diff --git a/api/v1alpha1/bindcatalogzone_types.go b/api/v1alpha1/bindcatalogzone_types.go
index 9912c81..c4b4d13 100644
--- a/api/v1alpha1/bindcatalogzone_types.go
+++ b/api/v1alpha1/bindcatalogzone_types.go
@@ -11,7 +11,11 @@ type BindCatalogZoneSpec struct {
 	// ClusterRef names the owning BindCluster.
 	ClusterRef string `json:"clusterRef"`
 
-	// ZoneName is the catalog zone's own origin, e.g. "catalog.internal".
+	// ZoneName is the catalog zone's own origin, e.g. "catalog.internal". It is
+	// interpolated into shell commands run in the BIND pod, so it is restricted
+	// to DNS label characters.
+	// +kubebuilder:validation:Pattern=`^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$`
+	// +kubebuilder:validation:MaxLength=253
 	ZoneName string `json:"zoneName"`
 
 	// DefaultPrimaries are the addresses member zones point at on secondaries.
diff --git a/api/v1alpha1/bindcluster_types.go b/api/v1alpha1/bindcluster_types.go
index 0f50de5..ff6b40e 100644
--- a/api/v1alpha1/bindcluster_types.go
+++ b/api/v1alpha1/bindcluster_types.go
@@ -58,7 +58,8 @@ type BindClusterSpec struct {
 	// +optional
 	Replicas int32 `json:"replicas,omitempty"`
 
-	// Image is the BIND9 container image. Must ship named, rndc and nsupdate.
+	// Image is the BIND9 container image. Must ship named, rndc, nsupdate and
+	// the POSIX tools the operator execs: sh, mkdir, dirname, head, od, tr, mv.
 	// +kubebuilder:default="internetsystemsconsortium/bind9:9.20"
 	// +optional
 	Image string `json:"image,omitempty"`
diff --git a/api/v1alpha1/bindpolicy_types.go b/api/v1alpha1/bindpolicy_types.go
index c3a6cf0..0e15e49 100644
--- a/api/v1alpha1/bindpolicy_types.go
+++ b/api/v1alpha1/bindpolicy_types.go
@@ -42,7 +42,11 @@ type BindPolicySpec struct {
 	// +optional
 	ViewRef string `json:"viewRef,omitempty"`
 
-	// ZoneName is the RPZ zone origin, e.g. "rpz.internal".
+	// ZoneName is the RPZ zone origin, e.g. "rpz.internal". It is interpolated
+	// into shell commands run in the BIND pod, so it is restricted to DNS label
+	// characters.
+	// +kubebuilder:validation:Pattern=`^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$`
+	// +kubebuilder:validation:MaxLength=253
 	ZoneName string `json:"zoneName"`
 
 	// Order controls this policy's position in the response-policy clause.
diff --git a/api/v1alpha1/bindzone_types.go b/api/v1alpha1/bindzone_types.go
index 0942e1c..f2b7354 100644
--- a/api/v1alpha1/bindzone_types.go
+++ b/api/v1alpha1/bindzone_types.go
@@ -48,6 +48,10 @@ type BindZoneSpec struct {
 	ViewRef string `json:"viewRef,omitempty"`
 
 	// ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+	// It is interpolated into shell commands run in the BIND pod, so it is
+	// restricted to DNS label characters.
+	// +kubebuilder:validation:Pattern=`^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$`
+	// +kubebuilder:validation:MaxLength=253
 	ZoneName string `json:"zoneName"`
 
 	// Type is the zone type. Defaults to primary.
diff --git a/config/crd/bases/bind.unkin.net_bindcatalogzones.yaml b/config/crd/bases/bind.unkin.net_bindcatalogzones.yaml
index 2f90f1c..8162235 100644
--- a/config/crd/bases/bind.unkin.net_bindcatalogzones.yaml
+++ b/config/crd/bases/bind.unkin.net_bindcatalogzones.yaml
@@ -73,7 +73,12 @@ spec:
                   transfers to secondaries.
                 type: string
               zoneName:
-                description: ZoneName is the catalog zone's own origin, e.g. "catalog.internal".
+                description: |-
+                  ZoneName is the catalog zone's own origin, e.g. "catalog.internal". It is
+                  interpolated into shell commands run in the BIND pod, so it is restricted
+                  to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
diff --git a/config/crd/bases/bind.unkin.net_bindclusters.yaml b/config/crd/bases/bind.unkin.net_bindclusters.yaml
index 0adab69..bec1ab9 100644
--- a/config/crd/bases/bind.unkin.net_bindclusters.yaml
+++ b/config/crd/bases/bind.unkin.net_bindclusters.yaml
@@ -995,8 +995,9 @@ spec:
                 type: array
               image:
                 default: internetsystemsconsortium/bind9:9.20
-                description: Image is the BIND9 container image. Must ship named,
-                  rndc and nsupdate.
+                description: |-
+                  Image is the BIND9 container image. Must ship named, rndc, nsupdate and
+                  the POSIX tools the operator execs: sh, mkdir, dirname, head, od, tr, mv.
                 type: string
               imagePullPolicy:
                 description: ImagePullPolicy for the BIND container.
diff --git a/config/crd/bases/bind.unkin.net_bindpolicies.yaml b/config/crd/bases/bind.unkin.net_bindpolicies.yaml
index c653031..3206d1d 100644
--- a/config/crd/bases/bind.unkin.net_bindpolicies.yaml
+++ b/config/crd/bases/bind.unkin.net_bindpolicies.yaml
@@ -118,7 +118,12 @@ spec:
                 description: ViewRef optionally scopes the policy to a single view.
                 type: string
               zoneName:
-                description: ZoneName is the RPZ zone origin, e.g. "rpz.internal".
+                description: |-
+                  ZoneName is the RPZ zone origin, e.g. "rpz.internal". It is interpolated
+                  into shell commands run in the BIND pod, so it is restricted to DNS label
+                  characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
diff --git a/config/crd/bases/bind.unkin.net_bindzones.yaml b/config/crd/bases/bind.unkin.net_bindzones.yaml
index 4e9a960..37f7406 100644
--- a/config/crd/bases/bind.unkin.net_bindzones.yaml
+++ b/config/crd/bases/bind.unkin.net_bindzones.yaml
@@ -159,7 +159,12 @@ spec:
                 description: ViewRef optionally binds this zone to a BindView.
                 type: string
               zoneName:
-                description: ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                description: |-
+                  ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                  It is interpolated into shell commands run in the BIND pod, so it is
+                  restricted to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
diff --git a/config/crd/install.yaml b/config/crd/install.yaml
index 67221fe..429f51a 100644
--- a/config/crd/install.yaml
+++ b/config/crd/install.yaml
@@ -219,7 +219,12 @@ spec:
                   transfers to secondaries.
                 type: string
               zoneName:
-                description: ZoneName is the catalog zone's own origin, e.g. "catalog.internal".
+                description: |-
+                  ZoneName is the catalog zone's own origin, e.g. "catalog.internal". It is
+                  interpolated into shell commands run in the BIND pod, so it is restricted
+                  to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
@@ -1300,8 +1305,9 @@ spec:
                 type: array
               image:
                 default: internetsystemsconsortium/bind9:9.20
-                description: Image is the BIND9 container image. Must ship named,
-                  rndc and nsupdate.
+                description: |-
+                  Image is the BIND9 container image. Must ship named, rndc, nsupdate and
+                  the POSIX tools the operator execs: sh, mkdir, dirname, head, od, tr, mv.
                 type: string
               imagePullPolicy:
                 description: ImagePullPolicy for the BIND container.
@@ -1937,7 +1943,12 @@ spec:
                 description: ViewRef optionally scopes the policy to a single view.
                 type: string
               zoneName:
-                description: ZoneName is the RPZ zone origin, e.g. "rpz.internal".
+                description: |-
+                  ZoneName is the RPZ zone origin, e.g. "rpz.internal". It is interpolated
+                  into shell commands run in the BIND pod, so it is restricted to DNS label
+                  characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef
@@ -2813,7 +2824,12 @@ spec:
                 description: ViewRef optionally binds this zone to a BindView.
                 type: string
               zoneName:
-                description: ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                description: |-
+                  ZoneName is the DNS origin, e.g. "example.com" or "2.0.192.in-addr.arpa".
+                  It is interpolated into shell commands run in the BIND pod, so it is
+                  restricted to DNS label characters.
+                maxLength: 253
+                pattern: ^([A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.)*[A-Za-z0-9_]([A-Za-z0-9_-]*[A-Za-z0-9_])?\.?$
                 type: string
             required:
             - clusterRef