diff --git a/cmd/ipfs/daemon.go b/cmd/ipfs/daemon.go
index 9ef4134140b..af105589db5 100644
--- a/cmd/ipfs/daemon.go
+++ b/cmd/ipfs/daemon.go
@@ -30,6 +30,7 @@ import (
 	fsrepo "github.com/ipfs/kubo/repo/fsrepo"
 	"github.com/ipfs/kubo/repo/fsrepo/migrations"
 	"github.com/ipfs/kubo/repo/fsrepo/migrations/ipfsfetcher"
+	pnet "github.com/libp2p/go-libp2p/core/pnet"
 	sockets "github.com/libp2p/go-socket-activation"
 
 	cmds "github.com/ipfs/go-ipfs-cmds"
@@ -396,6 +397,16 @@ func daemonFunc(req *cmds.Request, re cmds.ResponseEmitter, env cmds.Environment
 			routingOption = routingOptionAutoKwd
 		}
 	}
+
+	// Private setups can't leverage peers returned by default IPNIs (Routing.Type=auto)
+	// To avoid breaking existing setups, switch them to DHT-only.
+	if routingOption == routingOptionAutoKwd {
+		if key, _ := repo.SwarmKey(); key != nil || pnet.ForcePrivateNetwork {
+			log.Error("Private networking (swarm.key / LIBP2P_FORCE_PNET) does not work with public HTTP IPNIs enabled by Routing.Type=auto. Kubo will use Routing.Type=dht instead. Update config to remove this message.")
+			routingOption = routingOptionDHTKwd
+		}
+	}
+
 	switch routingOption {
 	case routingOptionSupernodeKwd:
 		return errors.New("supernode routing was never fully implemented and has been removed")
@@ -441,6 +452,11 @@ func daemonFunc(req *cmds.Request, re cmds.ResponseEmitter, env cmds.Environment
 		fmt.Printf("Swarm key fingerprint: %x\n", node.PNetFingerprint)
 	}
 
+	if (pnet.ForcePrivateNetwork || node.PNetFingerprint != nil) && routingOption == routingOptionAutoKwd {
+		// This should never happen, but better safe than sorry
+		log.Fatal("Private network does not work with Routing.Type=auto. Update your config to Routing.Type=dht (or none, and do manual peering)")
+	}
+
 	printSwarmAddrs(node)
 
 	defer func() {