diff --git a/policy/validate_http_host_idna15_test.go b/policy/validate_http_host_idna15_test.go
new file mode 100644
index 000000000000..5cdff1571c4e
--- /dev/null
+++ b/policy/validate_http_host_idna15_test.go
@@ -0,0 +1,17 @@
+//go:build !go1.27
+
+package policy
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeHTTPHostInvalidUTF8(t *testing.T) {
+	// Unicode 15 encodes this invalid byte as U+FFFD, which IDNA then punycodes.
+	host, err := normalizeHTTPHost(&url.URL{Scheme: "https", Host: "\x94.EXAMPLE.COM"})
+	require.NoError(t, err)
+	require.Equal(t, "xn--zn7c.example.com", host)
+}
diff --git a/policy/validate_http_host_idna17_test.go b/policy/validate_http_host_idna17_test.go
new file mode 100644
index 000000000000..38bf03cc6c6c
--- /dev/null
+++ b/policy/validate_http_host_idna17_test.go
@@ -0,0 +1,16 @@
+//go:build go1.27
+
+package policy
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestNormalizeHTTPHostInvalidUTF8(t *testing.T) {
+	// Unicode 17 rejects the invalid byte instead of encoding it as U+FFFD.
+	_, err := normalizeHTTPHost(&url.URL{Scheme: "https", Host: "\x94.EXAMPLE.COM"})
+	require.ErrorContains(t, err, "invalid http host")
+}
diff --git a/policy/validate_test.go b/policy/validate_test.go
index 9989761adaab..fca4df9be77c 100644
--- a/policy/validate_test.go
+++ b/policy/validate_test.go
@@ -35,7 +35,6 @@ func TestNormalizeHTTPHost(t *testing.T) {
 		{"http", "Example.com", "example.com"},
 		{"https", "\u0130.EXAMPLE.COM:443", "xn--i-9bb.example.com"},
 		{"https", "\u00c9XAMPLE.COM", "xn--xample-9ua.com"},
-		{"https", "\x94.EXAMPLE.COM", "xn--zn7c.example.com"},
 		{"https", "EXAMPLE.COM:000443", "example.com"},
 		{"https", "eXaMpLe.CoM:8443", "example.com:8443"},
 		{"https", "example.com:443", "example.com"},