diff --git a/internal/mode/static/state/graph/nginxproxy.go b/internal/mode/static/state/graph/nginxproxy.go
index 7c494ab1f..fa55f209c 100644
--- a/internal/mode/static/state/graph/nginxproxy.go
+++ b/internal/mode/static/state/graph/nginxproxy.go
@@ -208,7 +208,7 @@ func validateRewriteClientIP(npCfg *ngfAPI.NginxProxy) field.ErrorList {
 		if len(rewriteClientIP.TrustedAddresses) > 16 {
 			allErrs = append(
 				allErrs,
-				field.TooLongMaxLength(trustedAddressesPath, rewriteClientIP.TrustedAddresses, 16),
+				field.TooMany(trustedAddressesPath, len(rewriteClientIP.TrustedAddresses), 16),
 			)
 		}
 
diff --git a/internal/mode/static/state/graph/nginxproxy_test.go b/internal/mode/static/state/graph/nginxproxy_test.go
index 3ac4f5b2e..54447f3b3 100644
--- a/internal/mode/static/state/graph/nginxproxy_test.go
+++ b/internal/mode/static/state/graph/nginxproxy_test.go
@@ -551,7 +551,7 @@ func TestValidateRewriteClientIP(t *testing.T) {
 				},
 			},
 			expectErrCount: 1,
-			errorString:    "spec.rewriteClientIP.trustedAddresses: Too long: may not be longer than 16",
+			errorString:    "spec.rewriteClientIP.trustedAddresses: Too many: 21: must have at most 16 items",
 		},
 		{
 			name:      "invalid when mode is not proxyProtocol or XForwardedFor",