diff --git a/pkg/agent/templates/templates.go b/pkg/agent/templates/templates.go
index c910fb61b914..42a6a02f236d 100644
--- a/pkg/agent/templates/templates.go
+++ b/pkg/agent/templates/templates.go
@@ -3,6 +3,7 @@ package templates
 import (
 	"bytes"
 	"net/url"
+	"strings"
 	"text/template"
 
 	"github.com/rancher/wharfie/pkg/registries"
@@ -62,7 +63,7 @@ skip_verify = true
 {{ end }}
 [host]
 {{ range $e := .Endpoints -}}
-[host."{{ $e.URL }}"]
+[host."{{ $e.URL | keyencode }}"]
   capabilities = ["pull", "resolve"]
   {{- if $e.OverridePath }}
   override_path = true
@@ -79,7 +80,7 @@ skip_verify = true
   {{- end }}
 {{ end }}
 {{- if $e.Rewrites }}
-  [host."{{ $e.URL }}".rewrite]
+  [host."{{ $e.URL | keyencode }}".rewrite]
   {{- range $pattern, $replace := $e.Rewrites }}
     "{{ $pattern }}" = "{{ $replace }}"
   {{- end }}
@@ -105,3 +106,12 @@ func ParseHostsTemplateFromConfig(templateBuffer string, config interface{}) (st
 	}
 	return out.String(), nil
 }
+
+// keyEncode replaces invalid table keys with escaped unicode equivalents.
+func keyEncode(s string) string {
+	// Square brackets are not valid in toml table keys, see
+	// https://github.com/containerd/containerd/issues/10055
+	s = strings.ReplaceAll(s, "[", "\\u005B")
+	s = strings.ReplaceAll(s, "]", "\\u005D")
+	return s
+}
diff --git a/pkg/agent/templates/templates_linux.go b/pkg/agent/templates/templates_linux.go
index 0df107abaae7..f51927f244a0 100644
--- a/pkg/agent/templates/templates_linux.go
+++ b/pkg/agent/templates/templates_linux.go
@@ -121,6 +121,7 @@ enable_keychain = true
 
 // Linux config templates do not need fixups
 var templateFuncs = template.FuncMap{
+	"keyencode": keyEncode,
 	"deschemify": func(s string) string {
 		return s
 	},
diff --git a/pkg/agent/templates/templates_windows.go b/pkg/agent/templates/templates_windows.go
index 5cccd7e43d08..fa3d3693eb03 100644
--- a/pkg/agent/templates/templates_windows.go
+++ b/pkg/agent/templates/templates_windows.go
@@ -145,6 +145,7 @@ oom_score = 0
 
 // Windows config templates need named pipe addresses fixed up
 var templateFuncs = template.FuncMap{
+	"keyencode": keyEncode,
 	"deschemify": func(s string) string {
 		if strings.HasPrefix(s, "npipe:") {
 			u, err := url.Parse(s)