diff --git a/internal/config/config.go b/internal/config/config.go
index 95864fa..cb5b9b9 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -312,7 +312,11 @@ func (c *Config) validate() error {
 
 // validateAllowlistHost checks that an allowlist_hosts entry is a bare
 // hostname, optionally with a leading dot for suffix matching. URLs,
-// paths, and whitespace indicate a misconfigured entry.
+// paths, and whitespace indicate a misconfigured entry. An entry with
+// no hostname labels (such as ".") is rejected: the allowlist matcher
+// treats a leading dot as a suffix pattern, so a bare "." would match
+// any upstream host written in FQDN trailing-dot form and effectively
+// disable URL signing.
 func validateAllowlistHost(host string) error {
 	if strings.Contains(host, "://") || strings.ContainsAny(host, "/ \t") {
 		return fmt.Errorf(
@@ -320,6 +324,12 @@ func validateAllowlistHost(host string) error {
 			"allowlist_hosts", host)
 	}
 
+	if strings.Trim(host, ".") == "" {
+		return fmt.Errorf(
+			"config key %q: entry %q contains no hostname labels",
+			"allowlist_hosts", host)
+	}
+
 	return nil
 }