diff --git a/scripts/ipa/create-nixos-ipa-host-account.sh b/scripts/ipa/create-nixos-ipa-host-account.sh
index a93b507..635dba2 100755
--- a/scripts/ipa/create-nixos-ipa-host-account.sh
+++ b/scripts/ipa/create-nixos-ipa-host-account.sh
@@ -81,6 +81,14 @@ if [[ -z "${TARGET}" ]]; then
   usage 1
 fi
 
+# Reject FQDNs passed by mistake — the script appends HOME_DOMAIN itself.
+# "nixos.sweet.home" → FQDN would become "nixos.sweet.home.sweet.home".
+if [[ "${TARGET}" == *"."* ]]; then
+  echo "Error: <hostname> must be the short name (e.g. 'nixos'), not a FQDN." >&2
+  echo "       The FQDN is derived automatically as ${TARGET}.${HOME_DOMAIN}." >&2
+  exit 1
+fi
+
 FQDN="${TARGET}.${HOME_DOMAIN}"
 KEYTAB_SECRET="${REPO_ROOT}/secrets/${TARGET}.keytab"
 # Temp path on the domain controller — use a name that won't collide.