diff --git a/cmd/headscale/headscale_test.go b/cmd/headscale/headscale_test.go
index a16271af..8d117896 100644
--- a/cmd/headscale/headscale_test.go
+++ b/cmd/headscale/headscale_test.go
@@ -60,9 +60,9 @@ func (*Suite) TestConfigFileLoading(c *check.C) {
 	c.Assert(viper.GetString("metrics_listen_addr"), check.Equals, "127.0.0.1:9090")
 	c.Assert(viper.GetString("database.type"), check.Equals, "sqlite")
 	c.Assert(viper.GetString("database.sqlite.path"), check.Equals, "/var/lib/headscale/db.sqlite")
-	c.Assert(viper.GetString("tls_letsencrypt_hostname"), check.Equals, "")
-	c.Assert(viper.GetString("tls_letsencrypt_listen"), check.Equals, ":http")
-	c.Assert(viper.GetString("tls_letsencrypt_challenge_type"), check.Equals, "HTTP-01")
+	c.Assert(viper.GetString("tls.letsencrypt_hostname"), check.Equals, "")
+	c.Assert(viper.GetString("tls.letsencrypt_listen"), check.Equals, ":http")
+	c.Assert(viper.GetString("tls.letsencrypt_challenge_type"), check.Equals, "HTTP-01")
 	c.Assert(viper.GetStringSlice("dns_config.nameservers")[0], check.Equals, "1.1.1.1")
 	c.Assert(
 		util.GetFileMode("unix_socket_permission"),
@@ -103,9 +103,9 @@ func (*Suite) TestConfigLoading(c *check.C) {
 	c.Assert(viper.GetString("metrics_listen_addr"), check.Equals, "127.0.0.1:9090")
 	c.Assert(viper.GetString("database.type"), check.Equals, "sqlite")
 	c.Assert(viper.GetString("database.sqlite.path"), check.Equals, "/var/lib/headscale/db.sqlite")
-	c.Assert(viper.GetString("tls_letsencrypt_hostname"), check.Equals, "")
-	c.Assert(viper.GetString("tls_letsencrypt_listen"), check.Equals, ":http")
-	c.Assert(viper.GetString("tls_letsencrypt_challenge_type"), check.Equals, "HTTP-01")
+	c.Assert(viper.GetString("tls.letsencrypt_hostname"), check.Equals, "")
+	c.Assert(viper.GetString("tls.letsencrypt_listen"), check.Equals, ":http")
+	c.Assert(viper.GetString("tls.letsencrypt_challenge_type"), check.Equals, "HTTP-01")
 	c.Assert(viper.GetStringSlice("dns_config.nameservers")[0], check.Equals, "1.1.1.1")
 	c.Assert(
 		util.GetFileMode("unix_socket_permission"),
@@ -193,6 +193,8 @@ noise:
 		".*Fatal config error: server_url must start with https:// or http://.*",
 	)
 
+	viper.Reset()
+
 	// Check configuration validation errors (2)
 	configYaml = []byte(`---
 noise:
diff --git a/hscontrol/types/config.go b/hscontrol/types/config.go
index 664eafb1..3db64b4b 100644
--- a/hscontrol/types/config.go
+++ b/hscontrol/types/config.go
@@ -180,6 +180,13 @@ type Tuning struct {
 	NodeMapSessionBufferedChanSize int
 }
 
+func RegisterDeprecatedAlias(old, new string) {
+	if viper.IsSet(old) {
+		log.Warn().Msgf("%s is deprecated and may be removed in future versions, please use %s instead.", old, new)
+		viper.Set(new, viper.GetString(old))
+	}
+}
+
 func LoadConfig(path string, isFile bool) error {
 	if isFile {
 		viper.SetConfigFile(path)
@@ -246,18 +253,6 @@ func LoadConfig(path string, isFile bool) error {
 
 	viper.SetDefault("prefixes.allocation", string(IPAllocationStrategySequential))
 
-	viper.RegisterAlias("grpc_listen_addr", "grpc.listen_addr")
-	viper.RegisterAlias("grpc_allow_insecure", "grpc.allow_insecure")
-
-	viper.RegisterAlias("acme_url", "tls.acme_url")
-	viper.RegisterAlias("acme_email", "tls.acme_email")
-	viper.RegisterAlias("tls_letsencrypt_hostname", "tls.letsencrypt_hostname")
-	viper.RegisterAlias("tls_letsencrypt_cache_dir", "tls.letsencrypt_cache_dir")
-	viper.RegisterAlias("tls_letsencrypt_challenge_type", "tls.letsencrypt_challenge_type")
-	viper.RegisterAlias("tls_letsencrypt_listen", "tls.letsencrypt_listen")
-	viper.RegisterAlias("tls_cert_path", "tls.cert_path")
-	viper.RegisterAlias("tls_key_path", "tls.key_path")
-
 	if IsCLIConfigured() {
 		return nil
 	}
@@ -268,6 +263,17 @@ func LoadConfig(path string, isFile bool) error {
 		return fmt.Errorf("fatal error reading config file: %w", err)
 	}
 
+	RegisterDeprecatedAlias("grpc_listen_addr", "grpc.listen_addr")
+	RegisterDeprecatedAlias("grpc_allow_insecure", "grpc.allow_insecure")
+	RegisterDeprecatedAlias("acme_url", "tls.acme_url")
+	RegisterDeprecatedAlias("acme_email", "tls.acme_email")
+	RegisterDeprecatedAlias("tls_letsencrypt_hostname", "tls.letsencrypt_hostname")
+	RegisterDeprecatedAlias("tls_letsencrypt_cache_dir", "tls.letsencrypt_cache_dir")
+	RegisterDeprecatedAlias("tls_letsencrypt_challenge_type", "tls.letsencrypt_challenge_type")
+	RegisterDeprecatedAlias("tls_letsencrypt_listen", "tls.letsencrypt_listen")
+	RegisterDeprecatedAlias("tls_cert_path", "tls.cert_path")
+	RegisterDeprecatedAlias("tls_key_path", "tls.key_path")
+
 	// Collect any validation errors and return them all at once
 	var errorText string
 	if (viper.GetString("tls.letsencrypt_hostname") != "") &&