diff --git a/solr/CHANGES.txt b/solr/CHANGES.txt
index 85a375a07f2..e332efe7bea 100644
--- a/solr/CHANGES.txt
+++ b/solr/CHANGES.txt
@@ -107,6 +107,8 @@ Bug Fixes
 
 * SOLR-17574: Fix AllowListUrlChecker when liveNodes changes. Remove ClusterState.getHostAllowList (Bruno Roustant, David Smiley)
 
+* SOLR-17586: Print zkcli.sh deprecation msg to stderr, which fixes Solr Operator upload of security.json to zookeeper (Jan Høydahl)
+
 Dependency Upgrades
 ---------------------
 (No changes)
diff --git a/solr/core/src/java/org/apache/solr/cli/SolrCLI.java b/solr/core/src/java/org/apache/solr/cli/SolrCLI.java
index 090339e2382..14b637e8e18 100755
--- a/solr/core/src/java/org/apache/solr/cli/SolrCLI.java
+++ b/solr/core/src/java/org/apache/solr/cli/SolrCLI.java
@@ -450,7 +450,7 @@ public static String getOptionWithDeprecatedAndDefault(
 
   // TODO: SOLR-17429 - remove the custom logic when Commons CLI is upgraded and
   // makes stderr the default, or makes Option.toDeprecatedString() public.
-  private static void deprecatedHandlerStdErr(Option o) {
+  public static void deprecatedHandlerStdErr(Option o) {
     // Deprecated options without a description act as "stealth" options
     if (o.isDeprecated() && !o.getDeprecated().getDescription().isBlank()) {
       final StringBuilder buf =
diff --git a/solr/core/src/java/org/apache/solr/cloud/ZkCLI.java b/solr/core/src/java/org/apache/solr/cloud/ZkCLI.java
index 6b67fc76360..4e9906f5217 100644
--- a/solr/core/src/java/org/apache/solr/cloud/ZkCLI.java
+++ b/solr/core/src/java/org/apache/solr/cloud/ZkCLI.java
@@ -36,12 +36,12 @@
 import javax.xml.parsers.ParserConfigurationException;
 import org.apache.commons.cli.CommandLine;
 import org.apache.commons.cli.CommandLineParser;
+import org.apache.commons.cli.DefaultParser;
 import org.apache.commons.cli.DeprecatedAttributes;
 import org.apache.commons.cli.HelpFormatter;
 import org.apache.commons.cli.Option;
 import org.apache.commons.cli.Options;
 import org.apache.commons.cli.ParseException;
-import org.apache.commons.cli.PosixParser;
 import org.apache.solr.cli.CLIO;
 import org.apache.solr.cli.SolrCLI;
 import org.apache.solr.client.solrj.impl.SolrZkClientTimeout;
@@ -159,7 +159,11 @@ public static void main(String[] args)
           SAXException,
           KeeperException {
 
-    CommandLineParser parser = new PosixParser();
+    CommandLineParser parser =
+        DefaultParser.builder()
+            // Override deprecation handler since the default one prints to stdout, we want stderr
+            .setDeprecatedHandler(SolrCLI::deprecatedHandlerStdErr)
+            .build();
     Options options = new Options();
 
     Option cmdOption =
diff --git a/solr/server/scripts/cloud-scripts/zkcli.sh b/solr/server/scripts/cloud-scripts/zkcli.sh
index c9dd7a50b66..197ee57b252 100755
--- a/solr/server/scripts/cloud-scripts/zkcli.sh
+++ b/solr/server/scripts/cloud-scripts/zkcli.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-echo "WARNING: The zkcli.sh script has been deprecated in favour of the bin/solr equivalent commands."
+>&2 echo "WARNING: The zkcli.sh script has been deprecated in favour of the bin/solr equivalent commands."
 
 # You can override pass the following parameters to this script:
 #