diff --git a/go.mod b/go.mod
index 944882aa..77cb31ea 100644
--- a/go.mod
+++ b/go.mod
@@ -9,7 +9,7 @@ require (
 	github.com/prometheus/common v0.44.0
 	golang.org/x/crypto v0.10.0
 	golang.org/x/sync v0.3.0
-	gopkg.in/yaml.v2 v2.4.0
+	gopkg.in/yaml.v3 v3.0.1
 )
 
 require (
@@ -32,4 +32,5 @@ require (
 	golang.org/x/text v0.10.0 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/protobuf v1.30.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 4cf41aac..dc5f92d9 100644
--- a/go.sum
+++ b/go.sum
@@ -80,3 +80,4 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
diff --git a/web/tls_config.go b/web/tls_config.go
index 61383bce..ff4ca3e6 100644
--- a/web/tls_config.go
+++ b/web/tls_config.go
@@ -14,10 +14,12 @@
 package web
 
 import (
+	"bytes"
 	"crypto/tls"
 	"crypto/x509"
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"net/http"
 	"os"
@@ -28,7 +30,7 @@ import (
 	"github.com/go-kit/log/level"
 	config_util "github.com/prometheus/common/config"
 	"golang.org/x/sync/errgroup"
-	"gopkg.in/yaml.v2"
+	"gopkg.in/yaml.v3"
 )
 
 var (
@@ -119,8 +121,10 @@ func getConfig(configPath string) (*Config, error) {
 		},
 		HTTPConfig: HTTPConfig{HTTP2: true},
 	}
-	err = yaml.UnmarshalStrict(content, c)
-	if err == nil {
+	decoder := yaml.NewDecoder(bytes.NewReader(content))
+	decoder.KnownFields(true)
+	err = decoder.Decode(c)
+	if err == nil && !errors.Is(err, io.EOF) {
 		err = validateHeaderConfig(c.HTTPConfig.Header)
 	}
 	c.TLSConfig.SetDirectory(filepath.Dir(configPath))
diff --git a/web/tls_config_test.go b/web/tls_config_test.go
index 6ca20673..973b0cae 100644
--- a/web/tls_config_test.go
+++ b/web/tls_config_test.go
@@ -44,6 +44,7 @@ var (
 	testlogger = &testLogger{}
 
 	ErrorMap = map[string]*regexp.Regexp{
+		"End of file":                  regexp.MustCompile(`EOF`),
 		"HTTP Response to HTTPS":       regexp.MustCompile(`server gave HTTP response to HTTPS client`),
 		"No such file":                 regexp.MustCompile(`no such file`),
 		"Invalid argument":             regexp.MustCompile(`invalid argument`),
@@ -112,7 +113,7 @@ func TestYAMLFiles(t *testing.T) {
 		{
 			Name:           `empty config yml`,
 			YAMLConfigPath: "testdata/web_config_empty.yml",
-			ExpectedError:  nil,
+			ExpectedError:  ErrorMap["End of file"],
 		},
 		{
 			Name:           `invalid config yml (invalid structure)`,