Can you drop the HTTP-to-HTTPS redirect once HSTS is set?

Can you drop the HTTP-to-HTTPS redirect once HSTS is set?

The optimization "HSTS handles the upgrade, so I can remove my 301 redirect" contains a fatal first-visit gap. HSTS (HTTP Strict Transport Security, RFC 6797) is a Trust On First Use mechanism. The browser only learns your HSTS policy by receiving the Strict-Transport-Security header — and it can only receive that header over a successful HTTPS response. A browser that has never visited you, or whose cached policy expired, has no instruction yet.

So the very first request a new client makes to http://yoursite must still be answered. If you removed the redirect, that plaintext request either fails or is served over HTTP, exactly the window an on-path attacker uses for SSL-stripping. The redirect is what gets that first connection onto HTTPS so the HSTS header can ever be delivered.

The only way to close the first-visit gap entirely is the preload list (compiled into the browser), and even that requires you to keep serving HTTPS correctly. The redirect stays either way.

— HSTS is Trust On First Use over HTTPS
— First plaintext request still needs answering
— Removing the redirect reopens SSL-stripping

Further reading: RFC 6797, §8.3 and §14.6.
Bottom line: Keep the HTTP-to-HTTPS redirect. HSTS protects return visits; the redirect protects the first one.