diff --git a/cmd/observability-proxy/main.go b/cmd/observability-proxy/main.go
index b05e03807..c228a0a12 100644
--- a/cmd/observability-proxy/main.go
+++ b/cmd/observability-proxy/main.go
@@ -90,6 +90,11 @@ func parseFlags(args []string) (options, error) {
 	if err := fs.Parse(args); err != nil {
 		return o, err
 	}
+	// Parsing stops at the first non-flag, so every flag after it would
+	// be dropped silently.
+	if fs.NArg() > 0 {
+		return o, fmt.Errorf("unexpected argument %q", fs.Arg(0))
+	}
 	switch {
 	case o.rootTenant == "":
 		return o, errors.New("--root-tenant must not be empty")
diff --git a/cmd/observability-proxy/main_test.go b/cmd/observability-proxy/main_test.go
index 3f77f8157..2d4fcece6 100644
--- a/cmd/observability-proxy/main_test.go
+++ b/cmd/observability-proxy/main_test.go
@@ -70,6 +70,7 @@ func TestParseFlagsInvalid(t *testing.T) {
 		{"--max-tails-per-user=-1"},
 		{"--max-tails=-1"},
 		{"--unknown"},
+		{"unexpected", "--root-tenant=tenant-x"},
 	} {
 		if _, err := parseFlags(args); err == nil {
 			t.Errorf("parseFlags(%v) accepted", args)