diff --git a/keystone/conf/trust.py b/keystone/conf/trust.py
index 1c1067f522..17f59ce637 100644
--- a/keystone/conf/trust.py
+++ b/keystone/conf/trust.py
@@ -11,6 +11,7 @@
 # under the License.
 
 from oslo_config import cfg
+from oslo_log import versionutils
 
 from keystone.conf import utils
 
@@ -18,6 +19,12 @@ from keystone.conf import utils
 enabled = cfg.BoolOpt(
     'enabled',
     default=True,
+    deprecated_for_removal=True,
+    deprecated_reason=utils.fmt("""
+Disabling the trusts API is deprecated. This option will be removed in the
+next release and trusts will always be enabled.
+"""),
+    deprecated_since=versionutils.deprecated.QUEENS,
     help=utils.fmt("""
 Delegation and impersonation features using trusts can be optionally disabled.
 """))
diff --git a/releasenotes/notes/deprecated-as-of-queens-8ad7f826e4f08f57.yaml b/releasenotes/notes/deprecated-as-of-queens-8ad7f826e4f08f57.yaml
index 3beed0b25f..643a560f3d 100644
--- a/releasenotes/notes/deprecated-as-of-queens-8ad7f826e4f08f57.yaml
+++ b/releasenotes/notes/deprecated-as-of-queens-8ad7f826e4f08f57.yaml
@@ -15,3 +15,6 @@ deprecations:
     role. This option is deprecated and will be removed in the S release. If
     you are depending on having a predictable role name and ID for this member
     role you will need to update your tooling.
+  - >
+    The ``enabled`` config option of the ``trust`` feature is deprecated and
+    will be removed in the next release. Trusts will then always be enabled.