diff --git a/age/src/plugin.rs b/age/src/plugin.rs
index 97a1465..387bf9f 100644
--- a/age/src/plugin.rs
+++ b/age/src/plugin.rs
@@ -461,3 +461,65 @@ impl<C: Callbacks> crate::Identity for IdentityPluginV1<C> {
         self.unwrap_stanzas(stanzas.iter())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use crate::{Callbacks, DecryptError, EncryptError};
+
+    use super::{
+        Identity, IdentityPluginV1, Recipient, RecipientPluginV1, PLUGIN_IDENTITY_PREFIX,
+        PLUGIN_RECIPIENT_PREFIX,
+    };
+
+    const INVALID_PLUGIN_NAME: &str = "foobar/../../../../../../../usr/bin/echo";
+
+    struct NoCallbacks;
+    impl Callbacks for NoCallbacks {
+        fn prompt(&self, _: &str) {}
+        fn request_public_string(&self, _: &str) -> Option<String> {
+            None
+        }
+        fn request_passphrase(&self, _: &str) -> Option<secrecy::SecretString> {
+            None
+        }
+    }
+
+    #[test]
+    fn recipient_rejects_invalid_chars() {
+        let invalid_recipient = bech32::encode(
+            &format!("{}{}", PLUGIN_RECIPIENT_PREFIX, INVALID_PLUGIN_NAME),
+            [],
+            bech32::Variant::Bech32,
+        )
+        .unwrap();
+        assert!(invalid_recipient.parse::<Recipient>().is_err());
+    }
+
+    #[test]
+    fn identity_rejects_invalid_chars() {
+        let invalid_identity = bech32::encode(
+            &format!("{}{}-", PLUGIN_IDENTITY_PREFIX, INVALID_PLUGIN_NAME),
+            [],
+            bech32::Variant::Bech32,
+        )
+        .expect("HRP is valid")
+        .to_uppercase();
+        assert!(invalid_identity.parse::<Identity>().is_err());
+    }
+
+    #[test]
+    fn recipient_plugin_v1_rejects_invalid_chars() {
+        assert!(matches!(
+            RecipientPluginV1::new(INVALID_PLUGIN_NAME, &[], &[], NoCallbacks),
+            Err(EncryptError::MissingPlugin { binary_name }) if binary_name == INVALID_PLUGIN_NAME,
+        ));
+    }
+
+    #[test]
+    fn identity_plugin_v1_rejects_invalid_chars() {
+        assert!(matches!(
+            IdentityPluginV1::new(INVALID_PLUGIN_NAME, &[], NoCallbacks),
+            Err(DecryptError::MissingPlugin { binary_name }) if binary_name == INVALID_PLUGIN_NAME,
+        ));
+    }
+}
diff --git a/rage/tests/cmd/rage/decrypt-invalid-identity-chars.in/file.age.txt b/rage/tests/cmd/rage/decrypt-invalid-identity-chars.in/file.age.txt
new file mode 100644
index 0000000..6f9dc67
--- /dev/null
+++ b/rage/tests/cmd/rage/decrypt-invalid-identity-chars.in/file.age.txt
@@ -0,0 +1,8 @@
+-----BEGIN AGE ENCRYPTED FILE-----
+YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHUGc3Zlhpekp0K012aXdu
+T1VZN0lmWlRmNjdLYVB4RldkTFVLTkNDUXlBCmJjRUcrM3E0a0U0N3IyK1JsTitG
+dHVTd0N6TVFRTWgzdG5uSzJmNm9YMTgKLT4gQXQ1WWAtZ3JlYXNlIDxodGFSVHJg
+IFg0cWYsO0ogZ2Fzc1EKZGtPSTB3Ci0tLSBKazRIaHJxdnNJcHpyclRkQjg3QW5r
+SVE2MHdtWkErYTNrNWJibWd1bmNBCkK9FoOkiLB93gD79vNed8L3LM9rhKm5qma2
+lSiwRx/aM1DKaZO0CMmYQkoM2tPReA==
+-----END AGE ENCRYPTED FILE-----
diff --git a/rage/tests/cmd/rage/decrypt-invalid-identity-chars.toml b/rage/tests/cmd/rage/decrypt-invalid-identity-chars.toml
new file mode 100644
index 0000000..d3350d2
--- /dev/null
+++ b/rage/tests/cmd/rage/decrypt-invalid-identity-chars.toml
@@ -0,0 +1,13 @@
+bin.name = "rage"
+args = "--decrypt --identity - file.age.txt"
+status = "failed"
+stdin = """
+AGE-PLUGIN-FOOBAR/../../../../../../../USR/BIN/ECHO-1HKGPY3
+"""
+stdout = ""
+stderr = """
+Error: identity file contains non-identity data on line 1
+
+[ Did rage not do what you expected? Could an error be more useful? ]
+[ Tell us: https://str4d.xyz/rage/report                            ]
+"""
diff --git a/rage/tests/cmd/rage/decrypt-invalid-plugin-name-chars.toml b/rage/tests/cmd/rage/decrypt-invalid-plugin-name-chars.toml
new file mode 100644
index 0000000..968a8b2
--- /dev/null
+++ b/rage/tests/cmd/rage/decrypt-invalid-plugin-name-chars.toml
@@ -0,0 +1,12 @@
+bin.name = "rage"
+args = "--decrypt -j foobar/../../../../../../../usr/bin/echo"
+status = "failed"
+stdin = ""
+stdout = ""
+stderr = """
+Error: Could not find 'foobar/../../../../../../../usr/bin/echo' on the PATH.
+Have you installed the plugin?
+
+[ Did rage not do what you expected? Could an error be more useful? ]
+[ Tell us: https://str4d.xyz/rage/report                            ]
+"""
diff --git a/rage/tests/cmd/rage/encrypt-invalid-recipient-chars.toml b/rage/tests/cmd/rage/encrypt-invalid-recipient-chars.toml
new file mode 100644
index 0000000..ce03d5e
--- /dev/null
+++ b/rage/tests/cmd/rage/encrypt-invalid-recipient-chars.toml
@@ -0,0 +1,11 @@
+bin.name = "rage"
+args = "--encrypt --recipient age1foobar/../../../../../../../usr/bin/echo1849l6e"
+status = "failed"
+stdin = ""
+stdout = ""
+stderr = """
+Error: Invalid recipient 'age1foobar/../../../../../../../usr/bin/echo1849l6e'.
+
+[ Did rage not do what you expected? Could an error be more useful? ]
+[ Tell us: https://str4d.xyz/rage/report                            ]
+"""