diff --git a/site/profiles/templates/dns/dns-update.sh.epp b/site/profiles/templates/dns/dns-update.sh.epp
index 9001b8d..ce3d872 100644
--- a/site/profiles/templates/dns/dns-update.sh.epp
+++ b/site/profiles/templates/dns/dns-update.sh.epp
@@ -20,7 +20,15 @@ applied="$(grep -vE '^[[:space:]]*(#|$)' "$STATE" 2>/dev/null | sort -u || true)
 [ "$desired" = "$applied" ] && exit 0
 
 fqdn() { # name zone
-  if [ -z "$1" ] || [ "$1" = "@" ]; then printf '%s.' "$2"; else printf '%s.%s.' "$1" "$2"; fi
+  # $1 may be relative to the zone, "@"/empty for the apex, or already a FQDN
+  # (trailing dot). Only append the zone in the relative case; appending it to
+  # an already-qualified name yields a "..", which nsupdate rejects as an
+  # "invalid owner name: empty label".
+  case "$1" in
+    ''|'@') printf '%s.' "$2" ;;
+    *.)     printf '%s' "$1" ;;
+    *)      printf '%s.%s.' "$1" "$2" ;;
+  esac
 }
 
 msg="$(mktemp)"