diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index e9def64cc19a..c1f5b33aceb6 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -180,6 +180,18 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `easytier` has been updated to 2.7.0 and is stricter about its configuration:
+
+  - [`services.easytier.instances.<name>.configServer`](#opt-services.easytier.instances._name_.configServer)
+    requires a full URL such as `udp://example.com:22020/<token>`; the bare
+    `<token>` shorthand for the official server was removed.
+  - The WireGuard portal no longer accepts `client_cidr` or `wg://host:port/CIDR`.
+    Set `wireguard_private_key` and list the clients under
+    `vpn_portal_config.clients` with a `virtual_ip` each.
+  - Unknown keys in the `[flags]` table are rejected instead of being ignored, so
+    a stale flag now stops the instance with `failed to parse flags`
+    ([upstream #2670](https://github.com/EasyTier/EasyTier/issues/2670)).
+
 - `services.music-assistant` no longer ships the service API credentials that upstream bundles
   only in its official release builds. Providers that rely on them (`spotify`, `qobuz`,
   `apple_music`, `theaudiodb`, `fanarttv`) no longer work out of the box. Register your own
diff --git a/nixos/modules/services/networking/easytier.nix b/nixos/modules/services/networking/easytier.nix
index 127c72063fac..93325da2b18a 100644
--- a/nixos/modules/services/networking/easytier.nix
+++ b/nixos/modules/services/networking/easytier.nix
@@ -134,7 +134,8 @@ let
             except `hostname` will be ignored. Valid formats are:
 
             - full uri for custom server: `udp://example.com:22020/<token>`
-            - username only for official server: `<token>`
+
+            Since 2.7.0 a full URL is required; a bare `<token>` is rejected.
           '';
           example = "udp://example.com:22020/myusername";
         };
diff --git a/pkgs/by-name/ea/easytier/service.nix b/pkgs/by-name/ea/easytier/service.nix
index e5cf1cfcbfc8..29fdee02c6e3 100644
--- a/pkgs/by-name/ea/easytier/service.nix
+++ b/pkgs/by-name/ea/easytier/service.nix
@@ -50,7 +50,8 @@ in
           except {option}`easytier.settings.hostname` will be ignored. Valid formats are:
 
           - full uri for custom server: `udp://example.com:22020/<token>`
-          - username only for official server: `<token>`
+
+          Since 2.7.0 a full URL is required; a bare `<token>` is rejected.
         '';
         example = "udp://example.com:22020/myusername";
       };