diff --git a/docs/treefile.md b/docs/treefile.md
index 9839589ebd..de56f431d4 100644
--- a/docs/treefile.md
+++ b/docs/treefile.md
@@ -156,7 +156,8 @@ It supports the following parameters:
     rpm-ostree will replace binaries such as `/usr/bin/rpm` with
     wrappers that intercept unsafe operations, or adjust functionality.
 
-    The default is `false` out of conservatism; you likely want to enable this.
+    This is deprecated and we now plan to land relevant functionality
+    in the upstream projects.
 
  * `cliwrap-binaries`: array of strings, optional.  An explicit list of binaries
     to enable `cliwrap`.  The current allowed set contains just one value: `kernel-install`.
diff --git a/rust/src/cliwrap.rs b/rust/src/cliwrap.rs
index e9a32ebd71..1675fab58e 100644
--- a/rust/src/cliwrap.rs
+++ b/rust/src/cliwrap.rs
@@ -85,6 +85,9 @@ pub fn entrypoint(args: &[&str]) -> Result<()> {
 
 /// Write wrappers to the target root filesystem.
 fn install_to_root(args: &[&str]) -> Result<()> {
+    crate::client::warn_future_incompatibility(
+        "cliwrap is deprecated; the replacement path is to get functionality into the relevant upstream projects.",
+    );
     let root = args
         .get(0)
         .map(Utf8Path::new)