diff --git a/core/src/main/java/hudson/PluginManager.java b/core/src/main/java/hudson/PluginManager.java
index c4dcaf1f2825..7e150290cba6 100644
--- a/core/src/main/java/hudson/PluginManager.java
+++ b/core/src/main/java/hudson/PluginManager.java
@@ -2501,13 +2501,27 @@ public boolean isPluginJar(URL jarUrl) {
     @SuppressFBWarnings(value = "MS_SHOULD_BE_FINAL", justification = "for script console")
     public static boolean FAST_LOOKUP = !SystemProperties.getBoolean(PluginManager.class.getName() + ".noFastLookup");
 
-    /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */
-    @Deprecated
-    public static final Permission UPLOAD_PLUGINS = new Permission(Jenkins.PERMISSIONS, "UploadPlugins", Messages._PluginManager_UploadPluginsPermission_Description(), Jenkins.ADMINISTER, PermissionScope.JENKINS);
-
-    /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */
-    @Deprecated
-    public static final Permission CONFIGURE_UPDATECENTER = new Permission(Jenkins.PERMISSIONS, "ConfigureUpdateCenter", Messages._PluginManager_ConfigureUpdateCenterPermission_Description(), Jenkins.ADMINISTER, PermissionScope.JENKINS);
+    /** To be removed: use {@link Jenkins#ADMINISTER} instead */
+    @Restricted(DoNotUse.class)
+    public static final Permission UPLOAD_PLUGINS =
+        new Permission(Jenkins.PERMISSIONS,
+                       "UploadPlugins",
+                       Messages._PluginManager_UploadPluginsPermission_Description(),
+                       null,
+                       false,
+                       new PermissionScope[] { PermissionScope.JENKINS }
+                       );
+
+    /** To be removed: use {@link Jenkins#ADMINISTER} instead */
+    @Restricted(DoNotUse.class)
+    public static final Permission CONFIGURE_UPDATECENTER =
+        new Permission(Jenkins.PERMISSIONS,
+                       "ConfigureUpdateCenter",
+                       Messages._PluginManager_ConfigureUpdateCenterPermission_Description(),
+                       null,
+                       false,
+                       new PermissionScope[] { PermissionScope.JENKINS }
+                       );
 
     /**
      * Remembers why a plugin failed to deploy.
diff --git a/core/src/main/java/jenkins/model/Jenkins.java b/core/src/main/java/jenkins/model/Jenkins.java
index 29a685a3e276..3e3a957d62da 100644
--- a/core/src/main/java/jenkins/model/Jenkins.java
+++ b/core/src/main/java/jenkins/model/Jenkins.java
@@ -5891,8 +5891,9 @@ public boolean shouldShowStackTrace() {
 
     public static final Permission READ = new Permission(PERMISSIONS, "Read", Messages._Hudson_ReadPermission_Description(), Permission.READ, PermissionScope.JENKINS);
     /** @deprecated in Jenkins 2.222 use {@link Jenkins#ADMINISTER} instead */
-    @Deprecated
-    public static final Permission RUN_SCRIPTS = new Permission(PERMISSIONS, "RunScripts", Messages._Hudson_RunScriptsPermission_Description(), ADMINISTER, PermissionScope.JENKINS);
+    @Deprecated(forRemoval = true)
+    @Restricted(DoNotUse.class)
+    public static final Permission RUN_SCRIPTS = new Permission(PERMISSIONS, "RunScripts", Messages._Hudson_RunScriptsPermission_Description(), null, false, new PermissionScope[] {PermissionScope.JENKINS});
 
     /**
      * Urls that are always visible without READ permission.
diff --git a/test/src/test/java/jenkins/model/JenkinsTest.java b/test/src/test/java/jenkins/model/JenkinsTest.java
index 6705323ad077..e2aead5d7a9a 100644
--- a/test/src/test/java/jenkins/model/JenkinsTest.java
+++ b/test/src/test/java/jenkins/model/JenkinsTest.java
@@ -392,8 +392,7 @@ void testDoScript() throws Exception {
         j.jenkins.setSecurityRealm(j.createDummySecurityRealm());
         j.jenkins.setAuthorizationStrategy(new MockAuthorizationStrategy().
             grant(Jenkins.ADMINISTER).everywhere().to("alice").
-            grant(Jenkins.READ).everywhere().to("bob").
-            grantWithoutImplication(Jenkins.RUN_SCRIPTS, Jenkins.READ).everywhere().to("charlie"));
+            grant(Jenkins.READ).everywhere().to("bob"));
         WebClient wc = j.createWebClient();
 
         wc.withBasicApiToken(User.getById("alice", true));
@@ -411,9 +410,6 @@ void testDoScript() throws Exception {
         wc.withBasicApiToken(User.getById("bob", true));
         wc.assertFails("script", HttpURLConnection.HTTP_FORBIDDEN);
 
-        //TODO: remove once RUN_SCRIPTS is finally retired
-        wc.withBasicApiToken(User.getById("charlie", true));
-        wc.assertFails("script", HttpURLConnection.HTTP_FORBIDDEN);
     }
 
     @Test