diff --git a/src/HomeAssistant/Runtime.hs b/src/HomeAssistant/Runtime.hs
index 68f026e..446724a 100644
--- a/src/HomeAssistant/Runtime.hs
+++ b/src/HomeAssistant/Runtime.hs
@@ -86,7 +86,9 @@ lookupPort = do
   m <- lookupEnv "HA_METRICS_PORT"
   case m of
     Nothing -> pure 8124
-    Just s  -> maybe (fail ("HA_METRICS_PORT is not a number: " <> s)) pure (readMaybe s)
+    Just s  -> case readMaybe s of
+      Just p | p >= 1 && p <= 65535 -> pure p
+      _ -> fail ("HA_METRICS_PORT must be a port in 1..65535: " <> s)
 
 defaultMain :: IO ()
 defaultMain = withSocketsDo $ do