diff --git a/client/cmd/root.go b/client/cmd/root.go
index f976ca895..3c49f8cca 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -220,13 +220,15 @@ func init() {
 			`An empty string "" clears the previous configuration. `+
 			`E.g. --dns-resolver-address 127.0.0.1:5053 or --dns-resolver-address ""`,
 	)
-	upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Experimental] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.")
-	upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Experimental] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.")
+	upCmd.PersistentFlags().BoolVar(&rosenpassEnabled, enableRosenpassFlag, false, "[Deprecated] Enable Rosenpass feature. If enabled, the connection will be post-quantum secured via Rosenpass.")
+	upCmd.PersistentFlags().BoolVar(&rosenpassPermissive, rosenpassPermissiveFlag, false, "[Deprecated] Enable Rosenpass in permissive mode to allow this peer to accept WireGuard connections without requiring Rosenpass functionality from peers that do not have Rosenpass enabled.")
 	upCmd.PersistentFlags().BoolVar(&autoConnectDisabled, disableAutoConnectFlag, false, "Disables auto-connect feature. If enabled, then the client won't connect automatically when the service starts.")
 	upCmd.PersistentFlags().BoolVar(&localMetricsEnabled, enableLocalMetricsFlag, false, "Enables a local Prometheus /metrics endpoint exposing connection state (peers, latency, P2P vs relay).")
 	upCmd.PersistentFlags().StringVar(&localMetricsAddr, localMetricsAddressFlag, localmetrics.DefaultListenAddress, "Listen address of the local Prometheus /metrics endpoint.")
 	upCmd.PersistentFlags().BoolVar(&lazyConnEnabled, enableLazyConnectionFlag, false, "Deprecated: no longer used. Lazy connections are controlled by the server and the NB_LAZY_CONN environment variable.")
 	_ = upCmd.PersistentFlags().MarkDeprecated(enableLazyConnectionFlag, "no longer used; lazy connections are controlled by the server and the NB_LAZY_CONN environment variable")
+	_ = upCmd.PersistentFlags().MarkDeprecated(enableRosenpassFlag, "Rosenpass support may be removed in a future release")
+	_ = upCmd.PersistentFlags().MarkDeprecated(rosenpassPermissiveFlag, "Rosenpass support may be removed in a future release")
 
 }
 
diff --git a/client/cmd/up_rosenpass_test.go b/client/cmd/up_rosenpass_test.go
new file mode 100644
index 000000000..fd36df20f
--- /dev/null
+++ b/client/cmd/up_rosenpass_test.go
@@ -0,0 +1,34 @@
+package cmd
+
+import (
+	"bytes"
+	"testing"
+
+	"github.com/spf13/pflag"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRosenpassFlagsWarnDeprecated(t *testing.T) {
+	origEnabled, origPermissive := rosenpassEnabled, rosenpassPermissive
+	t.Cleanup(func() {
+		rosenpassEnabled, rosenpassPermissive = origEnabled, origPermissive
+	})
+
+	for _, name := range []string{enableRosenpassFlag, rosenpassPermissiveFlag} {
+		// Copy the production flag into a private set so Set marks only the copy as
+		// Changed, leaving upCmd's shared flag set untouched for other tests.
+		prod := upCmd.PersistentFlags().Lookup(name)
+		require.NotNil(t, prod, "flag --%s must be registered on up", name)
+		flagCopy := *prod
+
+		var out bytes.Buffer
+		flags := pflag.NewFlagSet("rosenpass-test", pflag.ContinueOnError)
+		flags.SetOutput(&out)
+		flags.AddFlag(&flagCopy)
+
+		require.NoError(t, flags.Set(name, "true"))
+		assert.Contains(t, out.String(), "Flag --"+name+" has been deprecated", "setting --%s should print the deprecation notice", name)
+		assert.False(t, prod.Changed, "the shared --%s flag must stay unchanged", name)
+	}
+}
diff --git a/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
index db1ad9c8f..eacf0ebfe 100644
--- a/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
+++ b/client/ui/frontend/src/modules/settings/SettingsSecurity.tsx
@@ -42,7 +42,14 @@ export function SettingsSecurity() {
                                 if (!v) setField("rosenpassPermissive", false);
                             }}
                             label={t("settings.security.rosenpass.label")}
-                            helpText={t("settings.security.rosenpass.help")}
+                            helpText={
+                                <>
+                                    {t("settings.security.rosenpass.help")}
+                                    <span className={"mt-1 block"}>
+                                        {t("settings.security.rosenpass.deprecated")}
+                                    </span>
+                                </>
+                            }
                         />
                     )}
                     {!hideRosenpassPermissive && (
diff --git a/client/ui/i18n/locales/en/common.json b/client/ui/i18n/locales/en/common.json
index 94d741b3e..fb3af16ea 100644
--- a/client/ui/i18n/locales/en/common.json
+++ b/client/ui/i18n/locales/en/common.json
@@ -899,6 +899,10 @@
         "message": "Add a post-quantum key exchange via Rosenpass on top of WireGuard®.",
         "description": "Helper text: adds a post-quantum key exchange via Rosenpass on top of WireGuard®. 'Rosenpass' and 'WireGuard®' are product names — do not translate; keep the ® symbol."
     },
+    "settings.security.rosenpass.deprecated": {
+        "message": "Deprecated: Rosenpass support may be removed in a future release.",
+        "description": "Notice shown under the quantum-resistance toggle: the Rosenpass feature is deprecated and may be removed later. 'Rosenpass' is a product name — do not translate."
+    },
     "settings.security.rosenpassPermissive.label": {
         "message": "Enable Permissive Mode",
         "description": "Toggle label: enable permissive mode (for quantum-resistance)."