diff --git a/install.ps1 b/install.ps1
index 49373f1..b441047 100644
--- a/install.ps1
+++ b/install.ps1
@@ -465,15 +465,15 @@ function Run-SimplePrompts {
     Write-Host ''
     if ($c.DeploymentMode -eq 'saas') {
         $defaultEmail = Coalesce $c.AdminUser "admin@$($c.PublicHost)"
-        if ($defaultEmail -and -not $defaultEmail.Contains('@')) {
+        if ($defaultEmail -and $defaultEmail -notmatch '@.+\..+') {
             $defaultEmail = "admin@$($c.PublicHost)"
         }
-        $c.AdminUser = Prompt-Value 'Admin email' $defaultEmail
-        # Validate email: must contain @
-        if (-not $c.AdminUser.Contains('@')) {
-            $original = $c.AdminUser
-            $c.AdminUser = "$($c.AdminUser)@$($c.PublicHost)"
-            Log-Info "Appended domain: '$original' -> '$($c.AdminUser)'"
+        while ($true) {
+            $c.AdminUser = Prompt-Value 'Admin email' $defaultEmail
+            if ($c.AdminUser -match '^[^@]+@[^@]+\.[^@]+$') { break }
+            Write-Host '  Invalid email address. Must be a valid email (e.g. admin@company.com).' -ForegroundColor Red
+            $c.AdminUser = $null
+            $defaultEmail = $null
         }
     } else {
         $c.AdminUser = Prompt-Value 'Admin username' (Coalesce $c.AdminUser $DEFAULT_ADMIN_USER)
@@ -557,7 +557,15 @@ function Merge-Config {
     if (-not $c.InstallDir)          { $c.InstallDir          = $DEFAULT_INSTALL_DIR }
     if (-not $c.PublicHost)          { $c.PublicHost          = 'localhost' }
     if (-not $c.PublicProtocol)      { $c.PublicProtocol      = $DEFAULT_PUBLIC_PROTOCOL }
-    if (-not $c.AdminUser)           { $c.AdminUser           = $DEFAULT_ADMIN_USER }
+    if ($c.DeploymentMode -eq 'saas') {
+        if (-not $c.AdminUser) { $c.AdminUser = "admin@$($c.PublicHost)" }
+        if ($c.AdminUser -notmatch '^[^@]+@[^@]+\.[^@]+$') {
+            Write-Host "ERROR: SAAS_ADMIN_USER must be a valid email address (e.g. admin@company.com), got: '$($c.AdminUser)'" -ForegroundColor Red
+            exit 1
+        }
+    } else {
+        if (-not $c.AdminUser) { $c.AdminUser = $DEFAULT_ADMIN_USER }
+    }
     if (-not $c.TlsMode)             { $c.TlsMode             = $DEFAULT_TLS_MODE }
     if (-not $c.HttpPort)            { $c.HttpPort            = $DEFAULT_HTTP_PORT }
     if (-not $c.HttpsPort)           { $c.HttpsPort           = $DEFAULT_HTTPS_PORT }
diff --git a/install.sh b/install.sh
index 33248f6..29bd333 100644
--- a/install.sh
+++ b/install.sh
@@ -448,13 +448,15 @@ run_simple_prompts() {
 
   echo ""
   if [ "$DEPLOYMENT_MODE" = "saas" ]; then
-    prompt ADMIN_USER "Admin email" "${ADMIN_USER:-admin@${PUBLIC_HOST:-localhost}}"
-    # Validate email: must contain @
-    if ! echo "$ADMIN_USER" | grep -q '@'; then
-      local original="$ADMIN_USER"
-      ADMIN_USER="${ADMIN_USER}@${PUBLIC_HOST:-localhost}"
-      log_info "Appended domain: '${original}' -> '${ADMIN_USER}'"
-    fi
+    while true; do
+      prompt ADMIN_USER "Admin email" "${ADMIN_USER:-admin@${PUBLIC_HOST:-localhost}}"
+      # Validate email: must be user@domain.tld format
+      if echo "$ADMIN_USER" | grep -qE '^[^@]+@[^@]+\.[^@]+$'; then
+        break
+      fi
+      echo -e "  ${RED}Invalid email address.${NC} Must be a valid email (e.g. admin@company.com)."
+      ADMIN_USER=""
+    done
   else
     prompt ADMIN_USER "Admin username" "${ADMIN_USER:-$DEFAULT_ADMIN_USER}"
   fi
@@ -538,7 +540,16 @@ merge_config() {
   : "${INSTALL_DIR:=$DEFAULT_INSTALL_DIR}"
   : "${PUBLIC_HOST:=localhost}"
   : "${PUBLIC_PROTOCOL:=$DEFAULT_PUBLIC_PROTOCOL}"
-  : "${ADMIN_USER:=$DEFAULT_ADMIN_USER}"
+  if [ "$DEPLOYMENT_MODE" = "saas" ]; then
+    : "${ADMIN_USER:=admin@${PUBLIC_HOST}}"
+    # Validate email format in SaaS mode
+    if ! echo "$ADMIN_USER" | grep -qE '^[^@]+@[^@]+\.[^@]+$'; then
+      echo -e "${RED}ERROR:${NC} SAAS_ADMIN_USER must be a valid email address (e.g. admin@company.com), got: '$ADMIN_USER'" >&2
+      exit 1
+    fi
+  else
+    : "${ADMIN_USER:=$DEFAULT_ADMIN_USER}"
+  fi
   : "${TLS_MODE:=$DEFAULT_TLS_MODE}"
   : "${HTTP_PORT:=$DEFAULT_HTTP_PORT}"
   : "${HTTPS_PORT:=$DEFAULT_HTTPS_PORT}"