diff --git a/internal/hostagent/guest_exec_guard.go b/internal/hostagent/guest_exec_guard.go
index 94285746d9..0f3457aff5 100644
--- a/internal/hostagent/guest_exec_guard.go
+++ b/internal/hostagent/guest_exec_guard.go
@@ -137,7 +137,7 @@ func guestExecConfigLock(config []byte) (string, bool) {
 			return "", false
 		}
 		for _, c := range key {
-			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '_') {
+			if !(c >= 'a' && c <= 'z' || c >= '0' && c <= '9' || c == '_' || c == '-') {
 				return "", false
 			}
 		}
diff --git a/internal/hostagent/guest_exec_guard_test.go b/internal/hostagent/guest_exec_guard_test.go
index 7a03b532ef..08d27a1e30 100644
--- a/internal/hostagent/guest_exec_guard_test.go
+++ b/internal/hostagent/guest_exec_guard_test.go
@@ -20,6 +20,7 @@ func TestGuestExecConfigLockDictionary(t *testing.T) {
 	}{
 		{"unlocked", "cores: 2\nname: home-assistant\n", "", true},
 		{"unicode name", "name: café\nmemory: 8192\n", "", true},
+		{"hyphenated PVE key", "name: vm\namd-sev: type=sev\n", "", true},
 		{"backup", "name: vm\nlock: backup\n", "backup", true},
 		{"other operation", "lock: migrate\n", "migrate", true},
 		{"comment", "# lock: backup\nname: vm\n", "", true},
diff --git a/internal/servicediscovery/deep_scanner.go b/internal/servicediscovery/deep_scanner.go
index e091af1791..794e0aac6b 100644
--- a/internal/servicediscovery/deep_scanner.go
+++ b/internal/servicediscovery/deep_scanner.go
@@ -3,6 +3,7 @@ package servicediscovery
 import (
 	"context"
 	"fmt"
+	"strings"
 	"sync"
 	"time"