diff --git a/src/core/devices/nm-device.c b/src/core/devices/nm-device.c
index 6f29d391d9..22a9b55e3c 100644
--- a/src/core/devices/nm-device.c
+++ b/src/core/devices/nm-device.c
@@ -14946,6 +14946,8 @@ typedef struct {
 static gboolean
 set_managed(NMDevice *self, gboolean managed, NMDeviceManagedFlags flags, GError **error)
 {
+    nm_assert((flags & ~NM_DEVICE_MANAGED_FLAGS_ALL) == 0);
+
     g_object_set(self, NM_DEVICE_MANAGED, managed, NULL);
 
     return TRUE;
@@ -14967,6 +14969,13 @@ set_managed_cb(NMDevice              *self,
     flags   = set_managed_data->managed_flags;
     nm_g_slice_free(set_managed_data);
 
+    if (!error && (flags & ~NM_DEVICE_MANAGED_FLAGS_ALL) != 0) {
+        g_set_error_literal(&error,
+                            NM_DEVICE_ERROR,
+                            NM_DEVICE_ERROR_INVALID_ARGUMENT,
+                            "Invalid flags");
+    }
+
     if (error) {
         nm_audit_log_device_op(NM_AUDIT_OP_DEVICE_MANAGED,
                                self,
diff --git a/src/libnm-core-public/nm-dbus-interface.h b/src/libnm-core-public/nm-dbus-interface.h
index 0bbd6ef9d8..1ead6f4adc 100644
--- a/src/libnm-core-public/nm-dbus-interface.h
+++ b/src/libnm-core-public/nm-dbus-interface.h
@@ -1259,6 +1259,8 @@ typedef enum /*< flags >*/ {
  */
 typedef enum /*< flags >*/ {
     NM_DEVICE_MANAGED_FLAGS_NONE = 0,
+
+    NM_DEVICE_MANAGED_FLAGS_ALL = 0, /* <skip> */
 } NMDeviceManagedFlags;
 
 /**