diff --git a/src/types.rs b/src/types.rs
index f5ca030..a521d2e 100644
--- a/src/types.rs
+++ b/src/types.rs
@@ -26,6 +26,9 @@ impl BucketName {
         if name.len() > Self::MAX_LEN {
             return Err("Bucket name too long");
         }
+        if name.chars().any(char::is_control) {
+            return Err("Bucket name cannot contain control characters");
+        }
         Ok(Self(name))
     }
 }
@@ -64,6 +67,9 @@ impl ObjectKind {
         if key.len() > Self::MAX_LEN {
             return Err("Object kind too long");
         }
+        if key.chars().any(char::is_control) {
+            return Err("Object kind cannot contain control characters");
+        }
         Ok(Self(key))
     }
 }
@@ -184,6 +190,18 @@ impl IntoIterator for BucketNameSet {
 mod tests {
     use super::*;
 
+    #[test]
+    fn bucket_name_rejects_control_characters() {
+        let result = BucketName::new("bucket\nname");
+        assert_eq!(result, Err("Bucket name cannot contain control characters"));
+    }
+
+    #[test]
+    fn object_kind_rejects_control_characters() {
+        let result = ObjectKind::new("kind\nname");
+        assert_eq!(result, Err("Object kind cannot contain control characters"));
+    }
+
     #[test]
     fn object_kind_deserialize_rejects_empty() {
         let result: Result<ObjectKind, _> = serde_json::from_str(r#""""#);