diff --git a/server/src/validation/monitorValidation.ts b/server/src/validation/monitorValidation.ts
index 53a8ec6ca..22a1a241e 100644
--- a/server/src/validation/monitorValidation.ts
+++ b/server/src/validation/monitorValidation.ts
@@ -2,6 +2,9 @@ import { z } from "zod";
 import { booleanCoercion, dnsHostnameRegex, dnsServerValidation } from "./shared.js";
 import { GeoContinents } from "@/types/geoCheck.js";
 import { DnsRecordTypes, MonitorMatchMethods, MonitorStatuses, MonitorTypes, PageSpeedStrategies } from "@/types/monitor.js";
+import http from "node:http";
+
+const httpStatusCode = z.number().refine((code) => code.toString() in http.STATUS_CODES, { message: "Must be a valid HTTP status code" });
 
 export const getMonitorByIdParamValidation = z.object({
 	monitorId: z.string().min(1, "Monitor ID is required"),
@@ -81,7 +84,7 @@ export const createMonitorBodyValidation = z
 		tempAlertThreshold: z.number().optional(),
 		notifications: z.array(z.string()).optional(),
 		tags: z.array(z.string()).optional(),
-		customUpCodes: z.array(z.number()).default([]),
+		customUpCodes: z.array(httpStatusCode).default([]),
 		secret: z.string().optional(),
 		jsonPath: z.union([z.string(), z.literal("")]).optional(),
 		expectedValue: z.union([z.string(), z.literal("")]).optional(),
@@ -111,7 +114,7 @@ export const editMonitorBodyValidation = z
 		interval: z.number().optional(),
 		notifications: z.array(z.string()).optional(),
 		tags: z.array(z.string()).optional(),
-		customUpCodes: z.array(z.number()).optional(),
+		customUpCodes: z.array(httpStatusCode).optional(),
 		secret: z.string().optional(),
 		ignoreTlsErrors: z.boolean().optional(),
 		useAdvancedMatching: z.boolean().optional(),
@@ -182,7 +185,7 @@ const importedMonitorSchema = z
 		uptimePercentage: z.number().optional(),
 		notifications: z.array(z.string()).default([]),
 		tags: z.array(z.string()).default([]),
-		customUpCodes: z.array(z.number()).default([]),
+		customUpCodes: z.array(httpStatusCode).default([]),
 		secret: z.string().optional(),
 		cpuAlertThreshold: z.number().default(100),
 		cpuAlertCounter: z.number().default(5),
@@ -244,7 +247,7 @@ export const monitorResponseSchema = z
 		matchMethod: z.enum(MonitorMatchMethods).optional(),
 		notifications: z.array(z.string()),
 		tags: z.array(z.string()),
-		customUpCodes: z.array(z.number()).optional(),
+		customUpCodes: z.array(httpStatusCode).optional(),
 		secret: z.string().optional(),
 		cpuAlertThreshold: z.number(),
 		memoryAlertThreshold: z.number(),
diff --git a/server/test/unit/validation/monitorValidation.test.ts b/server/test/unit/validation/monitorValidation.test.ts
index 057ff6ae1..04cf2537e 100644
--- a/server/test/unit/validation/monitorValidation.test.ts
+++ b/server/test/unit/validation/monitorValidation.test.ts
@@ -222,3 +222,93 @@ describe("monitorValidation — strategy gating", () => {
 		});
 	});
 });
+
+describe("monitorValidation — customUpCodes", () => {
+	const baseHttpBody = {
+		name: "HTTP check",
+		type: "http" as const,
+		url: "https://example.com",
+	};
+
+	describe("createMonitorBodyValidation", () => {
+		it("accepts valid HTTP status codes", () => {
+			const parsed = createMonitorBodyValidation.parse({
+				...baseHttpBody,
+				customUpCodes: [200, 301, 404, 503],
+			});
+			expect(parsed.customUpCodes).toEqual([200, 301, 404, 503]);
+		});
+
+		it("rejects invalid HTTP status codes", () => {
+			expect(() =>
+				createMonitorBodyValidation.parse({
+					...baseHttpBody,
+					customUpCodes: [5000],
+				})
+			).toThrow();
+
+			expect(() =>
+				createMonitorBodyValidation.parse({
+					...baseHttpBody,
+					customUpCodes: [-1],
+				})
+			).toThrow();
+		});
+
+		it("defaults to an empty array when not provided", () => {
+			const parsed = createMonitorBodyValidation.parse(baseHttpBody);
+			expect(parsed.customUpCodes).toEqual([]);
+		});
+	});
+
+	describe("editMonitorBodyValidation", () => {
+		it("accepts valid HTTP status codes on edits", () => {
+			const parsed = editMonitorBodyValidation.parse({
+				customUpCodes: [200, 201],
+			});
+			expect(parsed.customUpCodes).toEqual([200, 201]);
+		});
+
+		it("rejects invalid HTTP status codes on edits", () => {
+			expect(() =>
+				editMonitorBodyValidation.parse({
+					customUpCodes: [9999],
+				})
+			).toThrow();
+		});
+	});
+
+	describe("importMonitorsBodyValidation", () => {
+		it("retains valid HTTP status codes on imported HTTP monitors", () => {
+			const parsed = importMonitorsBodyValidation.parse({
+				monitors: [
+					{
+						...baseHttpBody,
+						customUpCodes: [404],
+					},
+				],
+			});
+			expect(parsed.monitors[0].customUpCodes).toEqual([404]);
+		});
+
+		it("rejects invalid HTTP status codes on imported HTTP monitors", () => {
+			expect(() =>
+				importMonitorsBodyValidation.parse({
+					monitors: [
+						{
+							...baseHttpBody,
+							customUpCodes: [5000],
+						},
+					],
+				})
+			).toThrow();
+		});
+
+		it("defaults to an empty array when not provided on import", () => {
+			const parsed = importMonitorsBodyValidation.parse({
+				monitors: [baseHttpBody],
+			});
+			expect(parsed.monitors[0].customUpCodes).toEqual([]);
+		});
+	});
+});