diff --git a/hive-c0re/src/bin/hivectl.rs b/hive-c0re/src/bin/hivectl.rs
index f3bbe5f7..b47a6a1c 100644
--- a/hive-c0re/src/bin/hivectl.rs
+++ b/hive-c0re/src/bin/hivectl.rs
@@ -1751,6 +1751,9 @@ async fn subvol_snapshot_create(name: &str, label: String) -> Result<()> {
     if !label.starts_with("hive-") {
         bail!("snapshot label {label:?} must start with \"hive-\"");
     }
+    if label.contains("..") {
+        bail!("snapshot label {label:?} must not contain \"..\"");
+    }
     let path = hive_c0re::priv_client::snapshot_agent_subvolume(name, &label)
         .await
         .with_context(|| format!("snapshot {name} state subvolume (label {label:?})"))?;
diff --git a/hive-priv/src/main.rs b/hive-priv/src/main.rs
index 453108ce..a031cb7b 100644
--- a/hive-priv/src/main.rs
+++ b/hive-priv/src/main.rs
@@ -455,6 +455,16 @@ fn validate_credential_name(name: &str) -> Result<()> {
     {
         bail!("invalid credential name {name:?}: must be non-empty [A-Za-z0-9_.-]");
     }
+    // `.` is in the allowed charset (systemd credential ids and snapshot
+    // labels both legitimately use dots), but a bare `..` reads as a
+    // directory-traversal token to anyone auditing this path — and a
+    // caller that builds a path via `PathBuf::from(name)` instead of the
+    // current `format!("...{name}...")` embedding would actually be
+    // exploitable. Reject it outright rather than relying on every future
+    // caller getting the embedding right.
+    if name.contains("..") {
+        bail!("invalid credential name {name:?}: must not contain \"..\"");
+    }
     Ok(())
 }