diff --git a/backend/tests/test_delivery.py b/backend/tests/test_delivery.py
index b31184c..b718b6a 100644
--- a/backend/tests/test_delivery.py
+++ b/backend/tests/test_delivery.py
@@ -881,6 +881,8 @@ def test_proxy_is_separate_from_private_execution_control():
     # records on the local namespace socket and restrict their fields to counters.
     destination, format_name = re.findall(r"^\s+access_log (\S+) (\w+);$", contents, re.M)[0]
     assert destination.startswith("syslog:server=unix:/")
+    tag = next(part[4:] for part in destination.split(",") if part.startswith("tag="))
+    assert re.fullmatch(r"[A-Za-z0-9_]+", tag)
     assert format_name == "bounded" and "/dev/stdout" not in contents
     log_fields = re.findall(r"^\s+log_format bounded '([^']+)';$", contents, re.M)[0]
     assert log_fields.split() == [
diff --git a/scripts/release/proxy.py b/scripts/release/proxy.py
index 0d9ee03..d7ac605 100644
--- a/scripts/release/proxy.py
+++ b/scripts/release/proxy.py
@@ -87,7 +87,7 @@ http {
     }
     default_type application/octet-stream;
     log_format bounded '$request_method $status $body_bytes_sent $request_time';
-    access_log syslog:server=unix:/dev/log,tag=kf-proxy,nohostname,severity=info bounded;
+    access_log syslog:server=unix:/dev/log,tag=kf_proxy,nohostname,severity=info bounded;
     server_tokens off;
     limit_conn_zone $binary_remote_addr zone=per_client:64k;
     limit_conn_zone $server_name zone=per_site:64k;