diff --git a/dashboard/src/components/DomainProviderForm.vue b/dashboard/src/components/DomainProviderForm.vue
index bf17cf93e..9b8b46beb 100644
--- a/dashboard/src/components/DomainProviderForm.vue
+++ b/dashboard/src/components/DomainProviderForm.vue
@@ -4,7 +4,7 @@ import { useI18n } from 'vue-i18n';
 const i18n = useI18n();
 const t = i18n.t;
 
-import { ref } from 'vue';
+import { ref, watch } from 'vue';
 import { TextInput, InputGroup, MaskedInput, Button, FormGroup, Checkbox, SingleSelect } from '@cloudron/pankow';
 import { ENDPOINTS_OVH } from '../constants.js';
 import DomainsModel from '../models/DomainsModel.js';
@@ -53,15 +53,6 @@ function needsPort80(dnsProvider, tlsProvider) {
     (tlsProvider === 'letsencrypt-prod' || tlsProvider === 'letsencrypt-staging'));
 }
 
-function setDefaultTlsProvider(p) {
-  // wildcard LE won't work without automated DNS
-  if (p === 'manual' || p === 'noop' || p === 'wildcard') {
-    tlsProvider.value = 'letsencrypt-prod';
-  } else {
-    tlsProvider.value = 'letsencrypt-prod-wildcard';
-  }
-}
-
 function resetFields() {
   dnsConfig.value.accessKeyId = '';
   dnsConfig.value.accessKey = '';
@@ -86,10 +77,16 @@ function resetFields() {
   dnsConfig.value.username = '';
 }
 
-function onProviderChange(p) {
-  setDefaultTlsProvider(p);
-  resetFields(p);
-}
+watch(provider, (p) => {
+  resetFields();
+
+  // wildcard LE won't work without automated DNS
+  if (p === 'manual' || p === 'noop' || p === 'wildcard') {
+    tlsProvider.value = 'letsencrypt-prod';
+  } else {
+    tlsProvider.value = 'letsencrypt-prod-wildcard';
+  }
+});
 
 const gcdnsFileParseError = ref('');
 function onGcdnsFileInputChange(event) {
@@ -130,7 +127,7 @@ function onGcdnsFileInputChange(event) {
   <div>
     <FormGroup>
       <label for="providerInput">{{ $t('domains.domainDialog.provider') }} <sup><a href="https://docs.cloudron.io/domains/#dns-providers" class="help" target="_blank"><i class="fa fa-question-circle"></i></a></sup></label>
-      <SingleSelect v-model="provider" @select="onProviderChange" :disabled="disabled" :options="DomainsModel.providers" option-key="value" option-label="name" required />
+      <SingleSelect v-model="provider" :disabled="disabled" :options="DomainsModel.providers" option-key="value" option-label="name" required />
     </FormGroup>
 
     <div class="warning-label" v-show="provider === 'wildcard'" v-html="$t('domains.domainDialog.wildcardInfo', { domain: domain })"></div>
@@ -323,7 +320,7 @@ function onGcdnsFileInputChange(event) {
 
     <FormGroup v-if="showAdvanced">
       <label>Certificate provider <sup><a href="https://docs.cloudron.io/certificates/#certificate-providers" class="help" target="_blank"><i class="fa fa-question-circle"></i></a></sup></label>
-      <SingleSelect v-model="tlsProvider" :options="tlsProviders" option-key="value" option-label="name"/>
+      <SingleSelect v-model="tlsProvider" :options="tlsProviders" option-key="value" option-label="name" required/>
     </FormGroup>
 
   </div>
diff --git a/dashboard/src/views/SetupView.vue b/dashboard/src/views/SetupView.vue
index 732b837ed..221522377 100644
--- a/dashboard/src/views/SetupView.vue
+++ b/dashboard/src/views/SetupView.vue
@@ -31,7 +31,7 @@ const setupToken = ref('');
 const zoneName = ref('');
 const provider = ref('');
 const dnsConfig = ref(DomainsModel.createEmptyConfig());
-const tlsProvider = ref('letsenc-prod-wildcard');
+const tlsProvider = ref('letsencrypt-prod-wildcard');
 const showAdvanced = ref(false);
 const customNameservers = ref(false);
 const ipv4Provider = ref('generic');
@@ -151,8 +151,6 @@ onMounted(async () => {
   } else if (status.provider === 'ami') {
       // aws marketplace made a policy change that they one cannot provide route53 IAM credentials
     provider.value = 'wildcard';
-  } else { // some default to make the form not feel "empty"
-    provider.value = 'digitalocean';
   }
 
   const [error2, result] = await provisionModel.detectIp();