diff --git a/pkgs/os-specific/linux/fscryptctl/legacy.nix b/pkgs/os-specific/linux/fscryptctl/legacy.nix
deleted file mode 100644
index 64a409fb58bf..000000000000
--- a/pkgs/os-specific/linux/fscryptctl/legacy.nix
+++ /dev/null
@@ -1,51 +0,0 @@
-{ lib, stdenv, fetchFromGitHub }:
-
-# Don't use this for anything important!
-# TODO: Drop fscryptctl-experimental after the NixOS 21.03/21.05 release.
-
-stdenv.mkDerivation rec {
-  pname = "fscryptctl";
-  version = "0.1.0";
-
-  goPackagePath = "github.com/google/fscrypt";
-
-  src = fetchFromGitHub {
-    owner = "google";
-    repo = "fscryptctl";
-    rev = "v${version}";
-    sha256 = "1853hlpklisbqnkb7a921dsf0vp2nr2im26zpmrs592cnpsvk3hb";
-  };
-
-  makeFlags = [ "DESTDIR=$(out)/bin" ];
-
-  meta = with lib; {
-    description = "Small C tool for Linux filesystem encryption";
-    longDescription = ''
-      fscryptctl is a low-level tool written in C that handles raw keys and
-      manages policies for Linux filesystem encryption, specifically the
-      "fscrypt" kernel interface which is supported by the ext4, f2fs, and
-      UBIFS filesystems.
-      fscryptctl is mainly intended for embedded systems which can't use the
-      full-featured fscrypt tool, or for testing or experimenting with the
-      kernel interface to Linux filesystem encryption. fscryptctl does not
-      handle key generation, key stretching, key wrapping, or PAM integration.
-      Most users should use the fscrypt tool instead, which supports these
-      features and generally is much easier to use.
-      As fscryptctl is intended for advanced users, you should read the kernel
-      documentation for filesystem encryption before using fscryptctl.
-    '';
-    inherit (src.meta) homepage;
-    license = licenses.asl20;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ primeos ];
-    knownVulnerabilities = [ ''
-      fscryptctl version 1.0.0 was released and now uses v2 encryption
-      policies. fscryptctl-experimental will remain at version 0.1.0 which
-      still supports the v1 encryption policies. Please try to switch from the
-      "fscryptctl-experimental" package to "fscryptctl". The v1 encryption
-      policies can be insecure, are hard to use correctly, and have different
-      semantics from v2 policies (which is why they are no longer supported in
-      fscryptctl 1.0.0+).
-    '' ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 38189f6ae296..388da7860a17 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -267,6 +267,7 @@ mapAliases ({
     and has only been used for old fontconfig caches.
   '';
   foomatic_filters = foomatic-filters;  # 2016-08
+  fscryptctl-experimental = throw "The package fscryptctl-experimental has been removed. Please switch to fscryptctl."; # 2021-11-07
   fsharp41 = throw "fsharp41 has been removed, please use dotnet-sdk_5 or later";
   fuse_exfat = exfat;                   # 2015-09-11
   fuseki = apache-jena-fuseki; # added 2018-04-25
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c904707b7cf3..8acbcd88d7d5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -21739,7 +21739,6 @@ with pkgs;
   fscryptctl = callPackage ../os-specific/linux/fscryptctl { };
   # unstable until the first 1.x release
   fscrypt-experimental = callPackage ../os-specific/linux/fscrypt { };
-  fscryptctl-experimental = callPackage ../os-specific/linux/fscryptctl/legacy.nix { };
 
   fwanalyzer = callPackage ../tools/filesystems/fwanalyzer { };