diff --git a/docs/cliwrap.md b/docs/cliwrap.md
index 94855a049f..06bbce200f 100644
--- a/docs/cliwrap.md
+++ b/docs/cliwrap.md
@@ -3,7 +3,13 @@ parent: Experimental features
 nav_order: 1
 ---
 
-# Wrapping other CLI entrypoints
+# DEPRECATED: Wrapping other CLI entrypoints
+
+**This functionality is now deprecated and slated for removal**. 
+
+The below text documents the functionality as it exists today for historical reference.
+
+---
 
 A simple way to describe the goal of rpm-ostree is to convert the default model for operating system updates to be "image based".
 
diff --git a/docs/treefile.md b/docs/treefile.md
index 9839589ebd..de56f431d4 100644
--- a/docs/treefile.md
+++ b/docs/treefile.md
@@ -156,7 +156,8 @@ It supports the following parameters:
     rpm-ostree will replace binaries such as `/usr/bin/rpm` with
     wrappers that intercept unsafe operations, or adjust functionality.
 
-    The default is `false` out of conservatism; you likely want to enable this.
+    This is deprecated and we now plan to land relevant functionality
+    in the upstream projects.
 
  * `cliwrap-binaries`: array of strings, optional.  An explicit list of binaries
     to enable `cliwrap`.  The current allowed set contains just one value: `kernel-install`.
diff --git a/rust/src/cliwrap.rs b/rust/src/cliwrap.rs
index e9a32ebd71..1675fab58e 100644
--- a/rust/src/cliwrap.rs
+++ b/rust/src/cliwrap.rs
@@ -85,6 +85,9 @@ pub fn entrypoint(args: &[&str]) -> Result<()> {
 
 /// Write wrappers to the target root filesystem.
 fn install_to_root(args: &[&str]) -> Result<()> {
+    crate::client::warn_future_incompatibility(
+        "cliwrap is deprecated; the replacement path is to get functionality into the relevant upstream projects.",
+    );
     let root = args
         .get(0)
         .map(Utf8Path::new)
diff --git a/rust/src/treefile.rs b/rust/src/treefile.rs
index da6c0ca75b..85a09a9683 100644
--- a/rust/src/treefile.rs
+++ b/rust/src/treefile.rs
@@ -1460,6 +1460,10 @@ impl Treefile {
             deprecated = true;
             eprintln!("warning: initramfs-args is deprecated, use /etc/dracut.conf.d")
         }
+        if self.get_cliwrap() {
+            deprecated = true;
+            eprintln!("warning: cliwrap is deprecated and slated for removal");
+        }
         if deprecated {
             std::thread::sleep(std::time::Duration::from_secs(3));
         }