diff --git a/CHANGELOG.md b/CHANGELOG.md
index 11c259ec..67f17a5b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,11 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+### Deprecated
+
+- The `-nodeport` discovery ConfigMaps have been deprecated for removal ([#813]).
+  - Any existing uses should be migrated to the primary discovery ConfigMap instead.
+
 ### Added
 
 - The lifetime of auto generated TLS certificates is now configurable with the role and roleGroup
@@ -25,6 +30,7 @@ All notable changes to this project will be documented in this file.
 [#796]: https://github.com/stackabletech/kafka-operator/pull/796
 [#803]: https://github.com/stackabletech/kafka-operator/pull/803
 [#809]: https://github.com/stackabletech/kafka-operator/pull/809
+[#813]: https://github.com/stackabletech/kafka-operator/pull/813
 
 ## [24.11.0] - 2024-11-18
 
diff --git a/docs/modules/kafka/pages/reference/discovery.adoc b/docs/modules/kafka/pages/reference/discovery.adoc
index eb30da5b..fe21ced5 100644
--- a/docs/modules/kafka/pages/reference/discovery.adoc
+++ b/docs/modules/kafka/pages/reference/discovery.adoc
@@ -9,6 +9,8 @@ The Stackable Operator for Apache Kafka publishes a xref:concepts:service_discov
 
 The bundle includes a thrift connection string to access the Kafka broker service. This string may be used by other operators or tools to configure their products with access to Kafka. This is limited to internal cluster access.
 
+NOTE: The operator also creates a deprecated secondary discovery ConfigMap named `\{clusterName\}-nodeport`. In 24.7 and older, this ConfigMap was used to access the Kafka installation from outside the Kubernetes cluster. In 24.11, this was replaced by xref:usage-guide/listenerclass.adoc[Listener-based exposition], and the `-nodeport` ConfigMap was made equivalent to the primary one. This behaviour is deprecated as of 25.3, and will be removed in the next release. Any existing uses of the `-nodeport` ConfigMap should be migrated to the primary. See https://github.com/stackabletech/kafka-operator/issues/765[the deprecation issue] for more details.
+
 == Example
 
 Given the following Kafka cluster:
diff --git a/rust/operator-binary/src/discovery.rs b/rust/operator-binary/src/discovery.rs
index 8b431bda..70147a23 100644
--- a/rust/operator-binary/src/discovery.rs
+++ b/rust/operator-binary/src/discovery.rs
@@ -73,16 +73,28 @@ pub async fn build_discovery_configmaps(
             &name,
             listener_hosts(listeners, port_name)?,
         )?,
-        // backwards compat: nodeport service is now the same as the main service, access type
-        // is determined by the listenerclass.
-        // do we want to deprecate/remove this?
-        build_discovery_configmap(
-            kafka,
-            owner,
-            resolved_product_image,
-            &format!("{name}-nodeport"),
-            listener_hosts(listeners, port_name)?,
-        )?,
+        {
+            let mut nodeport = build_discovery_configmap(
+                kafka,
+                owner,
+                resolved_product_image,
+                &format!("{name}-nodeport"),
+                listener_hosts(listeners, port_name)?,
+            )?;
+            nodeport
+                .metadata
+                .annotations
+                .get_or_insert_with(Default::default)
+                .insert(
+                    "stackable.tech/deprecated".to_string(),
+                    format!(
+                        "Deprecated in 25.3, and scheduled for removal in the next version. \
+                             Use {name:?} instead. \
+                             See https://github.com/stackabletech/kafka-operator/issues/765 for more."
+                    ),
+                );
+            nodeport
+        },
     ])
 }