diff --git a/src/middlewared/middlewared/plugins/network.py b/src/middlewared/middlewared/plugins/network.py
index 7a30da98e7db2..5bac389fdb42b 100644
--- a/src/middlewared/middlewared/plugins/network.py
+++ b/src/middlewared/middlewared/plugins/network.py
@@ -1049,6 +1049,12 @@ def _get_filters(key):
                             f'{schema_name}.{i}',
                             f'{str(validation_attrs[i][0]) + str(validation_attrs[i][2])}',
                         )
+            else:
+                if data.get('failover_critical') and data.get('failover_group') is None:
+                    verrors.add(
+                        f'{schema_name}.failover_group',
+                        'A failover group is required when configuring a critical failover interface.'
+                    )
 
             # creating a "failover" lagg interface on HA systems and trying
             # to mark it "critical for failover" isn't allowed as it can cause
diff --git a/tests/api2/test_005_interface.py b/tests/api2/test_005_interface.py
index 9e27e3f19048d..d92d30769ae03 100644
--- a/tests/api2/test_005_interface.py
+++ b/tests/api2/test_005_interface.py
@@ -4,8 +4,10 @@
 apifolder = os.getcwd()
 sys.path.append(apifolder)
 
+import errno
 import pytest
 
+from middlewared.service_exception import ValidationError, ValidationErrors
 from auto_config import interface, ha, netmask
 from middlewared.test.integration.utils.client import client, truenas_server
 from middlewared.test.integration.utils import call
@@ -118,3 +120,14 @@ def test_002_configure_interface(request, ws_client, get_payload):
 
 def test_003_recheck_ipvx(request):
     assert int(call('tunable.get_sysctl', f'net.ipv6.conf.{interface}.autoconf')) == 0
+
+def test_004_remove_critical_failover_group(request):
+    with pytest.raises(ValidationErrors) as ve:
+        call('interface.update', interface, {'failover_group': None, 'failover_critical': True})
+        assert ve.value.errors == [
+            ValidationError(
+                'interface_update.failover_group',
+                'A failover group is required when configuring a critical failover interface.',
+                errno.EINVAL
+            )
+        ]