diff --git a/nixos/modules/services/networking/radicale.nix b/nixos/modules/services/networking/radicale.nix
index 76e74e07a4e5..fd0a63212d49 100644
--- a/nixos/modules/services/networking/radicale.nix
+++ b/nixos/modules/services/networking/radicale.nix
@@ -119,6 +119,14 @@ in
           are mutually exclusive.
         '';
       }
+      {
+        assertion = cfg.config != "" || (cfg.settings ? auth && cfg.settings.auth ? type);
+        message = ''
+          Radicale 3.5.0 changed the default value for `auth.type` from `none` to `denyall`.
+          You probably don't want `denyall`, so please set this explicitly.
+          https://github.com/Kozea/Radicale/blob/v3.5.0/CHANGELOG.md
+        '';
+      }
     ];
 
     warnings =