diff --git a/man/systemd-firstboot.xml b/man/systemd-firstboot.xml
index 86a85f0bf2..db6f2569a8 100644
--- a/man/systemd-firstboot.xml
+++ b/man/systemd-firstboot.xml
@@ -447,6 +447,17 @@
 
         <xi:include href="version-info.xml" xpointer="v249"/></listitem>
       </varlistentry>
+
+      <varlistentry>
+        <term><varname>firstboot.hostname</varname></term>
+
+        <listitem><para>This credential specifies the static system hostname to set during first boot. The
+        user will not be prompted for the hostname. Note that this controls the static hostname, not the
+        transient hostname, and only has an effect on first boot, unlike
+        <varname>system.hostname</varname>.</para>
+
+        <xi:include href="version-info.xml" xpointer="v261"/></listitem>
+      </varlistentry>
     </variablelist>
 
     <para>Note that by default the <filename>systemd-firstboot.service</filename> unit file is set up to
diff --git a/man/systemd.system-credentials.xml b/man/systemd.system-credentials.xml
index e3e2887207..a302be236d 100644
--- a/man/systemd.system-credentials.xml
+++ b/man/systemd.system-credentials.xml
@@ -44,7 +44,7 @@
       <varlistentry>
         <term><varname>firstboot.keymap</varname></term>
         <listitem>
-          <para>The console key mapping to set (e.g. <literal>de</literal>).  Read by
+          <para>The console key mapping to set (e.g. <literal>de</literal>). Read by
           <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
           and only honoured if no console keymap has been configured before.</para>
 
@@ -52,6 +52,20 @@
         </listitem>
       </varlistentry>
 
+      <varlistentry>
+        <term><varname>firstboot.hostname</varname></term>
+
+        <listitem><para>This credential specifies the static system hostname to set during first boot. The
+        user will not be prompted for the hostname. Note that this controls the static hostname, not the transient
+        hostname, and only has an effect on first boot, unlike <varname>system.hostname</varname> (see
+        below). Read by
+        <citerefentry><refentrytitle>systemd-firstboot</refentrytitle><manvolnum>1</manvolnum></citerefentry>
+        and only honoured if no static hostname has been configured before.</para>
+
+        <xi:include href="version-info.xml" xpointer="v261"/>
+        </listitem>
+      </varlistentry>
+
       <varlistentry>
         <term><varname>firstboot.locale</varname></term>
         <term><varname>firstboot.locale-messages</varname></term>
@@ -398,9 +412,10 @@
         <term><varname>system.hostname</varname></term>
         <listitem>
           <para>Accepts a (transient) hostname to configure during early boot. The static hostname specified
-            in <filename>/etc/hostname</filename>, if configured, takes precedence over this setting.
-            Interpreted by the service manager (PID 1). For details see
-            <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>.</para>
+          in <filename>/etc/hostname</filename>, if configured, takes precedence over this setting.
+          Interpreted by the service manager (PID 1). For details see
+          <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>. Also
+          see <varname>firstboot.hostname</varname> above.</para>
 
           <xi:include href="version-info.xml" xpointer="v254"/>
         </listitem>
diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c
index 38e3adaed6..8cb81e7f06 100644
--- a/src/firstboot/firstboot.c
+++ b/src/firstboot/firstboot.c
@@ -412,11 +412,15 @@ static int prompt_keymap(int rfd, sd_varlink **mute_console_link) {
         if (arg_keymap)
                 return 0;
 
-        r = read_credential("firstboot.keymap", (void**) &arg_keymap, NULL);
+        _cleanup_free_ char *km = NULL;
+        r = read_credential("firstboot.keymap", (void**) &km, NULL);
         if (r < 0)
                 log_debug_errno(r, "Failed to read credential firstboot.keymap, ignoring: %m");
+        else if (!keymap_is_valid(km))
+                log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Keymap '%s' supplied via credential is not valid, ignoring.", km);
         else {
                 log_debug("Acquired keymap from credential.");
+                arg_keymap = TAKE_PTR(km);
                 return 0;
         }
 
@@ -540,11 +544,15 @@ static int prompt_timezone(int rfd, sd_varlink **mute_console_link) {
         if (arg_timezone)
                 return 0;
 
-        r = read_credential("firstboot.timezone", (void**) &arg_timezone, NULL);
+        _cleanup_free_ char *tz = NULL;
+        r = read_credential("firstboot.timezone", (void**) &tz, NULL);
         if (r < 0)
                 log_debug_errno(r, "Failed to read credential firstboot.timezone, ignoring: %m");
+        else if (!timezone_is_valid(tz, LOG_DEBUG))
+                log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Timezone '%s' supplied via credential is not valid, ignoring.", tz);
         else {
                 log_debug("Acquired timezone from credential.");
+                arg_timezone = TAKE_PTR(tz);
                 return 0;
         }
 
@@ -647,6 +655,19 @@ static int prompt_hostname(int rfd, sd_varlink **mute_console_link) {
         if (arg_hostname)
                 return 0;
 
+        _cleanup_free_ char *hn = NULL;
+        r = read_credential("firstboot.hostname", (void**) &hn, NULL);
+        if (r < 0)
+                log_debug_errno(r, "Failed to read credential firstboot.hostname, ignoring: %m");
+        else if (!hostname_is_valid(hn, VALID_HOSTNAME_TRAILING_DOT|VALID_HOSTNAME_QUESTION_MARK))
+                log_warning_errno(SYNTHETIC_ERRNO(EINVAL), "Hostname '%s' supplied via credential is not valid, ignoring.", hn);
+        else {
+                log_debug("Acquired hostname from credentials.");
+                arg_hostname = TAKE_PTR(hn);
+                hostname_cleanup(arg_hostname);
+                return 0;
+        }
+
         if (!arg_prompt_hostname) {
                 log_debug("Prompting for hostname was not requested.");
                 return 0;