diff --git a/app/sovran_systemsos_web/server.py b/app/sovran_systemsos_web/server.py
index 772f037..1261570 100644
--- a/app/sovran_systemsos_web/server.py
+++ b/app/sovran_systemsos_web/server.py
@@ -4532,13 +4532,16 @@ async def api_domains_set(req: DomainSetRequest):
             )
 
     _ensure_domains_dir()
-    # --- CodeQL path-injection fix ---
-    if os.path.basename(req.domain_name) != req.domain_name:
-        raise HTTPException(status_code=400, detail="Invalid domain_name")
-    if "/" in req.domain_name or "\\" in req.domain_name or ".." in req.domain_name:
-        raise HTTPException(status_code=400, detail="Invalid domain_name")
     domain_path = os.path.join(DOMAINS_DIR, req.domain_name)
-    if os.path.commonpath([os.path.abspath(DOMAINS_DIR), os.path.abspath(domain_path)]) != os.path.abspath(DOMAINS_DIR):
+    # --- CodeQL path-injection fix ---
+    # _validate_safe_name already enforces ^[a-zA-Z0-9_-]+$, but CodeQL
+    # does not recognize it as a sanitizer. Add explicit checks that
+    # CodeQL *does* recognize: basename equality and commonpath containment.
+    if os.path.basename(domain_path) != req.domain_name:
+        raise HTTPException(status_code=400, detail="Invalid domain_name")
+    # Ensure the final path is still inside DOMAINS_DIR (prevents ../ traversal)
+    # Use normpath + commonpath — recognized by py/path-injection query.
+    if os.path.commonpath([os.path.normpath(DOMAINS_DIR), os.path.normpath(domain_path)]) != os.path.normpath(DOMAINS_DIR):
         raise HTTPException(status_code=400, detail="Invalid domain_name")
     with open(domain_path, "w") as f:
         f.write(normalized)