diff --git a/pkg/cli/cmds/root.go b/pkg/cli/cmds/root.go
index bef07c1767..d72c4179fe 100644
--- a/pkg/cli/cmds/root.go
+++ b/pkg/cli/cmds/root.go
@@ -83,8 +83,8 @@ var (
 			Destination: &config.CloudProviderConfig,
 		},
 		&cli.StringFlag{
-			Name: "profile",
-			Usage: "(security) Validate system configuration against the selected benchmark (valid items: cis, cis-1.23 (deprecated))",
+			Name:   "profile",
+			Usage:  "(security) Validate system configuration against the selected benchmark (valid items: cis)",
 			EnvVar: "RKE2_CIS_PROFILE",
 		},
 		&cli.StringFlag{
diff --git a/pkg/rke2/rke2.go b/pkg/rke2/rke2.go
index 86cb930371..b84e7d68bb 100644
--- a/pkg/rke2/rke2.go
+++ b/pkg/rke2/rke2.go
@@ -275,7 +275,7 @@ func removeDisabledPods(dataDir, containerRuntimeEndpoint string, disabledItems
 func isCISMode(clx *cli.Context) bool {
 	profile := clx.String("profile")
 	if profile == CISProfile123 {
-		logrus.Warn("cis-1.23 profile is deprecated and will be removed in v1.29. Please use cis instead.")
+		logrus.Fatal("cis-1.23 profile is deprecated. Please use 'cis' instead.")
 	}
 	return profile == CISProfile123 || profile == CISProfile
 }