diff --git a/src/dstack/_internal/core/models/configurations.py b/src/dstack/_internal/core/models/configurations.py
index 17cf55f71..0992f89d0 100644
--- a/src/dstack/_internal/core/models/configurations.py
+++ b/src/dstack/_internal/core/models/configurations.py
@@ -50,7 +50,7 @@
 )
 
 CommandsList = List[str]
-ValidPort = conint(gt=0, le=65536)
+ValidPort = conint(gt=0, le=65535)
 MAX_INT64 = 2**63 - 1
 SERVICE_HTTPS_DEFAULT = True
 STRIP_PREFIX_DEFAULT = True
diff --git a/src/tests/_internal/pydantic_compat/test_field_parsing.py b/src/tests/_internal/pydantic_compat/test_field_parsing.py
index dabf94e81..add43396f 100644
--- a/src/tests/_internal/pydantic_compat/test_field_parsing.py
+++ b/src/tests/_internal/pydantic_compat/test_field_parsing.py
@@ -113,6 +113,15 @@ def test_service_port_variants_are_normalized(self, raw: Any, expected: dict[str
         assert class_name(config.port) == "PortMapping"
         assert config.port.dict() == expected
 
+    @pytest.mark.parametrize("ports", [[65536], ["65536:80"], ["80:65536"]])
+    def test_task_ports_above_tcp_range_are_rejected(self, ports: list[Any]):
+        with pytest.raises(ConfigurationError, match="65535"):
+            parse_apply_configuration(_task(ports=ports))
+
+    def test_service_port_above_tcp_range_is_rejected(self):
+        with pytest.raises(ConfigurationError, match="65535"):
+            parse_apply_configuration(_service(port=65536))
+
 
 class TestMountPointFieldParsing:
     def test_string_arms_select_volume_and_instance_mount_models(self):