diff --git a/internal/admin/router.go b/internal/admin/router.go
index 0c683d4..6169bf5 100644
--- a/internal/admin/router.go
+++ b/internal/admin/router.go
@@ -5,6 +5,7 @@ package admin
 import (
 	"encoding/json"
 	"errors"
+	"log/slog"
 	"net/http"
 	"strconv"
 
@@ -170,6 +171,10 @@ func updateCluster(repo *storage.ClusterRepo, auditRepo *audit.Repo) gin.Handler
 			merged.DefaultSubmitArgs = decodeStringSlice(v)
 		}
 
+		if len(merged.DefaultSubmitArgs) > 0 {
+			slog.Default().Info("admin: cluster sets default_submit_args which is deprecated; the spark_submit Tool no longer prepends these args. Configure flags via spark_conf / extra_args in the structured tool call.", "cluster_id", merged.ID)
+		}
+
 		// Re-validate after merging so a missing auth_type on a fresh
 		// cluster (defaulted by DB to "none") doesn't get clobbered.
 		if err := validateClusterUpdate(&merged); err != nil {
diff --git a/internal/cluster/types.go b/internal/cluster/types.go
index 7a46bc1..95ac283 100644
--- a/internal/cluster/types.go
+++ b/internal/cluster/types.go
@@ -34,23 +34,28 @@ const (
 //     password" — keeps the existing encrypted blob intact.
 //   - URLAllowlist: extra glob patterns beyond the RM/SHS hosts; fetch_url
 //     uses this to permit long-tail SHS endpoints the agent may construct.
-//   - DefaultSubmitArgs: prepended to every spark_submit Tool call's args.
+//   - DefaultSubmitArgs: deprecated; no longer prepended by spark_submit
+//     (post-7920dc9 the builder constructs argv from structured fields).
+//     Kept for backward compatibility with the admin API and DB schema;
+//     actual removal is a follow-up. New cluster configurations should
+//     leave this empty.
 //   - RateLimitPerMin: 0 disables the per-cluster limiter.
 type Cluster struct {
-	ID                    string    `json:"id"`
-	Name                  string    `json:"name"`
-	RMURL                 string    `json:"rm_url"`
-	SHSURL                string    `json:"shs_url"`
-	SparkSubmitExecuteBin string    `json:"spark_submit_execute_bin"`
-	IsActive              bool      `json:"is_active"`
-	AuthType              AuthType  `json:"auth_type"`
-	AuthUsername          string    `json:"auth_username,omitempty"`
-	AuthPassword          string    `json:"-"` // never serialized; encrypted at rest in auth_password_enc
-	SSLVerify             bool      `json:"ssl_verify"`
-	SSLCABundle           string    `json:"ssl_ca_bundle,omitempty"`
-	URLAllowlist          []string  `json:"url_allowlist,omitempty"`
-	DefaultSubmitArgs     []string  `json:"default_submit_args,omitempty"`
-	RateLimitPerMin       int       `json:"rate_limit_per_min"`
-	CreatedAt             time.Time `json:"created_at"`
-	UpdatedAt             time.Time `json:"updated_at"`
+	ID                    string   `json:"id"`
+	Name                  string   `json:"name"`
+	RMURL                 string   `json:"rm_url"`
+	SHSURL                string   `json:"shs_url"`
+	SparkSubmitExecuteBin string   `json:"spark_submit_execute_bin"`
+	IsActive              bool     `json:"is_active"`
+	AuthType              AuthType `json:"auth_type"`
+	AuthUsername          string   `json:"auth_username,omitempty"`
+	AuthPassword          string   `json:"-"` // never serialized; encrypted at rest in auth_password_enc
+	SSLVerify             bool     `json:"ssl_verify"`
+	SSLCABundle           string   `json:"ssl_ca_bundle,omitempty"`
+	URLAllowlist          []string `json:"url_allowlist,omitempty"`
+	// Deprecated: see godoc.
+	DefaultSubmitArgs []string  `json:"default_submit_args,omitempty"`
+	RateLimitPerMin   int       `json:"rate_limit_per_min"`
+	CreatedAt         time.Time `json:"created_at"`
+	UpdatedAt         time.Time `json:"updated_at"`
 }