diff --git a/pkgs/by-name/ka/kanidm/1_3.nix b/pkgs/by-name/ka/kanidm/1_3.nix
deleted file mode 100644
index f0f708eba357..000000000000
--- a/pkgs/by-name/ka/kanidm/1_3.nix
+++ /dev/null
@@ -1,16 +0,0 @@
-import ./generic.nix {
-  version = "1.3.3";
-  hash = "sha256-W5G7osV4du6w/BfyY9YrDzorcLNizRsoz70RMfO2AbY=";
-  cargoHash = "sha256-QgEoeXjGm7fhPnJBbquWJYDYPg+Uv1IjZnaI5yUEYlQ=";
-  patchDir = ./patches/1_3;
-  extraMeta = {
-    knownVulnerabilities = [
-      ''
-        kanidm 1.3.x has reached EOL as of 2024-12-01.
-
-        Please upgrade by verifying `kanidmd domain upgrade-check` and setting `services.kanidm.package = pkgs.kanidm_1_4;`
-        See upgrade guide at https://kanidm.github.io/kanidm/master/server_updates.html
-      ''
-    ];
-  };
-}
diff --git a/pkgs/by-name/ka/kanidm/1_4.nix b/pkgs/by-name/ka/kanidm/1_4.nix
index a87b8eb4f11e..da046ce65626 100644
--- a/pkgs/by-name/ka/kanidm/1_4.nix
+++ b/pkgs/by-name/ka/kanidm/1_4.nix
@@ -3,4 +3,5 @@ import ./generic.nix {
   hash = "sha256-pjJyq52wO5p34LN2Jmt0npgWBDcWin8gIX4skZ7Ff8E=";
   cargoHash = "sha256-33HRoH/vWPe/wOZJtQLWV9eBocbj0iR/XUu4zMehu8M=";
   patchDir = ./patches/1_4;
+  unsupported = true;
 }
diff --git a/pkgs/by-name/ka/kanidm/README.md b/pkgs/by-name/ka/kanidm/README.md
index 34a354596218..30e751fe8166 100644
--- a/pkgs/by-name/ka/kanidm/README.md
+++ b/pkgs/by-name/ka/kanidm/README.md
@@ -40,8 +40,10 @@ For example, when upgrading from 1.4 -> 1.5
 
 Kanidm versions are supported for 30 days after the release of new versions. Following the example above, 1.5.x superseding 1.4.x in 30 days, do the following near the end of the 30 day window
 
-1. Update `pkgs/top-level/release.nix` and add `kanidm_1_4-1.4.6` to `permittedInsecurePackages`
-1. Update `pkgs/top-level/release.nix` and remove `kanidm_1_3-1.3.3` from `permittedInsecurePackages`
-1. Remove the third oldest release from `all-packages.nix`, e.g. 1.3.x continuing the example. Remove `kanidm_1_3` and `kanidmWithSecretProvisioning_1_3`
 1. Update `pkgs/by-name/ka/kanidm/1_4.nix` by adding `unsupported = true;`
-1. Open a PR and backport it to stable
+1. Update `pkgs/top-level/release.nix` and add `kanidm_1_4-1.4.6` to `permittedInsecurePackages`
+1. Create commit `kanidm_1_4: mark EOL`, this commit alone should be backported
+
+1. Remove the third oldest release from `all-packages.nix`, e.g. 1.3.x continuing the example. Remove `kanidm_1_3` and `kanidmWithSecretProvisioning_1_3`
+1. Update `pkgs/top-level/release.nix` and remove `kanidm_1_3-1.3.3` from `permittedInsecurePackages`
+1. Remove `pkgs/by-name/ka/kanidm/1_3.nix`
diff --git a/pkgs/by-name/ka/kanidm/generic.nix b/pkgs/by-name/ka/kanidm/generic.nix
index ddaaba190fff..9b9a95df57c3 100644
--- a/pkgs/by-name/ka/kanidm/generic.nix
+++ b/pkgs/by-name/ka/kanidm/generic.nix
@@ -144,7 +144,7 @@ rustPlatform.buildRustPackage rec {
       # avoid spurious releases and tags such as "debs"
       extraArgs = [
         "-vr"
-        "v(.*)"
+        "v([0-9\\.]*)"
         "--override-filename"
         "pkgs/by-name/ka/kanidm/${
           builtins.replaceStrings [ "." ] [ "_" ] (lib.versions.majorMinor kanidm.version)
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 07c6c8fe5a02..dd71f271ab5d 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -708,6 +708,7 @@ mapAliases {
   kube3d = k3d; # Added 2022-0705
   kafkacat = throw "'kafkacat' has been renamed to/replaced by 'kcat'"; # Converted to throw 2024-10-17
   kak-lsp = kakoune-lsp; # Added 2024-04-01
+  kanidm_1_3 = throw "'kanidm_1_3' has been removed as it has reached end of life"; # Added 2025-03-10
   kdbplus = throw "'kdbplus' has been removed from nixpkgs"; # Added 2024-05-06
   kdeconnect = throw "'kdeconnect' has been renamed to/replaced by 'plasma5Packages.kdeconnect-kde'"; # Converted to throw 2024-10-17
   keepkey_agent = keepkey-agent; # added 2024-01-06
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0c29393bed25..3e8430c75d91 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11287,16 +11287,11 @@ with pkgs;
 
   jitsi-videobridge = callPackage ../servers/jitsi-videobridge { };
 
-  kanidm_1_3 = callPackage ../by-name/ka/kanidm/1_3.nix { };
   kanidm_1_4 = callPackage ../by-name/ka/kanidm/1_4.nix { };
   kanidm_1_5 = callPackage ../by-name/ka/kanidm/1_5.nix { };
 
   kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_5;
 
-  kanidmWithSecretProvisioning_1_3 = callPackage ../by-name/ka/kanidm/1_3.nix {
-    enableSecretProvisioning = true;
-  };
-
   kanidmWithSecretProvisioning_1_4 = callPackage ../by-name/ka/kanidm/1_4.nix {
     enableSecretProvisioning = true;
   };
diff --git a/pkgs/top-level/release.nix b/pkgs/top-level/release.nix
index 97e64f73c510..2e5b64ac383a 100644
--- a/pkgs/top-level/release.nix
+++ b/pkgs/top-level/release.nix
@@ -36,7 +36,7 @@
       # so users choosing to allow don't have to rebuild them every time.
       permittedInsecurePackages = [
         "olm-3.2.16" # see PR #347899
-        "kanidm_1_3-1.3.3"
+        "kanidm_1_4-1.4.6"
       ];
     };