diff --git a/api/types/swarm/service.go b/api/types/swarm/service.go
index 90df7deeed..0b678dea33 100644
--- a/api/types/swarm/service.go
+++ b/api/types/swarm/service.go
@@ -207,8 +207,12 @@ type JobStatus struct {
 	LastExecution time.Time `json:",omitempty"`
 }
 
+// RegistryAuthSource defines options for the "registryAuthFrom" query parameter
+// on service update.
+type RegistryAuthSource string
+
 // Values for RegistryAuthFrom in ServiceUpdateOptions
 const (
-	RegistryAuthFromSpec         = "spec"
-	RegistryAuthFromPreviousSpec = "previous-spec"
+	RegistryAuthFromSpec         RegistryAuthSource = "spec"
+	RegistryAuthFromPreviousSpec RegistryAuthSource = "previous-spec"
 )
diff --git a/client/service_update.go b/client/service_update.go
index 36061c9d16..9e6b52781e 100644
--- a/client/service_update.go
+++ b/client/service_update.go
@@ -28,7 +28,7 @@ type ServiceUpdateOptions struct {
 	// RegistryAuthFrom specifies where to find the registry authorization
 	// credentials if they are not given in EncodedRegistryAuth. Valid
 	// values are "spec" and "previous-spec".
-	RegistryAuthFrom string
+	RegistryAuthFrom swarm.RegistryAuthSource
 
 	// Rollback indicates whether a server-side rollback should be
 	// performed. When this is set, the provided spec will be ignored.
@@ -65,7 +65,7 @@ func (cli *Client) ServiceUpdate(ctx context.Context, serviceID string, options
 
 	query := url.Values{}
 	if options.RegistryAuthFrom != "" {
-		query.Set("registryAuthFrom", options.RegistryAuthFrom)
+		query.Set("registryAuthFrom", string(options.RegistryAuthFrom))
 	}
 
 	if options.Rollback != "" {
diff --git a/daemon/server/router/swarm/cluster_routes.go b/daemon/server/router/swarm/cluster_routes.go
index 7b47198c99..e4ec2d9757 100644
--- a/daemon/server/router/swarm/cluster_routes.go
+++ b/daemon/server/router/swarm/cluster_routes.go
@@ -276,7 +276,14 @@ func (sr *swarmRouter) updateService(ctx context.Context, w http.ResponseWriter,
 
 	// Get returns "" if the header does not exist
 	flags.EncodedRegistryAuth = r.Header.Get(registry.AuthHeader)
-	flags.RegistryAuthFrom = r.URL.Query().Get("registryAuthFrom")
+	if v := r.URL.Query().Get("registryAuthFrom"); v != "" {
+		switch val := types.RegistryAuthSource(v); val {
+		case types.RegistryAuthFromSpec, types.RegistryAuthFromPreviousSpec:
+			flags.RegistryAuthFrom = val
+		default:
+			return errdefs.InvalidParameter(fmt.Errorf("invalid registryAuthFrom '%s'", v))
+		}
+	}
 	flags.Rollback = r.URL.Query().Get("rollback")
 	queryRegistry := false
 	if v := httputils.VersionFromContext(ctx); v != "" {
diff --git a/daemon/server/swarmbackend/swarm.go b/daemon/server/swarmbackend/swarm.go
index e18cbe27c4..7419da0162 100644
--- a/daemon/server/swarmbackend/swarm.go
+++ b/daemon/server/swarmbackend/swarm.go
@@ -1,6 +1,9 @@
 package swarmbackend
 
-import "github.com/moby/moby/v2/daemon/internal/filters"
+import (
+	"github.com/moby/moby/api/types/swarm"
+	"github.com/moby/moby/v2/daemon/internal/filters"
+)
 
 type ConfigListOptions struct {
 	Filters filters.Args
@@ -34,7 +37,7 @@ type ServiceUpdateOptions struct {
 	// RegistryAuthFrom specifies where to find the registry authorization
 	// credentials if they are not given in EncodedRegistryAuth. Valid
 	// values are "spec" and "previous-spec".
-	RegistryAuthFrom string
+	RegistryAuthFrom swarm.RegistryAuthSource
 
 	// Rollback indicates whether a server-side rollback should be
 	// performed. When this is set, the provided spec will be ignored.
diff --git a/vendor/github.com/moby/moby/api/types/swarm/service.go b/vendor/github.com/moby/moby/api/types/swarm/service.go
index 90df7deeed..0b678dea33 100644
--- a/vendor/github.com/moby/moby/api/types/swarm/service.go
+++ b/vendor/github.com/moby/moby/api/types/swarm/service.go
@@ -207,8 +207,12 @@ type JobStatus struct {
 	LastExecution time.Time `json:",omitempty"`
 }
 
+// RegistryAuthSource defines options for the "registryAuthFrom" query parameter
+// on service update.
+type RegistryAuthSource string
+
 // Values for RegistryAuthFrom in ServiceUpdateOptions
 const (
-	RegistryAuthFromSpec         = "spec"
-	RegistryAuthFromPreviousSpec = "previous-spec"
+	RegistryAuthFromSpec         RegistryAuthSource = "spec"
+	RegistryAuthFromPreviousSpec RegistryAuthSource = "previous-spec"
 )
diff --git a/vendor/github.com/moby/moby/client/service_update.go b/vendor/github.com/moby/moby/client/service_update.go
index 36061c9d16..9e6b52781e 100644
--- a/vendor/github.com/moby/moby/client/service_update.go
+++ b/vendor/github.com/moby/moby/client/service_update.go
@@ -28,7 +28,7 @@ type ServiceUpdateOptions struct {
 	// RegistryAuthFrom specifies where to find the registry authorization
 	// credentials if they are not given in EncodedRegistryAuth. Valid
 	// values are "spec" and "previous-spec".
-	RegistryAuthFrom string
+	RegistryAuthFrom swarm.RegistryAuthSource
 
 	// Rollback indicates whether a server-side rollback should be
 	// performed. When this is set, the provided spec will be ignored.
@@ -65,7 +65,7 @@ func (cli *Client) ServiceUpdate(ctx context.Context, serviceID string, options
 
 	query := url.Values{}
 	if options.RegistryAuthFrom != "" {
-		query.Set("registryAuthFrom", options.RegistryAuthFrom)
+		query.Set("registryAuthFrom", string(options.RegistryAuthFrom))
 	}
 
 	if options.Rollback != "" {