diff --git a/internal/config/config_validation_test.go b/internal/config/config_validation_test.go
index c5dbc92..127c0d7 100644
--- a/internal/config/config_validation_test.go
+++ b/internal/config/config_validation_test.go
@@ -414,6 +414,35 @@ func TestExplicitlyEmptyDBURLAbortsStartup(t *testing.T) {
 	}
 }
 
+// TestAllowlistHostsRejectsDotOnlyEntries verifies that entries with no
+// hostname labels are rejected. The allowlist matcher treats a leading
+// dot as a suffix pattern, so a bare "." entry would match any upstream
+// host written in FQDN trailing-dot form (e.g. evil.com.) and
+// effectively disable URL signing with a single character.
+func TestAllowlistHostsRejectsDotOnlyEntries(t *testing.T) {
+	signingKeyLine := "signing_key: " + validTestSigningKey + "\n"
+
+	for _, entry := range []string{".", ".."} {
+		t.Run(entry, func(t *testing.T) {
+			yamlContent := signingKeyLine +
+				"allowlist_hosts:\n  - \"" + entry + "\"\n"
+
+			c, err := configFromYAML(t, yamlContent)
+			if err == nil {
+				t.Fatalf("allowlist entry %q must abort startup, got config: %+v",
+					entry, c)
+			}
+
+			t.Logf("got expected error: %v", err)
+
+			if !strings.Contains(err.Error(), "allowlist_hosts") {
+				t.Errorf("error %q does not name the offending key allowlist_hosts",
+					err.Error())
+			}
+		})
+	}
+}
+
 func TestUnknownTopLevelKeyAbortsStartup(t *testing.T) {
 	yamlContent := `signing_key: ` + validTestSigningKey + `
 whitelist_hosts: