diff --git a/pkg/crosscluster/physical/alter_replication_job.go b/pkg/crosscluster/physical/alter_replication_job.go
index 33a34bfc95ae..763dda02cc91 100644
--- a/pkg/crosscluster/physical/alter_replication_job.go
+++ b/pkg/crosscluster/physical/alter_replication_job.go
@@ -200,6 +200,12 @@ func alterReplicationJobHook(
 		}
 	}
 
+	// Ensure the TenantSpec is type checked, even if we don't use the result.
+	_, _, _, err = exprEval.TenantSpec(ctx, alterTenantStmt.TenantSpec)
+	if err != nil {
+		return nil, nil, nil, false, err
+	}
+
 	retentionTTLSeconds := defaultRetentionTTLSeconds
 	if ret, ok := options.GetRetention(); ok {
 		retentionTTLSeconds = ret
diff --git a/pkg/crosscluster/physical/alter_replication_job_test.go b/pkg/crosscluster/physical/alter_replication_job_test.go
index 572fdb1912a2..c1eb3b1d7045 100644
--- a/pkg/crosscluster/physical/alter_replication_job_test.go
+++ b/pkg/crosscluster/physical/alter_replication_job_test.go
@@ -597,3 +597,22 @@ func TestAlterTenantStartReplicationAfterRestore(t *testing.T) {
 	srcTime := srv.Clock().Now()
 	replicationtestutils.WaitUntilReplicatedTime(t, srcTime, db, catpb.JobID(ingestionJobID))
 }
+
+func TestAlterReplicationJobErrors(t *testing.T) {
+	defer leaktest.AfterTest(t)()
+	defer log.Scope(t).Close(t)
+
+	ctx := context.Background()
+
+	srv, sqlDB, _ := serverutils.StartServer(t, base.TestServerArgs{
+		DefaultTestTenant: base.TestControlsTenantsExplicitly})
+	defer srv.Stopper().Stop(ctx)
+
+	db := sqlutils.MakeSQLRunner(sqlDB)
+
+	t.Run("alter tenant subqueries", func(t *testing.T) {
+		// Regression test for #136339
+		db.ExpectErr(t, "subqueries are not allowed", "ALTER TENANT (select 't2') START REPLICATION OF t1 ON 'foo'")
+	})
+
+}