diff --git a/internal/configuration/settings/health.go b/internal/configuration/settings/health.go
index 6554acbc..e22adf61 100644
--- a/internal/configuration/settings/health.go
+++ b/internal/configuration/settings/health.go
@@ -24,7 +24,8 @@ type Health struct {
 	TargetAddresses []string
 	// ICMPTargetIP is the IP address to use for ICMP echo requests
 	// in the health checker. It can be set to an unspecified address (0.0.0.0)
-	// such that the VPN server IP is used, which is also the default behavior.
+	// such that the VPN server IP is used, although this can be less reliable.
+	// It defaults to 1.1.1.1, and cannot be left empty (invalid) in the internal state.
 	ICMPTargetIP netip.Addr
 	// RestartVPN indicates whether to restart the VPN connection
 	// when the healthcheck fails.
@@ -62,7 +63,7 @@ func (h *Health) OverrideWith(other Health) {
 func (h *Health) SetDefaults() {
 	h.ServerAddress = gosettings.DefaultComparable(h.ServerAddress, "127.0.0.1:9999")
 	h.TargetAddresses = gosettings.DefaultSlice(h.TargetAddresses, []string{"cloudflare.com:443", "github.com:443"})
-	h.ICMPTargetIP = gosettings.DefaultComparable(h.ICMPTargetIP, netip.IPv4Unspecified()) // use the VPN server IP
+	h.ICMPTargetIP = gosettings.DefaultComparable(h.ICMPTargetIP, netip.AddrFrom4([4]byte{1, 1, 1, 1}))
 	h.RestartVPN = gosettings.DefaultPointer(h.RestartVPN, true)
 }
 
diff --git a/internal/configuration/settings/settings_test.go b/internal/configuration/settings/settings_test.go
index 231fc2e6..8c4dbc2c 100644
--- a/internal/configuration/settings/settings_test.go
+++ b/internal/configuration/settings/settings_test.go
@@ -60,7 +60,7 @@ func Test_Settings_String(t *testing.T) {
 |   ├── Target addresses:
 |   |   ├── cloudflare.com:443
 |   |   └── github.com:443
-|   ├── ICMP target IP: VPN server IP
+|   ├── ICMP target IP: 1.1.1.1
 |   └── Restart VPN on healthcheck failure: yes
 ├── Shadowsocks server settings:
 |   └── Enabled: no