diff --git a/tailcfg/tailcfg.go b/tailcfg/tailcfg.go
index c921a0c7d..738c8a5dc 100644
--- a/tailcfg/tailcfg.go
+++ b/tailcfg/tailcfg.go
@@ -27,6 +27,7 @@ import (
 	"tailscale.com/types/tkatype"
 	"tailscale.com/util/dnsname"
 	"tailscale.com/util/slicesx"
+	"tailscale.com/util/vizerror"
 )
 
 // CapabilityVersion represents the client's capability level. That
@@ -891,14 +892,14 @@ type ServiceName string
 
 // Validate validates if the service name is formatted correctly.
 // We only allow valid DNS labels, since the expectation is that these will be
-// used as parts of domain names.
+// used as parts of domain names. All errors are [vizerror.Error].
 func (sn ServiceName) Validate() error {
 	bareName, ok := strings.CutPrefix(string(sn), "svc:")
 	if !ok {
-		return errors.New("services must start with 'svc:'")
+		return vizerror.Errorf("%q is not a valid service name: must start with 'svc:'", sn)
 	}
 	if bareName == "" {
-		return errors.New("service names must not be empty")
+		return vizerror.Errorf("%q is not a valid service name: must not be empty after the 'svc:' prefix", sn)
 	}
 	return dnsname.ValidLabel(bareName)
 }
diff --git a/util/dnsname/dnsname.go b/util/dnsname/dnsname.go
index 131bdd14b..6404a9af1 100644
--- a/util/dnsname/dnsname.go
+++ b/util/dnsname/dnsname.go
@@ -94,7 +94,8 @@ func (f FQDN) Contains(other FQDN) bool {
 	return strings.HasSuffix(other.WithTrailingDot(), cmp)
 }
 
-// ValidLabel reports whether label is a valid DNS label.
+// ValidLabel reports whether label is a valid DNS label. All errors are
+// [vizerror.Error].
 func ValidLabel(label string) error {
 	if len(label) == 0 {
 		return vizerror.New("empty DNS label")