diff --git a/crates/tw-config/src/proxy.rs b/crates/tw-config/src/proxy.rs
index 3eac31d..27374c2 100644
--- a/crates/tw-config/src/proxy.rs
+++ b/crates/tw-config/src/proxy.rs
@@ -37,7 +37,10 @@ impl ProxyKind {
     }
 }
 
+/// 写错的字段名是错误，和配置的其余部分一样（见 `Config` 上那段）：`passwd`
+/// 被静默丢掉的话，表现是代理一直 407，而配置文件里看着什么都写了。
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct ProxyAuth {
     pub user: String,
     /// 支持 `${ENV}`，和上游的密钥同一套
@@ -45,6 +48,7 @@ pub struct ProxyAuth {
 }
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(deny_unknown_fields)]
 pub struct Proxy {
     pub name: String,
     #[serde(default, rename = "type")]
@@ -198,6 +202,22 @@ mod tests {
         );
     }
 
+    /// `typ: http` 被悄悄丢掉的话，代理按默认的 socks5h 去连一个 HTTP 代理，
+    /// 报的是连不上，而配置文件里看着明明写了类型。
+    #[test]
+    fn a_misspelled_proxy_field_is_an_error_that_names_it() {
+        let e = serde_yaml_ng::from_str::<Proxy>("{name: p, addr: '127.0.0.1:7890', typ: http}")
+            .unwrap_err()
+            .to_string();
+        assert!(e.contains("typ"), "{e}");
+        let e = serde_yaml_ng::from_str::<Proxy>(
+            "{name: p, addr: '127.0.0.1:7890', auth: {user: a, passwd: b}}",
+        )
+        .unwrap_err()
+        .to_string();
+        assert!(e.contains("passwd"), "{e}");
+    }
+
     #[test]
     fn failing_is_the_default_not_silently_going_direct() {
         // 静默降级最糟的情况不是失败，是它**真的连上了**，而你以为
diff --git a/crates/tw-control/tests/live_state.rs b/crates/tw-control/tests/live_state.rs
index f57b810..bb1cc74 100644
--- a/crates/tw-control/tests/live_state.rs
+++ b/crates/tw-control/tests/live_state.rs
@@ -228,7 +228,7 @@ async fn the_overview_says_which_proxy_is_down_and_why() {
     let dead = dead_addr();
     let d = tempfile::tempdir().unwrap();
     let yaml = format!(
-        "version: 1\nlisten:\n  control:\n    key: c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00\nclients:\n  - name: 我\n    key: tw-k\nproxies:\n  - name: 代理一\n    kind: http\n    addr: {dead}\nproviders:\n  - name: 中转\n    base_url: http://127.0.0.1:9\n    protocol: anthropic\n    key: sk-x\n    proxy: 代理一\n"
+        "version: 1\nlisten:\n  control:\n    key: c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00c0ffee00\nclients:\n  - name: 我\n    key: tw-k\nproxies:\n  - name: 代理一\n    type: http\n    addr: {dead}\nproviders:\n  - name: 中转\n    base_url: http://127.0.0.1:9\n    protocol: anthropic\n    key: sk-x\n    proxy: 代理一\n"
     );
     let (gw, app) = control(&d, &yaml, None);
     let mut rx = gw.bus.subscribe();