diff --git a/pkg/cluster/spec/tiproxy.go b/pkg/cluster/spec/tiproxy.go
index 2cfe1c421e..63d4823a1e 100644
--- a/pkg/cluster/spec/tiproxy.go
+++ b/pkg/cluster/spec/tiproxy.go
@@ -136,8 +136,15 @@ func (c *TiProxyComponent) Source() string {
 
 // CalculateVersion implements the Component interface
 func (c *TiProxyComponent) CalculateVersion(clusterVersion string) string {
-	// always not follow global version, use ""(latest) by default
 	version := c.Topology.ComponentVersions.TiProxy
+	if version == "" {
+		// always not follow global version
+		// because tiproxy version is different from clusterVersion
+		// but "nightly" is effective
+		if clusterVersion == "nightly" {
+			version = clusterVersion
+		}
+	}
 	return version
 }
 
@@ -224,7 +231,6 @@ func (i *TiProxyInstance) checkConfig(
 		pds = append(pds, pdspec.GetAdvertiseClientURL(enableTLS))
 	}
 	cfg["proxy.pd-addrs"] = strings.Join(pds, ",")
-	cfg["proxy.require-backend-tls"] = false
 	cfg["proxy.addr"] = utils.JoinHostPort(i.GetListenHost(), i.GetPort())
 	cfg["api.addr"] = utils.JoinHostPort(i.GetListenHost(), spec.StatusPort)
 	cfg["log.log-file.filename"] = filepath.Join(paths.Log, "tiproxy.log")
@@ -311,7 +317,7 @@ func (i *TiProxyInstance) setTLSConfig(ctx context.Context, enableTLS bool, conf
 		}
 	}
 
-	return nil, nil
+	return configs, nil
 }
 
 var _ RollingUpdateInstance = &TiProxyInstance{}
diff --git a/pkg/cluster/spec/validate.go b/pkg/cluster/spec/validate.go
index 486cfbcd8d..3ad76e57aa 100644
--- a/pkg/cluster/spec/validate.go
+++ b/pkg/cluster/spec/validate.go
@@ -938,6 +938,7 @@ func (s *Specification) validateTLSEnabled() error {
 			ComponentTiDB,
 			ComponentTiKV,
 			ComponentTiFlash,
+			ComponentTiProxy,
 			ComponentPump,
 			ComponentDrainer,
 			ComponentCDC,