diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index 0b02ac2f8337..7decf27c018d 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -51,6 +51,8 @@
 
 - `zerofs` has been updated from `1.x` to `2.x` which is a breaking change. Volumes created by earlier releases are refused at open with a clear error. There is no migration tool; older volumes remain readable and writable by the release that created them.
 
+- `keycloak.plugins.keycloak-metrics-spi` has been removed. Keycloak exposes Prometheus metrics natively on its management interface; enable them with the `metrics-enabled` setting (and `event-metrics-user-enabled` for login and event counters). See [Gaining insights with metrics](https://www.keycloak.org/observability/configuration-metrics).
+
 - `alps` has been rewritten upstream, see [upstream repository](https://github.com/migadu/alps) for documentation.
 
 - `uhttpmock` providing 0.0 ABI was removed. `uhttpmock_1_0` providing 1.0 ABI was renamed to `uhttpmock` and `uhttpmock_1_0` was kept as an alias.
diff --git a/nixos/tests/keycloak.nix b/nixos/tests/keycloak.nix
index 28b47661f3d8..8c5227dd443e 100644
--- a/nixos/tests/keycloak.nix
+++ b/nixos/tests/keycloak.nix
@@ -38,6 +38,7 @@ let
                 enable = true;
                 settings = {
                   hostname = certs.domain;
+                  metrics-enabled = true;
                 };
                 inherit initialAdminPassword;
                 sslCertificate = "${certs.${certs.domain}.cert}";
@@ -50,7 +51,6 @@ let
                 };
                 plugins = with config.services.keycloak.package.plugins; [
                   keycloak-discord
-                  keycloak-metrics-spi
                 ];
               };
               environment.systemPackages = with pkgs; [
@@ -131,13 +131,7 @@ let
                      | jq -r '"Authorization: bearer " + .access_token' >admin_auth_header
             """)
 
-            # Register the metrics SPI
-            keycloak.succeed(
-                """${pkgs.jre}/bin/keytool -import -alias snakeoil -file ${certs.ca.cert} -storepass aaaaaa -keystore cacert.jks -noprompt""",
-                """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh config credentials --server '${frontendUrl}' --realm master --user admin --password "$(<${adminPasswordFile})" """,
-                """KC_OPTS='-Djavax.net.ssl.trustStore=cacert.jks -Djavax.net.ssl.trustStorePassword=aaaaaa' kcadm.sh update events/config -s 'eventsEnabled=true' -s 'adminEventsEnabled=true' -s 'eventsListeners+=metrics-listener'""",
-                """curl -sSf '${frontendUrl}/realms/master/metrics' | grep '^keycloak_admin_event_UPDATE'"""
-            )
+            keycloak.succeed("curl -sSf https://${certs.domain}:9000/metrics | grep '^jvm_'")
 
             # Publish the realm, including a test OIDC client and user
             keycloak.succeed(
diff --git a/pkgs/by-name/ke/keycloak/all-plugins.nix b/pkgs/by-name/ke/keycloak/all-plugins.nix
index 5e36541557b5..183ed6657613 100644
--- a/pkgs/by-name/ke/keycloak/all-plugins.nix
+++ b/pkgs/by-name/ke/keycloak/all-plugins.nix
@@ -1,4 +1,6 @@
 {
+  lib,
+  config,
   callPackage,
   fetchMavenArtifact,
   junixsocket-common,
@@ -9,7 +11,6 @@
   keycloak-discord = callPackage ./keycloak-discord { };
   keycloak-enforce-mfa-authenticator = callPackage ./keycloak-enforce-mfa-authenticator { };
   keycloak-magic-link = callPackage ./keycloak-magic-link { };
-  keycloak-metrics-spi = callPackage ./keycloak-metrics-spi { };
   keycloak-orgs = callPackage ./keycloak-orgs { };
   keycloak-remember-me-authenticator = callPackage ./keycloak-remember-me-authenticator { };
   keycloak-restrict-client-auth = callPackage ./keycloak-restrict-client-auth { };
@@ -40,3 +41,6 @@
       hash = "sha256-xHxzBxriSd/OU8gEcDG00VRkJYPYJDfAfPh/FkQe+zg=";
     }).passthru.jar;
 }
+// lib.optionalAttrs config.allowAliases {
+  keycloak-metrics-spi = throw "keycloak.plugins.keycloak-metrics-spi has been removed in favor of Keycloak's native metrics."; # Added 2026-07-14
+}
diff --git a/pkgs/by-name/ke/keycloak/keycloak-metrics-spi/default.nix b/pkgs/by-name/ke/keycloak/keycloak-metrics-spi/default.nix
deleted file mode 100644
index 7ae12fc8023a..000000000000
--- a/pkgs/by-name/ke/keycloak/keycloak-metrics-spi/default.nix
+++ /dev/null
@@ -1,45 +0,0 @@
-{
-  maven,
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-maven.buildMavenPackage rec {
-  pname = "keycloak-metrics-spi";
-  version = "7.0.0";
-
-  src = fetchFromGitHub {
-    owner = "aerogear";
-    repo = "keycloak-metrics-spi";
-    tag = version;
-    hash = "sha256-C6ueYhSMVMGpjHF5QQj9jfaS9sGTZ3wKZq2xmNgTmAg=";
-  };
-
-  mvnHash =
-    let
-      mvnHashes = {
-        "aarch64-darwin" = "sha256-L+LVJGBVhkaWOdXpHep9f2s7hLr3enf5POm8U+Y7I1w=";
-        "x86_64-darwin" = "sha256-G/e0mgAGP+6zvX3b0EuI95bdLT7Bzwh1GgcAfxzsIhE=";
-        "aarch64-linux" = "sha256-Nrs+gqRYPKXWRr0COAsKmOrNaza2fxhEAJ5x896tKvA=";
-        "x86_64-linux" = "sha256-oHMkzXHR4mETH6VsxhFuap3AcjvTXytNkKlLY/mzT3g=";
-      };
-    in
-    mvnHashes.${stdenv.hostPlatform.system}
-      or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  installPhase = ''
-    runHook preInstall
-    install -Dm444 -t "$out" target/keycloak-metrics-spi-*.jar
-    runHook postInstall
-  '';
-
-  meta = {
-    homepage = "https://github.com/aerogear/keycloak-metrics-spi";
-    description = "Keycloak Service Provider that adds a metrics endpoint";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      benley
-      anish
-    ];
-  };
-}