diff --git a/dashboard/src/components/DomainProviderForm.vue b/dashboard/src/components/DomainProviderForm.vue
index 9b8b46beb..ac0319a52 100644
--- a/dashboard/src/components/DomainProviderForm.vue
+++ b/dashboard/src/components/DomainProviderForm.vue
@@ -86,7 +86,7 @@ watch(provider, (p) => {
   } else {
     tlsProvider.value = 'letsencrypt-prod-wildcard';
   }
-});
+}, { immediate: true });
 
 const gcdnsFileParseError = ref('');
 function onGcdnsFileInputChange(event) {
diff --git a/dashboard/src/views/SetupView.vue b/dashboard/src/views/SetupView.vue
index 521d9e74b..e731c3ee9 100644
--- a/dashboard/src/views/SetupView.vue
+++ b/dashboard/src/views/SetupView.vue
@@ -138,8 +138,8 @@ onMounted(async () => {
   } else if (serverProvider.value === 'gce') {
     provider.value = 'gcdns';
   } else if (serverProvider.value === 'ami') {
-      // aws marketplace made a policy change that they one cannot provide route53 IAM credentials
-    provider.value = 'wildcard';
+    // aws marketplace made a policy change that they one cannot provide route53 IAM credentials
+    // we used to have wildcard here but it shows some ugly warnings
   }
 
   const [error2, result] = await provisionModel.detectIp();