diff --git a/ui/src/routes/devices.$id.settings.access._index.tsx b/ui/src/routes/devices.$id.settings.access._index.tsx
index 8c944b7..6d3a26d 100644
--- a/ui/src/routes/devices.$id.settings.access._index.tsx
+++ b/ui/src/routes/devices.$id.settings.access._index.tsx
@@ -21,7 +21,7 @@ import { CloudState } from "./adopt";
 import { TextAreaWithLabel } from "@components/TextArea";
 
 export interface TLSState {
-  mode: "selfsigned" | "custom" | "disabled";
+  mode: "self-signed" | "custom" | "disabled";
   certificate?: string;
   privateKey?: string;
 };
@@ -220,7 +220,7 @@ export default function SettingsAccessIndexRoute() {
                   value={tlsMode}
                   onChange={e => handleTlsModeChange(e.target.value)}
                   options={[
-                    { value: "selfsigned", label: "Self-signed" },
+                    { value: "self-signed", label: "Self-signed" },
                     { value: "custom", label: "Custom" },
                     { value: "disabled", label: "Disabled" },
                   ]}
diff --git a/web_tls.go b/web_tls.go
index 81f070c..0d9bc09 100644
--- a/web_tls.go
+++ b/web_tls.go
@@ -100,6 +100,8 @@ func setTLSState(s TLSState) error {
 		config.TLSMode = "custom"
 	case "self-signed":
 		config.TLSMode = "self-signed"
+	default:
+		return fmt.Errorf("invalid TLS mode: %s", s.Mode)
 	}
 	return nil
 }