diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr
index 052d12cec..c809c3434 100644
--- a/net/haproxy/pkg-descr
+++ b/net/haproxy/pkg-descr
@@ -11,6 +11,9 @@ Plugin Changelog
 Added:
 * add SSL SNI setting to servers and health checks (#2388)
 
+Fixed:
+* fix custom TCP health checks (#2653)
+
 Changed:
 * replace "force SSL" setting with "SSL preferences" in health checks (#2388)
 * health check port is no longer an advanced option
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 8eb29fb40..71e377f18 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -1487,25 +1487,29 @@ backend {{backend.name}}
 {%           set healthcheck_enabled = '0' %}
 {%         elif healthcheck_data.type == 'tcp' %}
 {#           # custom TCP health check option #}
+{#           # TODO: add support for multiple send/expect steps, see plugins/#2653 #}
 {%           if healthcheck_data.tcp_enabled|default("") == '1' %}
-{#             # validate options: both must not be disabled at the same time #}
+{#             # check if any of the required values can be found #}
 {%             if healthcheck_data.tcp_sendValue|default("") == "" and healthcheck_data.tcp_matchValue|default("") == "" %}
-    # ERROR: invalid custom TCP health check, missing "sendValue" or "matchValue"
+    # ERROR: invalid custom TCP health check, missing send/expect data
 {%             else %}
+    option tcp-check
+{#             # check for "send" value #}
+{%             if healthcheck_data.tcp_sendValue|default("") != "" %}
+    tcp-check send {{healthcheck_data.tcp_sendValue}}
+{%             endif %}
 {%               set healthcheck_customtcp = [] %}
-{%               do healthcheck_customtcp.append('send ' ~ healthcheck_data.tcp_sendValue) if healthcheck_data.tcp_sendValue|default("") != "" %}
 {%               if healthcheck_data.tcp_matchValue|default("") != "" %}
-{%                 do healthcheck_customtcp.append('expect ' ~ healthcheck_data.tcp_matchType) %}
+{%                 do healthcheck_customtcp.append(healthcheck_data.tcp_matchType) %}
 {%                 if healthcheck_data.tcp_negate == '1' and healthcheck_data.tcp_matchType|default("") != 'binary' %}
 {%                   do healthcheck_customtcp.append('!') %}
 {%                 endif %}
 {%                 do healthcheck_customtcp.append(healthcheck_data.tcp_matchValue) %}
 {%               endif %}
-{#               # XXX: some values (send/match) must be properly escaped (whitespace) #}
-{#               # TODO: add support for multiple send/expect steps #}
-    option tcp-check
-    tcp-check connect
-    tcp-check {{healthcheck_customtcp|join(' ')}}
+{#               # check for "expect" value #}
+{%               if (healthcheck_customtcp|length > 0 ) %}
+    tcp-check expect {{healthcheck_customtcp|join(' ')}}
+{%               endif %}
 {%             endif %}
 {%           endif %}
 {%         elif healthcheck_data.type == 'http' %}