diff --git a/composer.json b/composer.json
index e9c3c231eb..9f426f75b4 100644
--- a/composer.json
+++ b/composer.json
@@ -97,9 +97,6 @@
         }
     },
     "scripts": {
-        "pre-install-cmd": "Drupal\\Composer\\Composer::ensureComposerVersion",
-        "pre-update-cmd": "Drupal\\Composer\\Composer::ensureComposerVersion",
-        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
         "drupal-phpunit-upgrade-check": "Drupal\\Core\\Composer\\Composer::upgradePHPUnit",
         "drupal-phpunit-upgrade": [
             "@composer update phpunit/phpunit --with-dependencies --no-progress",
diff --git a/core/composer.json b/core/composer.json
index da12e2b8f1..6de1a4a935 100644
--- a/core/composer.json
+++ b/core/composer.json
@@ -240,11 +240,5 @@
                 "[web-root]/themes/README.txt": "assets/scaffold/files/themes.README.txt"
             }
         }
-    },
-    "scripts": {
-        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
-        "post-autoload-dump": [
-          "Drupal\\Core\\Composer\\Composer::ensureHtaccess"
-        ]
     }
 }
diff --git a/core/lib/Drupal/Core/Composer/Composer.php b/core/lib/Drupal/Core/Composer/Composer.php
index fc7ce25cd4..cef36e7755 100644
--- a/core/lib/Drupal/Core/Composer/Composer.php
+++ b/core/lib/Drupal/Core/Composer/Composer.php
@@ -89,8 +89,15 @@ class Composer {
    *
    * @param \Composer\Script\Event $event
    *   The event.
+   *
+   * @deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Use
+   *   Composer's optimize feature instead. Example: composer install -o.
+   *
+   * @see https://www.drupal.org/node/3260624
    */
   public static function preAutoloadDump(Event $event) {
+    trigger_error('Calling ' . __METHOD__ . ' from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624', E_USER_DEPRECATED);
+
     // Get the configured vendor directory.
     $vendor_dir = $event->getComposer()->getConfig()->get('vendor-dir');
 
@@ -162,8 +169,14 @@ public static function preAutoloadDump(Event $event) {
    *
    * @param \Composer\Script\Event $event
    *   The event.
+   *
+   * @deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Use the
+   *   drupal/core-vendor-hardening plugin instead.
+   *
+   * @see https://www.drupal.org/node/3260624
    */
   public static function ensureHtaccess(Event $event) {
+    trigger_error('Calling ' . __METHOD__ . ' from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624', E_USER_DEPRECATED);
 
     // The current working directory for composer scripts is where you run
     // composer from.
@@ -182,8 +195,15 @@ public static function ensureHtaccess(Event $event) {
    * @param \Composer\Installer\PackageEvent $event
    *   A PackageEvent object to get the configured composer vendor directories
    *   from.
+   *
+   * @deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Use the
+   *   drupal/core-vendor-hardening plugin instead.
+   *
+   * @see https://www.drupal.org/node/3260624
    */
   public static function vendorTestCodeCleanup(PackageEvent $event) {
+    trigger_error('Calling ' . __METHOD__ . ' from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624', E_USER_DEPRECATED);
+
     $vendor_dir = $event->getComposer()->getConfig()->get('vendor-dir');
     $io = $event->getIO();
     $op = $event->getOperation();
@@ -238,7 +258,9 @@ public static function vendorTestCodeCleanup(PackageEvent $event) {
    *   The package name from composer. This is always already lower case.
    *
    * @return string|null
-   *   The string key, or NULL if none was found.
+   *   The string key, or NULL if none was found.\
+   *
+   * @internal
    */
   protected static function findPackageKey($package_name) {
     $package_key = NULL;
@@ -262,8 +284,15 @@ protected static function findPackageKey($package_name) {
 
   /**
    * Removes Composer's timeout so that scripts can run indefinitely.
+   *
+   * @deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. There is no
+   *   replacement.
+   *
+   * @see https://www.drupal.org/node/3260624
    */
   public static function removeTimeout() {
+    trigger_error('Calling ' . __METHOD__ . ' from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624', E_USER_DEPRECATED);
+
     ProcessExecutor::setTimeout(0);
   }
 
@@ -275,6 +304,8 @@ public static function removeTimeout() {
    *
    * @return bool
    *   TRUE on success or FALSE on failure.
+   *
+   * @internal
    */
   protected static function deleteRecursive($path) {
     if (is_file($path) || is_link($path)) {
@@ -299,6 +330,8 @@ protected static function deleteRecursive($path) {
    *
    * @param \Composer\Script\Event $event
    *   The event.
+   *
+   * @internal
    */
   public static function upgradePHPUnit(Event $event) {
     $repository = $event->getComposer()->getRepositoryManager()->getLocalRepository();
@@ -332,6 +365,8 @@ public static function upgradePHPUnit(Event $event) {
    *
    * @return bool
    *   TRUE if the PHPUnit needs to be upgraded, FALSE if not.
+   *
+   * @internal
    */
   public static function upgradePHPUnitCheck($phpunit_version) {
     return !(version_compare(PHP_MAJOR_VERSION . '.' . PHP_MINOR_VERSION, '7.4') >= 0 && version_compare($phpunit_version, '9.0') < 0);
diff --git a/core/tests/Drupal/Tests/Core/ComposerDeprecationTest.php b/core/tests/Drupal/Tests/Core/ComposerDeprecationTest.php
new file mode 100644
index 0000000000..95ce429521
--- /dev/null
+++ b/core/tests/Drupal/Tests/Core/ComposerDeprecationTest.php
@@ -0,0 +1,94 @@
+<?php
+
+namespace Drupal\Tests\Core;
+
+use Composer\Config;
+use Composer\Composer as ComposerClass;
+use Composer\DependencyResolver\Operation\UpdateOperation;
+use Composer\Installer\PackageEvent;
+use Composer\IO\IOInterface;
+use Composer\Package\Package;
+use Composer\Repository\InstalledRepositoryInterface;
+use Composer\Repository\RepositoryManager;
+use Composer\Script\Event;
+use Drupal\Core\Composer\Composer;
+use Drupal\Tests\UnitTestCase;
+
+/**
+ * Tests the deprecations in the Composer class.
+ *
+ * @group Composer
+ * @coversDefaultClass \Drupal\Core\Composer\Composer
+ */
+class ComposerDeprecationTest extends UnitTestCase {
+
+  /**
+   * @covers ::preAutoloadDump
+   * @group legacy
+   */
+  public function testPreAutoloadDump() {
+    $event = $this->prophesize(Event::class);
+
+    $composer = $this->prophesize(ComposerClass::class);
+    $event->getComposer()->willReturn($composer->reveal());
+
+    $config = $this->prophesize(Config::class);
+    $composer->getConfig()->willReturn($config->reveal());
+
+    $repository_manager = $this->prophesize(RepositoryManager::class);
+    $composer->getRepositoryManager()->willReturn($repository_manager->reveal());
+
+    $repository = $this->prophesize(InstalledRepositoryInterface::class);
+    $repository_manager->getLocalRepository()->willReturn($repository->reveal());
+
+    $package = $this->prophesize(Package::class);
+    $composer->getPackage()->willReturn($package->reveal());
+
+    $this->expectDeprecation('Unsilenced deprecation: Calling Drupal\Core\Composer\Composer::preAutoloadDump from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624');
+    Composer::preAutoloadDump($event->reveal());
+  }
+
+  /**
+   * @covers ::ensureHtaccess
+   * @group legacy
+   */
+  public function testEnsureHtaccess() {
+    $event = $this->prophesize(Event::class);
+
+    $composer = $this->prophesize(ComposerClass::class);
+    $event->getComposer()->willReturn($composer->reveal());
+
+    $config = $this->prophesize(Config::class);
+    $composer->getConfig()->willReturn($config->reveal());
+
+    $this->expectDeprecation('Unsilenced deprecation: Calling Drupal\Core\Composer\Composer::ensureHtaccess from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624');
+    Composer::ensureHtaccess($event->reveal());
+  }
+
+  /**
+   * @covers ::vendorTestCodeCleanup
+   * @group legacy
+   */
+  public function testVendorTestCodeCleanup() {
+    $event = $this->prophesize(PackageEvent::class);
+
+    $composer = $this->prophesize(ComposerClass::class);
+    $event->getComposer()->willReturn($composer->reveal());
+
+    $config = $this->prophesize(Config::class);
+    $composer->getConfig()->willReturn($config->reveal());
+
+    $operation = $this->prophesize(UpdateOperation::class);
+    $event->getOperation()->willReturn($operation->reveal());
+
+    $package = $this->prophesize(Package::class);
+    $operation->getTargetPackage()->willReturn($package->reveal());
+
+    $io = $this->prophesize(IOInterface::class);
+    $event->getIO()->willReturn($io->reveal());
+
+    $this->expectDeprecation('Unsilenced deprecation: Calling Drupal\Core\Composer\Composer::vendorTestCodeCleanup from composer.json is deprecated in drupal:9.5.0 and is removed from drupal:10.0.0. Any "scripts" section mentioning this in composer.json can be safely removed. See https://www.drupal.org/node/3260624');
+    Composer::vendorTestCodeCleanup($event->reveal());
+  }
+
+}