diff --git a/packages/core/src/__tests__/utils.test.ts b/packages/core/src/__tests__/utils.test.ts
index 85f12643f..6e12eeb6d 100644
--- a/packages/core/src/__tests__/utils.test.ts
+++ b/packages/core/src/__tests__/utils.test.ts
@@ -106,6 +106,11 @@ describe("isGitBranchNameSafe", () => {
     expect(isGitBranchNameSafe(".hidden")).toBe(false);
   });
 
+  it("rejects consecutive slashes and dot-prefixed components", () => {
+    expect(isGitBranchNameSafe("feat//bar")).toBe(false);
+    expect(isGitBranchNameSafe("feat/.hidden")).toBe(false);
+  });
+
   it("rejects characters invalid in git refs", () => {
     expect(isGitBranchNameSafe("bad branch")).toBe(false);
     expect(isGitBranchNameSafe("x:y")).toBe(false);
diff --git a/packages/core/src/utils.ts b/packages/core/src/utils.ts
index ee3bb7465..1f1f94ac7 100644
--- a/packages/core/src/utils.ts
+++ b/packages/core/src/utils.ts
@@ -44,6 +44,8 @@ export function isGitBranchNameSafe(name: string): boolean {
   if (name === "@" || name.startsWith(".") || name.endsWith(".") || name.endsWith("/")) return false;
   if (name.endsWith(".lock")) return false;
   if (name.includes("..")) return false;
+  if (name.includes("//")) return false;
+  if (name.includes("/.")) return false;
   if (name.includes("@{")) return false;
   if (name.startsWith("/")) return false;
   for (let i = 0; i < name.length; i++) {