Comment by buzer

You also need to block access to the approved CT list until it fails open after 70 days.

This is assuming the CT logs no longer issue SCTs for these CAs. If they do then you just need to the CT dance and publish that certificate there.

Of course this assumes the app/device isn't using certificate pinning.