diff --git a/internal/ingress/annotations/authtls/main.go b/internal/ingress/annotations/authtls/main.go
index b331a215e..1c6bad485 100644
--- a/internal/ingress/annotations/authtls/main.go
+++ b/internal/ingress/annotations/authtls/main.go
@@ -41,7 +41,7 @@ const (
 )
 
 var (
-	authVerifyClientRegex = regexp.MustCompile(`on|off|optional|optional_no_ca`)
+	authVerifyClientRegex = regexp.MustCompile(`^(on|off|optional|optional_no_ca)$`)
 	redirectRegex         = regexp.MustCompile(`^((https?://)?[A-Za-z0-9\-.]*(:\d+)?/[A-Za-z0-9\-.]*)?$`)
 )