diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ISqlDialect.cs b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ISqlDialect.cs
index f6b37df0..9b15d22e 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ISqlDialect.cs
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/ISqlDialect.cs
@@ -11,10 +11,14 @@ namespace ZB.MOM.WW.OtOpcUa.Driver.Sql;
 ///     Those live here, so no dialect assumption leaks into the reader, the poll planner, or the schema browser.
 ///     <para><b>This interface is the driver's SQL-injection boundary.</b> Every runtime <em>value</em> is
 ///     bound as a <see cref="DbParameter"/> and never reaches a command text. Identifiers cannot be
-///     parameterized in SQL, so the few that must appear as text are sourced only from catalog-validated
-///     (<c>INFORMATION_SCHEMA</c>) names and emitted through <see cref="QuoteIdentifier"/>. Any code path that
-///     builds SQL by concatenating an authored tag field <em>without</em> going through
-///     <see cref="QuoteIdentifier"/> is a defect (design §8.1).</para>
+///     parameterized in SQL, so the few that must appear as text are emitted through
+///     <see cref="QuoteIdentifier"/>. Any code path that builds SQL by concatenating an authored tag field
+///     <em>without</em> going through <see cref="QuoteIdentifier"/> is a defect (design §8.1).</para>
+///     <para><b>Not yet implemented:</b> design §8.1 also specifies that an authored table/column is
+///     validated against the live catalog before it is ever quoted into text, so that an unknown identifier
+///     rejects the tag. No such gate exists yet — an identifier reaches <see cref="QuoteIdentifier"/>
+///     straight from the authored <c>TagConfig</c> blob, so <b>quoting is currently the only defence</b>,
+///     not a backstop behind an upstream filter. Scrutinise it accordingly.</para>
 ///     <para>Public because <c>Driver.Sql.Browser</c> consumes it — the catalog SQL <em>is</em> the browse
 ///     engine, so it is shared rather than duplicated. Implementations own their provider package;
 ///     <b>no provider-specific type appears in this signature</b> (<see cref="Factory"/> is the abstract
diff --git a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlServerDialect.cs b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlServerDialect.cs
index 2e76821b..e666856f 100644
--- a/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlServerDialect.cs
+++ b/src/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql/SqlServerDialect.cs
@@ -1,4 +1,5 @@
 using System.Data.Common;
+using System.Globalization;
 using Microsoft.Data.SqlClient;
 using ZB.MOM.WW.OtOpcUa.Core.Abstractions;
 using ZB.MOM.WW.OtOpcUa.Driver.Sql.Contracts;
@@ -61,11 +62,17 @@ public sealed class SqlServerDialect : ISqlDialect
     /// <remarks>
     ///     <para><b>Rejects</b> (all as <see cref="ArgumentException"/>): null / empty / all-whitespace; longer
     ///     than <see cref="MaxIdentifierLength"/>; any control character (which covers embedded NUL, and the
-    ///     C0/C1 ranges that can truncate or corrupt a logged/audited statement).</para>
+    ///     C0/C1 ranges that can truncate or corrupt a logged/audited statement); and any Unicode
+    ///     <see cref="System.Globalization.UnicodeCategory.Format"/> character — bidi overrides, zero-width
+    ///     spaces, soft hyphen, BOM. Those last cannot escape the brackets, but they spoof the <em>rendered</em>
+    ///     text of a log line or an AdminUI label while comparing byte-different from the real catalog name
+    ///     (the Trojan-Source class, CVE-2021-42574) — the same log/audit-integrity concern that motivates the
+    ///     control-character rule.</para>
     ///     <para>The rejection messages deliberately do <b>not</b> echo the offending value — it is untrusted
     ///     input and this exception's text reaches the driver log.</para>
-    ///     <para>Rejection is a backstop, not the primary defence: an identifier only reaches here after being
-    ///     validated against the live catalog (design §8.1).</para>
+    ///     <para><b>This is currently the only defence, not a backstop.</b> Design §8.1 specifies that an
+    ///     identifier is validated against the live catalog before reaching here; that gate is not implemented
+    ///     yet, so an authored <c>TagConfig</c> table/column arrives unfiltered.</para>
     /// </remarks>
     /// <param name="ident">The bare, unquoted identifier part.</param>
     /// <returns>The bracket-quoted identifier.</returns>
@@ -86,6 +93,13 @@ public sealed class SqlServerDialect : ISqlDialect
             if (char.IsControl(ch))
                 throw new ArgumentException(
                     "A SQL identifier may not contain control characters (including NUL).", nameof(ident));
+
+            // Cf is a *separate* category from Cc, so char.IsControl misses every bidi override and
+            // zero-width character. They are inert inside brackets but spoof rendered log/UI text.
+            if (CharUnicodeInfo.GetUnicodeCategory(ch) == UnicodeCategory.Format)
+                throw new ArgumentException(
+                    "A SQL identifier may not contain Unicode format characters "
+                    + "(bidi overrides, zero-width spaces, soft hyphen, BOM).", nameof(ident));
         }
 
         return string.Concat("[", ident.Replace("]", "]]", StringComparison.Ordinal), "]");
diff --git a/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlServerDialectTests.cs b/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlServerDialectTests.cs
index af0e4c0f..e10995bc 100644
--- a/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlServerDialectTests.cs
+++ b/tests/Drivers/ZB.MOM.WW.OtOpcUa.Driver.Sql.Tests/SqlServerDialectTests.cs
@@ -25,6 +25,29 @@ public class SqlServerDialectTests
     public void QuoteIdentifier_rejectsControlCharsAndNul()
         => Should.Throw<ArgumentException>(() => new SqlServerDialect().QuoteIdentifier("x\0y"));
 
+    // NUL alone would still pass against a `Contains('\0')` regression, so pin the whole Cc category.
+    [Theory]
+    [InlineData("x\u0001y")]   // C0 SOH
+    [InlineData("x\u001By")]   // C0 ESC
+    [InlineData("x\u007Fy")]   // DEL
+    [InlineData("x\u0085y")]   // C1 NEL
+    [InlineData("x\ty")]
+    [InlineData("x\ny")]
+    public void QuoteIdentifier_rejectsEveryControlCharacter_notJustNul(string ident)
+        => Should.Throw<ArgumentException>(() => new SqlServerDialect().QuoteIdentifier(ident));
+
+    // Unicode Format (Cf) is a distinct category from Control (Cc): char.IsControl returns false for all
+    // of these. They cannot escape the brackets, but they spoof rendered log/AdminUI text while comparing
+    // byte-different from the real catalog name (Trojan Source, CVE-2021-42574).
+    [Theory]
+    [InlineData("Sp\u200Beed")]          // zero-width space
+    [InlineData("\u202Ediop.selbat")]    // right-to-left override
+    [InlineData("x\u2066y\u2069")]      // bidi isolates
+    [InlineData("x\uFEFFy")]             // BOM / zero-width no-break space
+    [InlineData("x\u00ADy")]             // soft hyphen
+    public void QuoteIdentifier_rejectsUnicodeFormatCharacters(string ident)
+        => Should.Throw<ArgumentException>(() => new SqlServerDialect().QuoteIdentifier(ident));
+
     [Theory]
     [InlineData("bit", DriverDataType.Boolean)]
     [InlineData("int", DriverDataType.Int32)]