diff --git a/nixos/modules/misc/label.nix b/nixos/modules/misc/label.nix
index 02b91555b3c2..b97cbaa26304 100644
--- a/nixos/modules/misc/label.nix
+++ b/nixos/modules/misc/label.nix
@@ -11,7 +11,7 @@ in
   options.system = {
 
     nixos.label = mkOption {
-      type = types.str;
+      type = types.strMatching "[a-zA-Z0-9:_\\.-]*";
       description = ''
         NixOS version name to be used in the names of generated
         outputs and boot labels.
@@ -19,6 +19,9 @@ in
         If you ever wanted to influence the labels in your GRUB menu,
         this is the option for you.
 
+        It can only contain letters, numbers and the following symbols:
+        <literal>:</literal>, <literal>_</literal>, <literal>.</literal> and <literal>-</literal>.
+
         The default is <option>system.nixos.tags</option> separated by
         "-" + "-" + <envar>NIXOS_LABEL_VERSION</envar> environment
         variable (defaults to the value of