diff --git a/scripts/src/platform-infra-pipelines-as-code.ts b/scripts/src/platform-infra-pipelines-as-code.ts
index f864b7d3..5411d82f 100644
--- a/scripts/src/platform-infra-pipelines-as-code.ts
+++ b/scripts/src/platform-infra-pipelines-as-code.ts
@@ -20,6 +20,15 @@ const remoteScriptFile = rootPath("scripts", "src", "platform-infra-pipelines-as
 const fieldManager = "unidesk-platform-infra-pipelines-as-code";
 const y = createYamlFieldReader(configLabel);
 
+function kubernetesLabelValue(value: string): string {
+  const normalized = value
+    .trim()
+    .replace(/[^A-Za-z0-9_.-]+/gu, "-")
+    .replace(/^-+|-+$/gu, "")
+    .slice(0, 63);
+  return normalized.length > 0 ? normalized : "unspecified";
+}
+
 interface PacTarget {
   id: string;
   route: string;
@@ -443,7 +452,7 @@ function remoteScript(action: "apply" | "status" | "webhook-test", pac: PacConfi
     UNIDESK_PAC_ARGO_NAMESPACE: consumer.argoNamespace,
     UNIDESK_PAC_ARGO_APPLICATION: consumer.argoApplication,
     UNIDESK_PAC_PART_OF: consumer.id.startsWith("sentinel") ? "hwlab-web-probe-sentinel" : "agentrun",
-    UNIDESK_PAC_SPEC: pac.metadata.relatedIssues.includes(1555) ? "GH-1552/GH-1555" : pac.metadata.spec,
+    UNIDESK_PAC_SPEC: kubernetesLabelValue(pac.metadata.relatedIssues.includes(1555) ? "GH-1552-GH-1555" : pac.metadata.spec),
   };
   const exports = Object.entries(env).map(([key, value]) => `export ${key}=${shQuote(value)}`).join("\n");
   return `${exports}\n${readFileSync(remoteScriptFile, "utf8")}`;