diff --git a/pkg/fn/runtime/tag_resolution.go b/pkg/fn/runtime/tag_resolution.go
index 18ae91e7f5..9572dede50 100644
--- a/pkg/fn/runtime/tag_resolution.go
+++ b/pkg/fn/runtime/tag_resolution.go
@@ -17,6 +17,7 @@ package runtime
 import (
 	"context"
 	"fmt"
+	"regexp"
 	"slices"
 	"strings"
 
@@ -25,6 +26,10 @@ import (
 	"k8s.io/klog/v2"
 )
 
+const imageTagError = "must start with an alphanumeric character or underscore, followed by at most 127 alphanumeric characters, underscores, periods, or dashes"
+
+var imageTagRegex = regexp.MustCompile(`^[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$`)
+
 // TagLister is an interface for listing tags for/from a function runtime/runner
 type TagLister interface {
 	Name() string
@@ -85,10 +90,22 @@ func (tr *TagResolver) ResolveFunctionImage(ctx context.Context, image, tag stri
 		ref.Tag = allFilteredVersions[0].Original()
 		return ref.CommonName(), nil
 	} else {
+		resolvedImage, tagErr := imageWithLiteralTag(ref, tag)
+		if tagErr != nil {
+			return "", tagErr
+		}
 		klog.Warningf("Tag %q could not be parsed as a semantic version (\"%s\") or constraint (\"%s\"), will use it literally",
 			tag, versionErr, constraintErr)
+		return resolvedImage, nil
 	}
 
+	return imageWithLiteralTag(ref, tag)
+}
+
+func imageWithLiteralTag(ref regclientref.Ref, tag string) (string, error) {
+	if !imageTagRegex.MatchString(tag) {
+		return "", fmt.Errorf("`function.tag` %q must be a valid image tag: %s", tag, imageTagError)
+	}
 	ref.Tag = tag
 	return ref.CommonName(), nil
 }
diff --git a/pkg/fn/runtime/tag_resolution_test.go b/pkg/fn/runtime/tag_resolution_test.go
index 24b6099566..24cfe0dfa8 100644
--- a/pkg/fn/runtime/tag_resolution_test.go
+++ b/pkg/fn/runtime/tag_resolution_test.go
@@ -146,6 +146,12 @@ func TestResolveFunctionImage(t *testing.T) {
 			repoTags:      tagSet,
 			expectedTag:   "v0.3.1",
 		},
+		"exact semver tag with invalid image tag syntax": {
+			functionImage: image,
+			functionTag:   "v0.3.1+build",
+			repoTags:      tagSet,
+			expectedErr:   "`function.tag` \"v0.3.1+build\" must be a valid image tag",
+		},
 		"no listing with exact semver tag": {
 			functionImage: image,
 			functionTag:   "v0.3.1",
@@ -164,6 +170,12 @@ func TestResolveFunctionImage(t *testing.T) {
 			repoErr:       "test",
 			expectedTag:   "master-git-38f885f",
 		},
+		"invalid non-semver tag": {
+			functionImage: image,
+			functionTag:   ">>0.1",
+			repoTags:      tagSet,
+			expectedErr:   "`function.tag` \">>0.1\" must be a valid image tag",
+		},
 		"list failure": {
 			functionImage: image,
 			functionTag:   "~0.1",