diff --git a/core/src/main/resources/lib/form/readOnlyTextbox.jelly b/core/src/main/resources/lib/form/readOnlyTextbox.jelly
index badcfd3228e7..91666470a46a 100644
--- a/core/src/main/resources/lib/form/readOnlyTextbox.jelly
+++ b/core/src/main/resources/lib/form/readOnlyTextbox.jelly
@@ -62,6 +62,20 @@ THE SOFTWARE.
       If @field is specified, this will be inferred automatically,
       which is the recommended approach.
     </st:attribute>
+    <st:attribute name="onchange" deprecated="true">
+      Inline JavaScript to execute when the textbox is changed.
+      Deprecated because this attribute is incompatible with adding Content-Security-Policy to the Jenkins UI in the future.
+      Set 'id' or 'clazz' attributes as appropriate to look up this element in external Javascript files (e.g. adjuncts)
+      to add the desired behavior there (DOMContentLoaded event in static forms, Behaviour.specify if this element may be
+      dynamically added). See https://github.com/jenkinsci/jenkins/pull/6852 for an example.
+    </st:attribute>
+    <st:attribute name="onkeyup" deprecated="true">
+      Inline JavaScript to execute when the keyup event is fired.
+      Deprecated because this attribute is incompatible with adding Content-Security-Policy to the Jenkins UI in the future.
+      Set 'id' or 'clazz' attributes as appropriate to look up this element in external Javascript files (e.g. adjuncts)
+      to add the desired behavior there (DOMContentLoaded event in static forms, Behaviour.specify if this element may be
+      dynamically added). See https://github.com/jenkinsci/jenkins/pull/6852 for an example.
+    </st:attribute>
   </st:documentation>
   <f:prepareDatabinding />
   <input class="jenkins-input ${attrs.checkUrl!=null?'validated':''} ${attrs.clazz}"