diff --git a/app/controllers/addresses_controller.rb b/app/controllers/addresses_controller.rb
index ddfba73..0b8f86a 100644
--- a/app/controllers/addresses_controller.rb
+++ b/app/controllers/addresses_controller.rb
@@ -46,8 +46,11 @@ def set_person
     @person = Person.find(params[:person_id])
   end
 
+  # A person has at most one address, and may have none yet: show, update and
+  # destroy on a person without one are a 404, not a nil blowing up in the
+  # action.
   def set_address
-    @address = @person.address
+    @address = @person.address || raise(ActiveRecord::RecordNotFound.new("Person #{@person.id} has no address", "Address"))
   end
 
   def address_params
diff --git a/test/controllers/addresses_controller_test.rb b/test/controllers/addresses_controller_test.rb
index 93dfabf..dcd8ca3 100644
--- a/test/controllers/addresses_controller_test.rb
+++ b/test/controllers/addresses_controller_test.rb
@@ -25,4 +25,28 @@ class AddressesControllerTest < ActionDispatch::IntegrationTest
     end
     assert_redirected_to person_url(@person)
   end
+
+  test "show is a 404 for a person without an address" do
+    @person.address.destroy
+
+    get person_address_url(@person)
+    assert_response :not_found
+  end
+
+  test "update is a 404 for a person without an address" do
+    @person.address.destroy
+
+    patch person_address_url(@person), params: { address: { city: "Springfield" } }
+    assert_response :not_found
+    assert_equal 0, Address.where(person_id: @person.id).count
+  end
+
+  test "destroy is a 404 for a person without an address" do
+    @person.address.destroy
+
+    assert_no_difference("Address.count") do
+      delete person_address_url(@person)
+    end
+    assert_response :not_found
+  end
 end