diff --git a/daemon/lua/trust_anchors.lua.in b/daemon/lua/trust_anchors.lua.in
index d17b20df765ebbbac24ced7ff54b57b407ae8169..e2ba3bc9f00979b6f1e76daec56b3bc6b1708138 100644
--- a/daemon/lua/trust_anchors.lua.in
+++ b/daemon/lua/trust_anchors.lua.in
@@ -11,8 +11,13 @@ local key_state = {
 	Missing = 'Missing', Revoked = 'Revoked', Removed = 'Removed'
 }
 
-local function upgrade_required()
-	panic('Configuration upgrade required! Please refer to ' ..
+local function upgrade_required(msg)
+	if msg then
+		msg = msg .. '\n'
+	else
+		msg = ''
+	end
+	panic('Configuration upgrade required: ' .. msg .. 'Please refer to ' ..
 		'https://knot-resolver.readthedocs.io/en/stable/upgrading.html')
 end
 
@@ -436,7 +441,7 @@ trust_anchors = {
 	-- Load keys from a file, 5011-managed by default.
 	-- If managed and the file doesn't exist, try bootstrapping the root into it.
 	add_file = add_file,
-	config = upgrade_required,
+	config = function() upgrade_required('trust_anchors.config was removed, see add_file()') end,
 	remove = remove,
 
 	keyset_publish = keyset_publish,
@@ -521,9 +526,12 @@ trust_anchors = {
 -- Syntactic sugar for TA store
 setmetatable(trust_anchors, {
        __newindex = function (t,k,v)
-       if     k == 'file' then upgrade_required()
-       elseif k == 'negative' then upgrade_required()
-       elseif k == 'keyfile_default' then upgrade_required()
+       if     k == 'file' then
+	       upgrade_required('trust_anchors.file was removed, see add_file()')
+       elseif k == 'negative' then
+	       upgrade_required('trust_anchors.negative was removed, see set_insecure()')
+       elseif k == 'keyfile_default' then
+	       upgrade_required('trust_anchors.keyfile_default is now compiled in, see trust_anchors.remove()')
        else   rawset(t, k, v) end
        end,
 })