diff --git a/management/internals/server/config/config.go b/management/internals/server/config/config.go
index 50028660a..3cdbe41e4 100644
--- a/management/internals/server/config/config.go
+++ b/management/internals/server/config/config.go
@@ -247,7 +247,10 @@ func (d DebugUpload) Validate() error {
 	if parsed.Scheme != "https" {
 		return fmt.Errorf("debug upload URL must use https, got scheme %q", parsed.Scheme)
 	}
-	if parsed.Host == "" {
+	// Hostname(), not Host: an authority like ":443" is non-empty but has no
+	// host, and the peers reject it (see profilemanager.ValidateBundleUploadURL).
+	// Management must not publish a destination its own clients refuse.
+	if parsed.Hostname() == "" {
 		return errors.New("debug upload URL must have a host")
 	}
 
diff --git a/management/internals/server/config/debug_upload_test.go b/management/internals/server/config/debug_upload_test.go
index dd52c9790..65c706b72 100644
--- a/management/internals/server/config/debug_upload_test.go
+++ b/management/internals/server/config/debug_upload_test.go
@@ -21,6 +21,8 @@ func TestDebugUploadValidate(t *testing.T) {
 		{name: "http refused", url: "http://upload.example.com/upload-url", wantErr: "must use https"},
 		{name: "scheme-less refused", url: "upload.example.com/upload-url", wantErr: "must use https"},
 		{name: "host-less refused", url: "https:///upload-url", wantErr: "must have a host"},
+		// ":443" is a non-empty authority with no host; the peers refuse it.
+		{name: "port-only authority refused", url: "https://:443/upload-url", wantErr: "must have a host"},
 		{name: "unparsable refused", url: "https://upload.example.com:port", wantErr: "parse debug upload URL"},
 	}