "json-schema-to-ts": "^3.0.0",
-        "mustache": "^4.2.0",
         "patch-package": "^8.0.0",
         "pino-pretty": "^13.1.3",
         "prettier": "^2.8.8",
@@ -11305,12 +11303,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/mustache": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@types/mustache/-/mustache-4.2.2.tgz",
-      "integrity": "sha512-MUSpfpW0yZbTgjekDbH0shMYBUD+X/uJJJMm9LXN1d5yjl5lCY1vN/eWKD6D1tOtjA6206K0zcIPnUaFMurdNA==",
-      "dev": true
-    },
     "node_modules/@types/mysql": {
       "version": "2.15.27",
       "resolved": "https://registry.npmjs.org/@types/mysql/-/mysql-2.15.27.tgz",
@@ -15477,15 +15469,6 @@
         "readable-stream": "^3.6.0"
       }
     },
-    "node_modules/mustache": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/mustache/-/mustache-4.2.0.tgz",
-      "integrity": "sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==",
-      "dev": true,
-      "bin": {
-        "mustache": "bin/mustache"
-      }
-    },
     "node_modules/natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
@@ -25807,12 +25790,6 @@
         "@types/node": "*"
       }
     },
-    "@types/mustache": {
-      "version": "4.2.2",
-      "resolved": "https://registry.npmjs.org/@types/mustache/-/mustache-4.2.2.tgz",
-      "integrity": "sha512-MUSpfpW0yZbTgjekDbH0shMYBUD+X/uJJJMm9LXN1d5yjl5lCY1vN/eWKD6D1tOtjA6206K0zcIPnUaFMurdNA==",
-      "dev": true
-    },
     "@types/mysql": {
       "version": "2.15.27",
       "resolved": "https://registry.npmjs.org/@types/mysql/-/mysql-2.15.27.tgz",
@@ -28728,12 +28705,6 @@
         "readable-stream": "^3.6.0"
       }
     },
-    "mustache": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/mustache/-/mustache-4.2.0.tgz",
-      "integrity": "sha512-71ippSywq5Yb7/tVYyGbkBggbU8H3u5Rz56fH60jGFgr8uHwxs+aSKeqmluIVzM0m0kB7xQjKS6qPfd0b2ZoqQ==",
-      "dev": true
-    },
     "natural-compare": {
       "version": "1.4.0",
       "resolved": "https://registry.npmjs.org/natural-compare/-/natural-compare-1.4.0.tgz",
diff --git a/package.json b/package.json
index 7e7f00a0..63dafff9 100644
--- a/package.json
+++ b/package.json
@@ -99,7 +99,6 @@
     "@types/jest": "^29.2.1",
     "@types/js-yaml": "^4.0.5",
     "@types/json-bigint": "^1.0.4",
-    "@types/mustache": "^4.2.2",
     "@types/node": "^22.18.8",
     "@types/pg": "^8.6.4",
     "@types/stream-buffers": "^3.0.7",
@@ -110,7 +109,6 @@
     "jest": "^29.7.0",
     "js-yaml": "^4.1.0",
     "json-schema-to-ts": "^3.0.0",
-    "mustache": "^4.2.0",
     "patch-package": "^8.0.0",
     "pino-pretty": "^13.1.3",
     "prettier": "^2.8.8",
diff --git a/src/test/rls.test.ts b/src/test/rls.test.ts
index 4f572d58..8c226994 100644
--- a/src/test/rls.test.ts
+++ b/src/test/rls.test.ts
@@ -11,7 +11,6 @@ import FormData from 'form-data'
 import fs from 'fs'
 import yaml from 'js-yaml'
 import { Knex, knex } from 'knex'
-import Mustache from 'mustache'
 import path from 'path'
 import app from '../app'
 import { getConfig } from '../config'
@@ -64,6 +63,22 @@ interface RlsTestSpec {
   tests: TestCase[]
 }
 
+function renderRlsTemplate(template: string, values: Record<string, string>) {
+  const rendered = template.replace(/{{\s*([a-zA-Z0-9_]+)\s*}}/g, (_match, key: string) => {
+    if (!Object.prototype.hasOwnProperty.call(values, key)) {
+      throw new Error(`Unknown RLS template variable: ${key}`)
+    }
+
+    return values[key]
+  })
+
+  if (rendered.includes('{{')) {
+    throw new Error('Unsupported template tag in rls_tests.yaml')
+  }
+
+  return rendered
+}
+
 const testSpec = yaml.load(
   fs.readFileSync(path.resolve(__dirname, 'rls_tests.yaml'), 'utf8')
 ) as RlsTestSpec
@@ -151,7 +166,7 @@ describe('RLS policies', () => {
       const originalBucketName = bucketName
 
       const testScopedSpec = yaml.load(
-        Mustache.render(content, {
+        renderRlsTemplate(content, {
           uid: userId,
           bucketName,
           objectName,