diff --git a/tasks/setup.yml b/tasks/setup.yml
index 61db2d5..c697f95 100644
--- a/tasks/setup.yml
+++ b/tasks/setup.yml
@@ -18,11 +18,12 @@
         that:
           - app_name is defined
           - app_name | length > 0
-          - app_name is match('^[a-zA-Z0-9_-]+$')
+          - app_name is match('^[a-zA-Z0-9_.-]+$')
           - host_root_path is defined
           - host_root_path | length > 0
-          - host_root_path is match('^/[a-zA-Z0-9/_-]*$')
-        fail_msg: "Validation failed for {{ app_name | default('undefined') }}: Required variables missing or contain invalid characters. app_name and host_root_path must be defined and contain only alphanumeric, underscore, hyphen, and slash characters."
+          - host_root_path is match('^/[a-zA-Z0-9./_-]*$')
+          - not (host_root_path is match('.*\.\..*'))
+        fail_msg: "Validation failed for {{ app_name | default('undefined') }}: Required variables missing or contain invalid characters. app_name and host_root_path must be defined, contain only alphanumeric, dot, underscore, hyphen, and slash characters, and must not contain path traversal sequences."
 
     - name: Set compose source type
       ansible.builtin.set_fact:
@@ -43,7 +44,7 @@
     - name: Validate directory paths
       ansible.builtin.assert:
         that:
-          - app_dir is match('^/[a-zA-Z0-9/_-]*$')
+          - app_dir is match('^/[a-zA-Z0-9./_-]*$')
           - not (app_dir is match('.*\.\..*'))
         fail_msg: "Security validation failed for {{ app_name }}: app_dir '{{ app_dir }}' contains invalid characters or path traversal sequences"