diff --git a/internal/netsettings/service.go b/internal/netsettings/service.go
index 27bcff40..9b526178 100644
--- a/internal/netsettings/service.go
+++ b/internal/netsettings/service.go
@@ -78,15 +78,19 @@ func (s *Service) Hops() int {
 // SetHops persists a new depth and refreshes the cache, so an admin change
 // takes effect on the next request with no restart (rule #25).
 func (s *Service) SetHops(ctx context.Context, hops int) error {
+	// Range first, availability second. The argument is wrong regardless of
+	// whether the database is reachable, and the distinction is user-visible:
+	// this ordering answers 400 for a bad value, where the reverse would
+	// report 500 and blame the server for the caller's input.
+	if hops < 0 || hops > MaxTrustedProxyHops {
+		return ErrHopsOutOfRange
+	}
 	if s == nil || s.pool == nil {
 		// Mirrors Hops()'s nil-tolerance: handlers can be constructed without
 		// this service in tests, and a write attempt there should be an error
 		// rather than a panic in an HTTP handler.
 		return errors.New("network settings unavailable")
 	}
-	if hops < 0 || hops > MaxTrustedProxyHops {
-		return ErrHopsOutOfRange
-	}
 	row, err := dbq.New(s.pool).UpdateTrustedProxyHops(ctx, int32(hops))
 	if err != nil {
 		return err