diff --git a/ext/session/php_session.h b/ext/session/php_session.h
index ee36eb291e52..65192816faff 100644
--- a/ext/session/php_session.h
+++ b/ext/session/php_session.h
@@ -251,8 +251,8 @@ PHPAPI php_session_status php_get_session_status(void);
 PHPAPI const ps_module *_php_find_ps_module(const char *name);
 PHPAPI const ps_serializer *_php_find_ps_serializer(const char *name);
 
-PHPAPI zend_result php_session_valid_key(const char *key);
-zend_result php_session_valid_key_ex(const zend_string *key);
+PHPAPI ZEND_ATTRIBUTE_DEPRECATED zend_result php_session_valid_key(const char *key);
+PHPAPI zend_result php_session_valid_key_ex(const zend_string *key);
 PHPAPI zend_result php_session_reset_id(void);
 
 /* Do not use a return statement in `code` because that may leak memory.
diff --git a/ext/session/session.c b/ext/session/session.c
index 702b56020ae9..91658ed75f73 100644
--- a/ext/session/session.c
+++ b/ext/session/session.c
@@ -388,14 +388,14 @@ static zend_result php_session_valid_key_len(const char *key, size_t key_len)
 }
 
 /* Validate the full zend_string, including embedded NUL bytes. */
-zend_result php_session_valid_key_ex(const zend_string *key)
+PHPAPI zend_result php_session_valid_key_ex(const zend_string *key)
 {
 	return php_session_valid_key_len(ZSTR_VAL(key), ZSTR_LEN(key));
 }
 
 /* C-string compatibility wrapper. Callers that have a zend_string should use
  * php_session_valid_key_ex() instead. */
-PHPAPI zend_result php_session_valid_key(const char *key)
+PHPAPI ZEND_ATTRIBUTE_DEPRECATED zend_result php_session_valid_key(const char *key)
 {
 	return php_session_valid_key_len(key, strlen(key));
 }