diff --git a/nomad/structs/host_volumes.go b/nomad/structs/host_volumes.go
index c254bf72902..440ad956512 100644
--- a/nomad/structs/host_volumes.go
+++ b/nomad/structs/host_volumes.go
@@ -275,9 +275,8 @@ func (hvc *HostVolumeCapability) Validate() error {
 	switch hvc.AccessMode {
 	case HostVolumeAccessModeSingleNodeReader,
 		HostVolumeAccessModeSingleNodeWriter,
-		HostVolumeAccessModeMultiNodeReader,
-		HostVolumeAccessModeMultiNodeSingleWriter,
-		HostVolumeAccessModeMultiNodeMultiWriter:
+		HostVolumeAccessModeSingleNodeSingleWriter,
+		HostVolumeAccessModeSingleNodeMultiWriter:
 	default:
 		return fmt.Errorf("invalid access mode: %q", hvc.AccessMode)
 	}
@@ -302,12 +301,10 @@ type HostVolumeAccessMode string
 const (
 	HostVolumeAccessModeUnknown HostVolumeAccessMode = ""
 
-	HostVolumeAccessModeSingleNodeReader HostVolumeAccessMode = "single-node-reader-only"
-	HostVolumeAccessModeSingleNodeWriter HostVolumeAccessMode = "single-node-writer"
-
-	HostVolumeAccessModeMultiNodeReader       HostVolumeAccessMode = "multi-node-reader-only"
-	HostVolumeAccessModeMultiNodeSingleWriter HostVolumeAccessMode = "multi-node-single-writer"
-	HostVolumeAccessModeMultiNodeMultiWriter  HostVolumeAccessMode = "multi-node-multi-writer"
+	HostVolumeAccessModeSingleNodeReader       HostVolumeAccessMode = "single-node-reader-only"
+	HostVolumeAccessModeSingleNodeWriter       HostVolumeAccessMode = "single-node-writer"
+	HostVolumeAccessModeSingleNodeSingleWriter HostVolumeAccessMode = "single-node-single-writer"
+	HostVolumeAccessModeSingleNodeMultiWriter  HostVolumeAccessMode = "single-node-multi-writer"
 )
 
 // HostVolumeStub is used for responses for the list volumes endpoint
diff --git a/nomad/structs/host_volumes_test.go b/nomad/structs/host_volumes_test.go
index 499bc27d1c8..2a03e838daf 100644
--- a/nomad/structs/host_volumes_test.go
+++ b/nomad/structs/host_volumes_test.go
@@ -45,7 +45,7 @@ func TestHostVolume_Copy(t *testing.T) {
 	out.Constraints[0].LTarget = "${meta.node_class}"
 	out.RequestedCapabilities = append(out.RequestedCapabilities, &HostVolumeCapability{
 		AttachmentMode: HostVolumeAttachmentModeBlockDevice,
-		AccessMode:     HostVolumeAccessModeMultiNodeReader,
+		AccessMode:     HostVolumeAccessModeSingleNodeMultiWriter,
 	})
 	out.Parameters["foo"] = "baz"
 
@@ -195,7 +195,7 @@ func TestHostVolume_CanonicalizeForUpdate(t *testing.T) {
 		RequestedCapacityMaxBytes: 500000,
 		RequestedCapabilities: []*HostVolumeCapability{{
 			AttachmentMode: HostVolumeAttachmentModeFilesystem,
-			AccessMode:     HostVolumeAccessModeMultiNodeMultiWriter,
+			AccessMode:     HostVolumeAccessModeSingleNodeMultiWriter,
 		}},
 	}
 	existing := &HostVolume{
@@ -240,7 +240,7 @@ func TestHostVolume_CanonicalizeForUpdate(t *testing.T) {
 
 	must.Eq(t, []*HostVolumeCapability{{
 		AttachmentMode: HostVolumeAttachmentModeFilesystem,
-		AccessMode:     HostVolumeAccessModeMultiNodeMultiWriter,
+		AccessMode:     HostVolumeAccessModeSingleNodeMultiWriter,
 	}}, vol.RequestedCapabilities)
 
 	must.Eq(t, "/var/nomad/alloc_mounts/82f357d6.ext4", vol.HostPath)
diff --git a/nomad/structs/volumes.go b/nomad/structs/volumes.go
index 18d5f39289e..58c4eefacd3 100644
--- a/nomad/structs/volumes.go
+++ b/nomad/structs/volumes.go
@@ -170,16 +170,22 @@ func (v *VolumeRequest) Validate(jobType string, taskGroupCount, canaries int) e
 	switch v.Type {
 
 	case VolumeTypeHost:
-		if v.AttachmentMode != CSIVolumeAttachmentModeUnknown {
-			addErr("host volumes cannot have an attachment mode")
-		}
-		if v.AccessMode != CSIVolumeAccessModeUnknown {
-			addErr("host volumes cannot have an access mode")
-		}
 		if v.MountOptions != nil {
+			// TODO(1.10.0): support mount options for dynamic host volumes
 			addErr("host volumes cannot have mount options")
 		}
 
+		switch v.AccessMode {
+		case CSIVolumeAccessModeSingleNodeReader, CSIVolumeAccessModeMultiNodeReader:
+			if !v.ReadOnly {
+				addErr("%s volumes must be read-only", v.AccessMode)
+			}
+		default:
+			// dynamic host volumes are all "per node" so there's no way to
+			// validate that other access modes work for a given volume until we
+			// have access to other allocations (in the scheduler)
+		}
+
 	case VolumeTypeCSI:
 
 		switch v.AttachmentMode {
diff --git a/nomad/structs/volumes_test.go b/nomad/structs/volumes_test.go
index 58585932d7c..9b697faf18c 100644
--- a/nomad/structs/volumes_test.go
+++ b/nomad/structs/volumes_test.go
@@ -31,9 +31,9 @@ func TestVolumeRequest_Validate(t *testing.T) {
 		{
 			name: "host volume with CSI volume config",
 			expected: []string{
-				"host volumes cannot have an access mode",
-				"host volumes cannot have an attachment mode",
+				"volume has an empty source",
 				"host volumes cannot have mount options",
+				"single-node-reader-only volumes must be read-only",
 				"volume cannot be per_alloc for system or sysbatch jobs",
 				"volume cannot be per_alloc when canaries are in use",
 			},