diff --git a/doc/userguide/configuration/suricata-yaml.rst b/doc/userguide/configuration/suricata-yaml.rst
index c0f6e493da..b04423c575 100644
--- a/doc/userguide/configuration/suricata-yaml.rst
+++ b/doc/userguide/configuration/suricata-yaml.rst
@@ -2858,8 +2858,8 @@ use of.
     vista: []
     windows2k3: []
 
-Suricata as a Firewall options (experimental)
----------------------------------------------
+Suricata as a Firewall options
+------------------------------
 
 It is possible to run Suricata as a firewall.
 Please read :ref:`Firewall Mode Design <firewall mode design>` before using this.
diff --git a/doc/userguide/firewall/firewall-design.rst b/doc/userguide/firewall/firewall-design.rst
index 681c51e57b..2d1dd7ecae 100644
--- a/doc/userguide/firewall/firewall-design.rst
+++ b/doc/userguide/firewall/firewall-design.rst
@@ -3,7 +3,7 @@
 Firewall Mode Design
 ********************
 
-.. note:: In Suricata 8 the firewall mode is experimental and subject to change.
+.. note:: Suricata firewall mode features and behavior are still subject to change.
 
 The firewall mode in Suricata allows the use of a ruleset that has different
 properties than the default "threat detection" rulesets:
diff --git a/doc/userguide/firewall/firewall-example.rst b/doc/userguide/firewall/firewall-example.rst
index e61a1919f3..0ccc22a974 100644
--- a/doc/userguide/firewall/firewall-example.rst
+++ b/doc/userguide/firewall/firewall-example.rst
@@ -1,8 +1,6 @@
 Firewall Ruleset Examples
 =========================
 
-.. note:: In Suricata 8 the firewall mode is experimental and subject to change.
-
 HTTP
 ----
 
diff --git a/doc/userguide/firewall/firewall-unsupported-keywords.rst b/doc/userguide/firewall/firewall-unsupported-keywords.rst
new file mode 100644
index 0000000000..0f26fc4235
--- /dev/null
+++ b/doc/userguide/firewall/firewall-unsupported-keywords.rst
@@ -0,0 +1,28 @@
+Firewall Mode Unsupported Keywords
+==================================
+
+Certain rule keywords are not supported in firewall mode, either completely or
+based on rulesets.
+
+A keyword may be unsupported in firewall rules, in threat detection rules, or in
+firewall mode altogether.
+
+This is done when there is a chance that the keyword would lead to the firewall
+verdict being skipped, contradicted, or when there could happen inconsistent
+states from interactions between firewall and threat detection rules matching.
+
+.. note:: Future releases may add support for such keywords where it makes sense.
+
+Unsupported Keywords
+--------------------
+
+Firewall Mode
+~~~~~~~~~~~~~
+
+* Bypass
+* Replace
+
+Threat Detection Rules
+~~~~~~~~~~~~~~~~~~~~~~
+
+* Config (both the ``config`` keyword and the ``config`` action)
diff --git a/doc/userguide/firewall/index.rst b/doc/userguide/firewall/index.rst
index 6b0d097c94..41ea6bea57 100644
--- a/doc/userguide/firewall/index.rst
+++ b/doc/userguide/firewall/index.rst
@@ -8,3 +8,4 @@ Firewall Mode
    firewall-stats
    tls-state-migration
    ssh-state-migration
+   firewall-unsupported-keywords
diff --git a/src/suricata.c b/src/suricata.c
index e9a377421d..5b59d83aa7 100644
--- a/src/suricata.c
+++ b/src/suricata.c
@@ -2832,7 +2832,6 @@ int PostConfLoadedSetup(SCInstance *suri)
         }
     }
     if (suri->is_firewall) {
-        SCLogWarning("firewall mode is EXPERIMENTAL and subject to change");
         EngineModeSetFirewall(g_engine_host_mode);
     }
 
diff --git a/suricata.yaml.in b/suricata.yaml.in
index 49c1df696c..f776c5cbfc 100644
--- a/suricata.yaml.in
+++ b/suricata.yaml.in
@@ -2383,7 +2383,7 @@ reference-config-file: @e_sysconfdir@reference.config
 # threshold-file: @e_sysconfdir@threshold.config
 
 ##
-## Suricata as a Firewall options (experimental)
+## Suricata as a Firewall options
 ##
 firewall:
   # toggle to enable firewall mode