diff --git a/docs/book/v2/validators/csrf.md b/docs/book/v2/validators/csrf.md
index 266312dc..02570dde 100644
--- a/docs/book/v2/validators/csrf.md
+++ b/docs/book/v2/validators/csrf.md
@@ -1,5 +1,9 @@
 # CSRF Validator
 
+CAUTION: **Deprecated**
+This validator is deprecated in favour of the drop-in replacement validator shipped in version 2.21.0 of [`laminas-session`](https://docs.laminas.dev/laminas-session/).
+The validator here will be removed in version 3.0 of `laminas-validator`.
+
 `Laminas\Validator\Csrf` provides the ability to both generate and validate CSRF tokens.
 This allows you to validate if a form submission originated from the same site, by confirming the value of the CSRF field in the submitted form is the same as the one contained in the original form.
 
diff --git a/psalm-baseline.xml b/psalm-baseline.xml
index 59a874b4..c78888dc 100644
--- a/psalm-baseline.xml
+++ b/psalm-baseline.xml
@@ -1752,6 +1752,11 @@
     </TooManyArguments>
   </file>
   <file src="src/ValidatorPluginManager.php">
+    <DeprecatedClass>
+      <code><![CDATA[Csrf::class]]></code>
+      <code><![CDATA[Csrf::class]]></code>
+      <code><![CDATA[Csrf::class]]></code>
+    </DeprecatedClass>
     <DeprecatedMethod>
       <code><![CDATA[getServiceLocator]]></code>
       <code><![CDATA[getServiceLocator]]></code>
diff --git a/src/Csrf.php b/src/Csrf.php
index 5c2ce489..668b75bd 100644
--- a/src/Csrf.php
+++ b/src/Csrf.php
@@ -18,6 +18,10 @@
 use function strtolower;
 use function strtr;
 
+/**
+ * @deprecated This validator will be removed in version 3.0 of this component. A replacement is available in
+ *             version 2.21.0 of the laminas-session component: https://docs.laminas.dev/laminas-session/
+ */
 final class Csrf extends AbstractValidator
 {
     /**
diff --git a/test/CsrfTest.php b/test/CsrfTest.php
index 8097930a..12a26771 100644
--- a/test/CsrfTest.php
+++ b/test/CsrfTest.php
@@ -20,6 +20,11 @@
 use function strtr;
 use function uniqid;
 
+/**
+ * @deprecated
+ *
+ * @psalm-suppress DeprecatedClass
+ */
 final class CsrfTest extends TestCase
 {
     private Csrf $validator;