diff --git a/forms/record_upsert.go b/forms/record_upsert.go
index 8ba1a546..f4bfde50 100644
--- a/forms/record_upsert.go
+++ b/forms/record_upsert.go
@@ -25,7 +25,7 @@ import (
 )
 
 // username value regex pattern
-var usernameRegex = regexp.MustCompile(`^[\w][\w\.]*$`)
+var usernameRegex = regexp.MustCompile(`^[\w][\w\.\-]*$`)
 
 // RecordUpsert is a [models.Record] upsert (create/update) form.
 type RecordUpsert struct {
diff --git a/forms/record_upsert_test.go b/forms/record_upsert_test.go
index cf7aabe9..22bb86ef 100644
--- a/forms/record_upsert_test.go
+++ b/forms/record_upsert_test.go
@@ -753,7 +753,7 @@ func TestRecordUpsertAuthRecord(t *testing.T) {
 			"create with all allowed auth fields",
 			"",
 			map[string]any{
-				"username":        "test_new",
+				"username":        "test_new-a.b",
 				"email":           "test_new@example.com",
 				"emailVisibility": true,
 				"password":        "12345678",