diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 5148a686195d..d97befde2881 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -328,6 +328,8 @@
 
 - The [bazarr](#opt-services.bazarr.enable) systemd service has been security hardened. If you are storing/accessing data in `/home`, you will need to adjust the `ProtectHome` option.
 
+- For security reasons, wrapped programs in `security.wrappers` are now required to be ELF executables.
+
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
 - `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.
diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 941a99323f9b..7d1c24674d09 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -60,7 +60,10 @@ let
       };
       options.source = lib.mkOption {
         type = lib.types.path;
-        description = "The absolute path to the program to be wrapped.";
+        description = ''
+          The absolute path to the program to be wrapped.
+          This must be an ELF executable.
+        '';
       };
       options.program = lib.mkOption {
         type = with lib.types; nullOr str;
@@ -234,7 +237,8 @@ in
         This option effectively allows adding setuid/setgid bits, capabilities,
         changing file ownership and permissions of a program without directly
         modifying it. This works by creating a wrapper program in a directory
-        (not configurable), which is then added to the shell `PATH`.
+        (not configurable), which is then added to the shell `PATH`. Source
+        programs are required to be ELF executables.
       '';
     };