diff --git a/reference/session/ini.xml b/reference/session/ini.xml
index 0e97a646762d..5f27d4d5e3d4 100644
--- a/reference/session/ini.xml
+++ b/reference/session/ini.xml
@@ -164,13 +164,19 @@
      <entry><link linkend="ini.session.sid-length">session.sid_length</link></entry>
      <entry>"32"</entry>
      <entry><constant>INI_ALL</constant></entry>
-     <entry>Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0.</entry>
+     <entry>
+      Available as of PHP 7.1.0.
+      Changing this setting is deprecated as of PHP 8.4.0.
+     </entry>
     </row>
     <row>
      <entry><link linkend="ini.session.sid-bits-per-character">session.sid_bits_per_character</link></entry>
      <entry>"4"</entry>
      <entry><constant>INI_ALL</constant></entry>
-     <entry>Available as of PHP 7.1.0. Deprecated as of PHP 8.4.0.</entry>
+     <entry>
+      Available as of PHP 7.1.0.
+      Changing this setting is deprecated as of PHP 8.4.0.
+     </entry>
     </row>
     <row>
      <entry><link linkend="ini.session.upload-progress.enabled">session.upload_progress.enabled</link></entry>
@@ -858,12 +864,18 @@
       <literal>session.sid_bits_per_character</literal>, otherwise you
       will have weaker session ID.
      </para>
-    </tip> 
+    </tip>
     <note>
      <simpara>
-      This setting is introduced in PHP 7.1.0.
+      Available as of PHP 7.1.0.
      </simpara>
     </note>
+    <warning>
+     <simpara>
+      Changing <literal>session.sid_length</literal> from its default
+      value is deprecated as of PHP 8.4.0.
+     </simpara>
+    </warning>
    </listitem>
   </varlistentry>
 
@@ -882,13 +894,17 @@
      The default is 4. The more bits results in stronger session ID. 5 is
      recommended value for most environments.
     </simpara>
-    <para>
-    </para>
     <note>
      <simpara>
-      This setting is introduced in PHP 7.1.0.
+      Available as of PHP 7.1.0.
      </simpara>
     </note>
+    <warning>
+     <simpara>
+      Changing <literal>session.sid_bits_per_character</literal> from its
+      default value is deprecated as of PHP 8.4.0.
+     </simpara>
+    </warning>
    </listitem>
   </varlistentry>
 
diff --git a/reference/session/security.xml b/reference/session/security.xml
index ac1927417787..4ba422070090 100644
--- a/reference/session/security.xml
+++ b/reference/session/security.xml
@@ -649,12 +649,16 @@
      <para>
       <link linkend="ini.session.use-trans-sid">session.use_trans_sid</link>=Off
      </para>
-     <para>
-      Use of a transparent session ID management is not prohibited.
-      Developers may employ it when it is required.
-      However, disabling transparent session ID management improves the general session
+     <simpara>
+      Disabling transparent session ID management improves the general session
       ID security by eliminating the possibility of a session ID injection and/or leak.
-     </para>
+     </simpara>
+     <warning>
+      <simpara>
+       Enabling <link linkend="ini.session.use-trans-sid">session.use_trans_sid</link>
+       is deprecated as of PHP 8.4.0.
+      </simpara>
+     </warning>
      <note>
       <para>
        Session ID may leak from bookmarked URLs, e-mailed URLs, saved HTML source, etc.
@@ -672,6 +676,12 @@
       Older PHP versions use
       <link linkend="ini.url-rewriter.tags">url_rewriter.tags</link> instead.
      </para>
+     <warning>
+      <simpara>
+       Changing <link linkend="ini.session.trans-sid-tags">session.trans_sid_tags</link>
+       from its default value is deprecated as of PHP 8.4.0.
+      </simpara>
+     </warning>
     </listitem>
 
     <listitem>
@@ -684,24 +694,34 @@
       Session module only allows <literal>$_SERVER['HTTP_HOST']</literal>
       when this setting is empty.
      </para>
+     <warning>
+      <simpara>
+       Setting <link linkend="ini.session.trans-sid-hosts">session.trans_sid_hosts</link>
+       to a non-empty value is deprecated as of PHP 8.4.0.
+      </simpara>
+     </warning>
     </listitem>
 
     <listitem>
-     <para>
+     <simpara>
       <link linkend="ini.session.referer-check">session.referer_check</link>=[originating URL]
-     </para>
-     <para>
+     </simpara>
+     <simpara>
       When <link
       linkend="ini.session.use-trans-sid">session.use_trans_sid</link>
-      is enabled.
-      It reduces the risk of session ID injection.
+      is enabled, it reduces the risk of session ID injection.
       If a website is <literal>http://example.com/</literal>,
       set <literal>http://example.com/</literal> to it.
       Note that with HTTPS browsers will not send the referrer header.
       Browsers may not send the referrer header by configuration.
       Therefore, this setting is not a reliable security measure.
-      Use of this setting is recommended.
-     </para>
+     </simpara>
+     <warning>
+      <simpara>
+       Setting <link linkend="ini.session.referer-check">session.referer_check</link>
+       to a non-empty value is deprecated as of PHP 8.4.0.
+      </simpara>
+     </warning>
     </listitem>
 
     <listitem>
@@ -721,20 +741,6 @@
      </para>
     </listitem>
 
-    <listitem>
-     <para>
-      <link linkend="ini.session.hash-function">session.hash_function</link>="sha256"
-     </para>
-     <para>
-      (PHP 7.1.0 &lt;) A stronger hash function will generate a stronger session ID.
-      Although hash collision is unlikely even with the MD5 hashing algorithm,
-      developers should use SHA-2 or a stronger hashing algorithm like sha384 and sha512.
-      Developers must ensure they feed a long enough
-      <link linkend="ini.session.entropy-length">entropy</link>
-      for the hashing function used.
-     </para>
-    </listitem>
-
     <listitem>
      <para>
       <link linkend="ini.session.save-path">session.save_path</link>=[non world-readable directory]