diff --git a/nuget/Microsoft.WSL.Containers/build/Microsoft.WSL.Containers.common.targets b/nuget/Microsoft.WSL.Containers/build/Microsoft.WSL.Containers.common.targets
index f03fe4fb..76bbdcdb 100644
--- a/nuget/Microsoft.WSL.Containers/build/Microsoft.WSL.Containers.common.targets
+++ b/nuget/Microsoft.WSL.Containers/build/Microsoft.WSL.Containers.common.targets
@@ -60,7 +60,7 @@
              XML entities: &quot; = "  &lt; = <  &gt; = >  -->
         <Error Condition="$([System.Text.RegularExpressions.Regex]::IsMatch('%(WslcImage.Identity)', '[/\\:*?&quot;&lt;&gt;|]'))"
                Code="WSLC0004"
-               Text="WslcImage '%(WslcImage.Identity)' contains characters not valid in file names. Use a simple name as the item identity and pass the full image reference via Tag metadata." />
+               Text="WslcImage '%(WslcImage.Identity)' contains characters not valid in file names. Use a simple, file-name-safe value for the item identity. If needed, specify only the image tag suffix via Tag metadata." />
     </Target>
 
     <!-- Dispatch each WslcImage via MSBuild task instead of batching directly because:
diff --git a/nuget/Microsoft.WSL.Containers/cmake/Microsoft.WSL.ContainersConfig.cmake b/nuget/Microsoft.WSL.Containers/cmake/Microsoft.WSL.ContainersConfig.cmake
index fed371a2..7c3198ce 100644
--- a/nuget/Microsoft.WSL.Containers/cmake/Microsoft.WSL.ContainersConfig.cmake
+++ b/nuget/Microsoft.WSL.Containers/cmake/Microsoft.WSL.ContainersConfig.cmake
@@ -91,10 +91,13 @@ function(wslc_add_image _target_name)
     if(NOT ARG_IMAGE)
         message(FATAL_ERROR "wslc_add_image: IMAGE is required")
     endif()
-    # IMAGE must not contain a tag — use the TAG parameter instead
-    string(FIND "${ARG_IMAGE}" ":" _colon_pos)
-    if(NOT _colon_pos EQUAL -1)
-        message(FATAL_ERROR "wslc_add_image: IMAGE '${ARG_IMAGE}' contains ':'. Specify the tag separately with the TAG parameter.")
+    # IMAGE must not contain a tag — use the TAG parameter instead.
+    # Allow ':' in the registry host portion (for example, localhost:5000/myimg)
+    # and only reject ':' when it appears after the last '/'.
+    string(FIND "${ARG_IMAGE}" "/" _last_slash_pos REVERSE)
+    string(FIND "${ARG_IMAGE}" ":" _last_colon_pos REVERSE)
+    if(_last_colon_pos GREATER _last_slash_pos)
+        message(FATAL_ERROR "wslc_add_image: IMAGE '${ARG_IMAGE}' contains a tag. Specify the tag separately with the TAG parameter.")
     endif()
     if(NOT ARG_DOCKERFILE)
         message(FATAL_ERROR "wslc_add_image: DOCKERFILE is required")