diff --git a/src/ci_orchestrator/winimage/iso_patch.py b/src/ci_orchestrator/winimage/iso_patch.py
index 3ba2f6f..603eff3 100644
--- a/src/ci_orchestrator/winimage/iso_patch.py
+++ b/src/ci_orchestrator/winimage/iso_patch.py
@@ -12,6 +12,7 @@ EFI El Torito boot image (the no-prompt variant Microsoft ships on the ISO).
 
 from __future__ import annotations
 
+import re
 import shutil
 import subprocess
 from pathlib import Path
@@ -62,8 +63,11 @@ def _read_volid(base_iso: Path) -> str:
             check=False,
         )
         label = proc.stdout.strip()
-    # Joliet volume ids are capped at 16 chars; longer ids make xorriso warn.
-    return (label or "WINSERVER")[:16]
+    # Sanitise to strict ISO 9660 d-characters (A-Z 0-9 _) and cap at 16 (Joliet
+    # limit) so xorriso doesn't warn about a non-compliant volume id. The label
+    # is cosmetic — Windows boots from the El Torito images, not the volid.
+    clean = re.sub(r"[^A-Z0-9_]", "_", (label or "WINSERVER").upper())
+    return clean[:16] or "WINSERVER"
 
 
 def _check_free_space(base_iso: Path, work_parent: Path) -> None: