diff --git a/client/cmd/root.go b/client/cmd/root.go
index f64879b4c..2ee9ef729 100644
--- a/client/cmd/root.go
+++ b/client/cmd/root.go
@@ -160,7 +160,7 @@ func init() {
 		defaultDaemonAddr = daddr.WindowsPipeAddr
 	}
 
-	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|tcp|npipe]://[path|host:port|name]")
+	rootCmd.PersistentFlags().StringVar(&daemonAddr, "daemon-addr", defaultDaemonAddr, "Daemon service address to serve CLI requests [unix|npipe]://[path|name]. tcp://host:port is deprecated: it carries no caller identity, so the daemon refuses every request on it")
 	rootCmd.PersistentFlags().StringVarP(&managementURL, "management-url", "m", "", fmt.Sprintf("Management Service URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultManagementURL))
 	rootCmd.PersistentFlags().StringVar(&adminURL, "admin-url", "", fmt.Sprintf("Admin Panel URL [http|https]://[host]:[port] (default \"%s\")", profilemanager.DefaultAdminURL))
 	rootCmd.PersistentFlags().StringVarP(&logLevel, "log-level", "l", "info", "sets NetBird log level")
diff --git a/client/cmd/service.go b/client/cmd/service.go
index d0312aa56..f6f8dedd2 100644
--- a/client/cmd/service.go
+++ b/client/cmd/service.go
@@ -94,7 +94,7 @@ func init() {
 	serviceCmd.PersistentFlags().BoolVar(&captureEnabled, "enable-capture", false, "Enables packet capture via 'netbird debug capture'. To persist, use: netbird service install --enable-capture")
 	serviceCmd.PersistentFlags().BoolVar(&networksDisabled, "disable-networks", false, "Disables network selection. If enabled, the client will not allow listing, selecting, or deselecting networks. To persist, use: netbird service install --disable-networks")
 	serviceCmd.PersistentFlags().BoolVar(&enableJSONSocket, "enable-json-socket", false, "Enables the HTTP/JSON API socket served by grpc-gateway. To persist, use: netbird service install --enable-json-socket")
-	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address [unix|tcp]://[path|host:port]. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
+	serviceCmd.PersistentFlags().StringVar(&jsonSocket, "json-socket", defaultJSONSocket, "HTTP/JSON API socket address unix://path. tcp://host:port is deprecated: it carries no caller identity, so the daemon refuses every request on it. Requires --enable-json-socket to serve. To persist, use: netbird service install --enable-json-socket --json-socket")
 
 	allowGroupDesc := `Restricts the daemon control socket and the JSON socket to the given group. ` +
 		`Accounts outside it cannot connect at all, so nothing the daemon exposes is reachable from them. ` +
diff --git a/client/cmd/service_socket.go b/client/cmd/service_socket.go
index 399125f51..ee52a2572 100644
--- a/client/cmd/service_socket.go
+++ b/client/cmd/service_socket.go
@@ -74,7 +74,7 @@ func listenOnAddress(addr string, allowed []string) (*socketListener, error) {
 func parseListenAddress(addr string) (string, string, error) {
 	network, address, ok := strings.Cut(addr, "://")
 	if !ok || network == "" || address == "" {
-		return "", "", fmt.Errorf("address must be in [unix|tcp|npipe]://[path|host:port|name] format: %q", addr)
+		return "", "", fmt.Errorf("address must be in [unix|npipe]://[path|name] format, or the deprecated tcp://host:port: %q", addr)
 	}
 
 	switch network {
diff --git a/client/ui/main.go b/client/ui/main.go
index 328351415..ea52118ca 100644
--- a/client/ui/main.go
+++ b/client/ui/main.go
@@ -242,7 +242,7 @@ func requestNotificationAuthorization(notifier *Notifier) {
 // "no flag" and an explicit "--log-file console" stay distinguishable; empty
 // falls back to console for InitLog.
 func parseFlagsAndInitLog() (string, bool) {
-	daemonAddr := flag.String("daemon-addr", DaemonAddr(), "Daemon gRPC address: unix:///path or tcp://host:port")
+	daemonAddr := flag.String("daemon-addr", DaemonAddr(), "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port (deprecated)")
 	logFiles := &stringList{}
 	flag.Var(logFiles, "log-file", "Log destination. Repeat to log to multiple targets at once, e.g. `--log-file console --log-file Y:/netbird-ui.log`. Each value is one of: console, syslog, or a file path. File destinations are rotated by lumberjack (same as the daemon). Defaults to console. Passing any value disables the daemon-debug-driven gui-client.log.")
 	logLevel := flag.String("log-level", "info", "Log level: trace|debug|info|warn|error.")
diff --git a/client/ui/services/oneshot.go b/client/ui/services/oneshot.go
index d20b390cd..60e4b850a 100644
--- a/client/ui/services/oneshot.go
+++ b/client/ui/services/oneshot.go
@@ -158,7 +158,7 @@ func IsPrivilegedSettingsRun(args []string) bool {
 func RunPrivilegedSettings(args []string, connect func(addr string) (proto.DaemonServiceClient, error)) int {
 	fs := flag.NewFlagSet("netbird-ui --"+FlagApplyPrivilegedSettings, flag.ContinueOnError)
 	fs.Bool(FlagApplyPrivilegedSettings, false, "Apply the settings the daemon restricts to root/administrator and exit.")
-	daemonAddr := fs.String(FlagDaemonAddr, "", "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port")
+	daemonAddr := fs.String(FlagDaemonAddr, "", "Daemon gRPC address: unix:///path, npipe://name or tcp://host:port (deprecated)")
 	logLevel := fs.String(FlagLogLevel, "info", "Log level: trace|debug|info|warn|error.")
 	profile := fs.String(FlagProfile, "", "Profile to change.")
 	username := fs.String(FlagUser, "", "Owner of the profile.")