diff --git a/.changelog/5168.internal.md b/.changelog/5168.internal.md
new file mode 100644
index 00000000000..aeac857c665
--- /dev/null
+++ b/.changelog/5168.internal.md
@@ -0,0 +1 @@
+go/consensus/supplementarysanity: Fix checks for legacy validators
diff --git a/go/consensus/tendermint/apps/supplementarysanity/checks.go b/go/consensus/tendermint/apps/supplementarysanity/checks.go
index 0b35afbae45..68e4d555c50 100644
--- a/go/consensus/tendermint/apps/supplementarysanity/checks.go
+++ b/go/consensus/tendermint/apps/supplementarysanity/checks.go
@@ -67,6 +67,7 @@ func checkRegistry(ctx *abciAPI.Context, now beacon.EpochTime) error {
 	if err != nil {
 		return fmt.Errorf("SignedNodes: %w", err)
 	}
+
 	_, err = registry.SanityCheckNodes(logger, params, signedNodes, seenEntities, runtimeLookup, false, now, ctx.Now(), uint64(ctx.BlockHeight()))
 	if err != nil {
 		return fmt.Errorf("SanityCheckNodes: %w", err)
diff --git a/go/registry/api/api.go b/go/registry/api/api.go
index 3f217b862ae..f0991cdb7a9 100644
--- a/go/registry/api/api.go
+++ b/go/registry/api/api.go
@@ -706,9 +706,10 @@ func VerifyRegisterNodeArgs( // nolint: gocyclo
 	}
 	expectedSigners = append(expectedSigners, n.P2P.ID)
 	p2pAddressRequired := n.HasRoles(P2PAddressRequiredRoles)
-	switch isGenesis {
+	switch isGenesis || isSanityCheck {
 	case true:
 		// Allow legacy descriptor with optional p2p address for validator.
+		// XXX: Remove this after 23.0.x.
 		if n.HasRoles(node.RoleValidator) {
 			p2pAddressRequired = false
 		}