diff --git a/doc/release-notes/rl-2505.section.md b/doc/release-notes/rl-2505.section.md
index 437e4187fc3f0..9c3a264db53ed 100644
--- a/doc/release-notes/rl-2505.section.md
+++ b/doc/release-notes/rl-2505.section.md
@@ -8,6 +8,10 @@
 
 - `services.rippleDataApi` has been removed, as `ripple-data-api` was broken and had not been updated since 2022.
 
+- The `rustPlatform.fetchCargoTarball` function is deprecated, because it relied on `cargo vendor` not changing its output format to keep fixed-output derivation hashes the same, which is a Nix invariant, and Cargo 1.84.0 changed `cargo vendor`'s output format.
+  It should generally be replaced with `rustPlatform.fetchCargoVendor`, but `rustPlatform.importCargoLock` may also be appropriate in some circumstances.
+  `rustPlatform.buildRustPackage` users must set `useFetchCargoVendor` to `true` and regenerate the `cargoHash`.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ### Titanium removed {#sec-nixpkgs-release-25.05-incompatibilities-titanium-removed}
diff --git a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
index 0821592e1fe1a..c477262968afe 100644
--- a/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
+++ b/pkgs/build-support/rust/fetch-cargo-tarball/default.nix
@@ -69,94 +69,102 @@ let
     else
       throw "fetchCargoTarball requires a hash for ${name}";
 in
-stdenv.mkDerivation (
-  {
-    name = "${name}-vendor.tar.gz";
-    nativeBuildInputs = [
-      cacert
-      git
-      cargo-vendor-normalise
-      cargo
-    ] ++ nativeBuildInputs;
-
-    dontConfigure = true;
-    buildPhase = ''
-      runHook preBuild
-
-      # Ensure deterministic Cargo vendor builds
-      export SOURCE_DATE_EPOCH=1
-
-      if [ -n "''${cargoRoot-}" ]; then
-        cd "$cargoRoot"
-      fi
-
-      if [[ ! -f Cargo.lock ]]; then
-          echo
-          echo "ERROR: The Cargo.lock file doesn't exist"
-          echo
-          echo "Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change"
-          echo "when the registry is updated."
-          echo
-
-          exit 1
-      fi
-
-      # Keep the original around for copyLockfile
-      cp Cargo.lock Cargo.lock.orig
-
-      export CARGO_HOME=$(mktemp -d cargo-home.XXX)
-      CARGO_CONFIG=$(mktemp cargo-config.XXXX)
-
-      if [[ -n "$NIX_CRATES_INDEX" ]]; then
-      cat >$CARGO_HOME/config.toml <<EOF
-      [source.crates-io]
-      replace-with = 'mirror'
-      [source.mirror]
-      registry = "$NIX_CRATES_INDEX"
-      EOF
-      fi
-
-      ${cargoUpdateHook}
-
-      # Override the `http.cainfo` option usually specified in `.cargo/config`.
-      export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
-
-      if grep '^source = "git' Cargo.lock; then
-          echo
-          echo "ERROR: The Cargo.lock contains git dependencies"
-          echo
-          echo "This is not supported in the default fixed-output derivation fetcher."
-          echo "Set \`useFetchCargoVendor = true\` / use fetchCargoVendor"
-          echo "or use cargoLock.lockFile / importCargoLock instead."
-          echo
-
-          exit 1
-      fi
-
-      cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
-
-      # Create an empty vendor directory when there is no dependency to vendor
-      mkdir -p $name
-      # Add the Cargo.lock to allow hash invalidation
-      cp Cargo.lock.orig $name/Cargo.lock
-
-      # Packages with git dependencies generate non-default cargo configs, so
-      # always install it rather than trying to write a standard default template.
-      install -D $CARGO_CONFIG $name/.cargo/config
-
-      runHook postBuild
-    '';
-
-    # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
-    installPhase = ''
-      tar --owner=0 --group=0 --numeric-owner --format=gnu \
-          --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
-          -czf $out $name
-    '';
-
-    inherit (hash_) outputHashAlgo outputHash;
-
-    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CRATES_INDEX" ];
-  }
-  // (removeAttrs args removedArgs)
-)
+lib.warn
+  ''
+    rustPlatform.fetchCargoTarball is deprecated in favor of rustPlatform.fetchCargoVendor.
+    If you are using buildRustPackage, try setting useFetchCargoVendor = true and regenerating cargoHash.
+    See the 25.05 release notes for more information.
+  ''
+  (
+    stdenv.mkDerivation (
+      {
+        name = "${name}-vendor.tar.gz";
+        nativeBuildInputs = [
+          cacert
+          git
+          cargo-vendor-normalise
+          cargo
+        ] ++ nativeBuildInputs;
+
+        dontConfigure = true;
+        buildPhase = ''
+          runHook preBuild
+
+          # Ensure deterministic Cargo vendor builds
+          export SOURCE_DATE_EPOCH=1
+
+          if [ -n "''${cargoRoot-}" ]; then
+            cd "$cargoRoot"
+          fi
+
+          if [[ ! -f Cargo.lock ]]; then
+              echo
+              echo "ERROR: The Cargo.lock file doesn't exist"
+              echo
+              echo "Cargo.lock is needed to make sure that cargoHash/cargoSha256 doesn't change"
+              echo "when the registry is updated."
+              echo
+
+              exit 1
+          fi
+
+          # Keep the original around for copyLockfile
+          cp Cargo.lock Cargo.lock.orig
+
+          export CARGO_HOME=$(mktemp -d cargo-home.XXX)
+          CARGO_CONFIG=$(mktemp cargo-config.XXXX)
+
+          if [[ -n "$NIX_CRATES_INDEX" ]]; then
+          cat >$CARGO_HOME/config.toml <<EOF
+          [source.crates-io]
+          replace-with = 'mirror'
+          [source.mirror]
+          registry = "$NIX_CRATES_INDEX"
+          EOF
+          fi
+
+          ${cargoUpdateHook}
+
+          # Override the `http.cainfo` option usually specified in `.cargo/config`.
+          export CARGO_HTTP_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+
+          if grep '^source = "git' Cargo.lock; then
+              echo
+              echo "ERROR: The Cargo.lock contains git dependencies"
+              echo
+              echo "This is not supported in the default fixed-output derivation fetcher."
+              echo "Set \`useFetchCargoVendor = true\` / use fetchCargoVendor"
+              echo "or use cargoLock.lockFile / importCargoLock instead."
+              echo
+
+              exit 1
+          fi
+
+          cargo vendor $name --respect-source-config | cargo-vendor-normalise > $CARGO_CONFIG
+
+          # Create an empty vendor directory when there is no dependency to vendor
+          mkdir -p $name
+          # Add the Cargo.lock to allow hash invalidation
+          cp Cargo.lock.orig $name/Cargo.lock
+
+          # Packages with git dependencies generate non-default cargo configs, so
+          # always install it rather than trying to write a standard default template.
+          install -D $CARGO_CONFIG $name/.cargo/config
+
+          runHook postBuild
+        '';
+
+        # Build a reproducible tar, per instructions at https://reproducible-builds.org/docs/archives/
+        installPhase = ''
+          tar --owner=0 --group=0 --numeric-owner --format=gnu \
+              --sort=name --mtime="@$SOURCE_DATE_EPOCH" \
+              -czf $out $name
+        '';
+
+        inherit (hash_) outputHashAlgo outputHash;
+
+        impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "NIX_CRATES_INDEX" ];
+      }
+      // (removeAttrs args removedArgs)
+    )
+  )