diff --git a/src/config/deprecatedFields.ts b/src/config/deprecatedFields.ts
new file mode 100644
index 000000000..972550166
--- /dev/null
+++ b/src/config/deprecatedFields.ts
@@ -0,0 +1,41 @@
+/**
+ * Copyright 2026 GitProxy Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { GitProxyConfig } from './generated/config';
+
+/**
+ * Returns deprecation warnings for legacy top-level config keys in user overrides.
+ * PR 3.0 (#1545) will replace warnings with startup failure for legacy-only configs.
+ */
+export function getDeprecatedConfigWarnings(userSettings: Partial<GitProxyConfig>): string[] {
+  const warnings: string[] = [];
+
+  if (userSettings.sslKeyPemPath?.trim() && !userSettings.tls?.key?.trim()) {
+    warnings.push('"sslKeyPemPath" is deprecated; use "tls.key" instead (removal in GitProxy 3.0)');
+  }
+
+  if (userSettings.sslCertPemPath?.trim() && !userSettings.tls?.cert?.trim()) {
+    warnings.push(
+      '"sslCertPemPath" is deprecated; use "tls.cert" instead (removal in GitProxy 3.0)',
+    );
+  }
+
+  if (typeof userSettings.proxyUrl === 'string' && userSettings.proxyUrl.trim() !== '') {
+    warnings.push('"proxyUrl" is deprecated and ignored; remove it before GitProxy 3.0');
+  }
+
+  return warnings;
+}
diff --git a/src/config/index.ts b/src/config/index.ts
index 792062863..a991fe35d 100644
--- a/src/config/index.ts
+++ b/src/config/index.ts
@@ -24,6 +24,7 @@ import { serverConfig } from './env';
 import { getConfigFile } from './file';
 import { GIGABYTE } from '../constants';
 import { validateConfig } from './validators';
+import { getDeprecatedConfigWarnings } from './deprecatedFields';
 import { handleErrorAndLog, handleErrorAndThrow } from '../utils/errors';
 
 export { setConfigFile, getConfigFile, validate } from './file';
@@ -158,6 +159,10 @@ function loadFullConfiguration(): FullGitProxyConfig {
     }
   }
 
+  for (const message of getDeprecatedConfigWarnings(userSettings)) {
+    console.warn(message);
+  }
+
   _currentConfig = mergeConfigurations(defaultConfig, userSettings);
 
   if (!validateConfig(_currentConfig)) {
diff --git a/test/deprecatedFields.test.ts b/test/deprecatedFields.test.ts
new file mode 100644
index 000000000..aee06fcef
--- /dev/null
+++ b/test/deprecatedFields.test.ts
@@ -0,0 +1,44 @@
+/**
+ * Copyright 2026 GitProxy Contributors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { describe, it, expect } from 'vitest';
+import { getDeprecatedConfigWarnings } from '../src/config/deprecatedFields';
+
+describe('getDeprecatedConfigWarnings', () => {
+  it('returns warnings for legacy TLS-only user config', () => {
+    const warnings = getDeprecatedConfigWarnings({
+      sslKeyPemPath: 'key.pem',
+      sslCertPemPath: 'cert.pem',
+    });
+
+    expect(warnings).toHaveLength(2);
+    expect(warnings).toContain(
+      '"sslKeyPemPath" is deprecated; use "tls.key" instead (removal in GitProxy 3.0)',
+    );
+    expect(warnings).toContain(
+      '"sslCertPemPath" is deprecated; use "tls.cert" instead (removal in GitProxy 3.0)',
+    );
+  });
+
+  it('returns no warnings for non-deprecated overrides', () => {
+    expect(getDeprecatedConfigWarnings({ uiPort: 9000 })).toEqual([]);
+    expect(
+      getDeprecatedConfigWarnings({
+        tls: { enabled: true, key: 'k.pem', cert: 'c.pem' },
+      }),
+    ).toEqual([]);
+  });
+});