diff --git a/deno/lib/__tests__/string.test.ts b/deno/lib/__tests__/string.test.ts
index cc41e8fbd..0dcba7d50 100644
--- a/deno/lib/__tests__/string.test.ts
+++ b/deno/lib/__tests__/string.test.ts
@@ -30,7 +30,8 @@ test("passing validations", () => {
   hostname.parse("www.google.com");
   hostname.parse("[2001:db8::ff00:42:8329]");
   hostname.parse("192.168.1.1");
-  hostname.parse("xn--d1acj3b");
+  hostname.parse("xn--d1acj3b.com");
+  hostname.parse("xn--d1acj3b.org");
 });
 
 test("failing validations", () => {
@@ -44,6 +45,7 @@ test("failing validations", () => {
   expect(() => startsWith.parse("x")).toThrow();
   expect(() => endsWith.parse("x")).toThrow();
   expect(() => hostname.parse("ht!tp://invalid.com")).toThrow();
+  expect(() => hostname.parse("xn--d1acj3b")).toThrow();
   expect(() => hostname.parse("xn--d1acj3b..com")).toThrow();
   expect(() => hostname.parse("ex@mple.com")).toThrow();
   expect(() => hostname.parse("[2001:db8::zzzz]")).toThrow();
diff --git a/deno/lib/types.ts b/deno/lib/types.ts
index 5dc7b884b..187aa5ba2 100644
--- a/deno/lib/types.ts
+++ b/deno/lib/types.ts
@@ -859,7 +859,7 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
       } else if (check.kind === "hostname") {
         const domainNameRegex =
           /^(?!-)(?!.*--)(?!.*\.\.)(?!.*\.$)[a-zA-Z0-9-]{1,63}(?<!-)(\.[a-zA-Z0-9-]{1,63})*$/;
-        const punycodeRegex = /^xn--[a-zA-Z0-9-]{1,63}$/;
+        const punycodeRegex = /^xn--[a-zA-Z0-9-]{1,63}\.[a-zA-Z]{2,}$/; // Ensure TLD after punycode
         const ipv4Regex =
           /^(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)$/;
         const ipv6Regex = /^\[[0-9a-fA-F:]+\]$/;
@@ -868,7 +868,7 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
           domainNameRegex.test(input.data) ||
           ipv4Regex.test(input.data) ||
           ipv6Regex.test(input.data) ||
-          punycodeRegex.test(input.data);
+          punycodeRegex.test(input.data); // Apply punycodeRegex here
 
         if (!isValid) {
           ctx = this._getOrReturnCtx(input, ctx);
diff --git a/src/__tests__/string.test.ts b/src/__tests__/string.test.ts
index 93314050f..76ba84965 100644
--- a/src/__tests__/string.test.ts
+++ b/src/__tests__/string.test.ts
@@ -29,7 +29,8 @@ test("passing validations", () => {
   hostname.parse("www.google.com");
   hostname.parse("[2001:db8::ff00:42:8329]");
   hostname.parse("192.168.1.1");
-  hostname.parse("xn--d1acj3b");
+  hostname.parse("xn--d1acj3b.com");
+  hostname.parse("xn--d1acj3b.org");
 });
 
 test("failing validations", () => {
@@ -43,6 +44,7 @@ test("failing validations", () => {
   expect(() => startsWith.parse("x")).toThrow();
   expect(() => endsWith.parse("x")).toThrow();
   expect(() => hostname.parse("ht!tp://invalid.com")).toThrow();
+  expect(() => hostname.parse("xn--d1acj3b")).toThrow();
   expect(() => hostname.parse("xn--d1acj3b..com")).toThrow();
   expect(() => hostname.parse("ex@mple.com")).toThrow();
   expect(() => hostname.parse("[2001:db8::zzzz]")).toThrow();
diff --git a/src/types.ts b/src/types.ts
index f6431046e..a5204b8fa 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -859,7 +859,7 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
       } else if (check.kind === "hostname") {
         const domainNameRegex =
           /^(?!-)(?!.*--)(?!.*\.\.)(?!.*\.$)[a-zA-Z0-9-]{1,63}(?<!-)(\.[a-zA-Z0-9-]{1,63})*$/;
-        const punycodeRegex = /^xn--[a-zA-Z0-9-]{1,63}$/;
+        const punycodeRegex = /^xn--[a-zA-Z0-9-]{1,63}\.[a-zA-Z]{2,}$/; // Ensure TLD after punycode
         const ipv4Regex =
           /^(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[0-1]?[0-9][0-9]?)$/;
         const ipv6Regex = /^\[[0-9a-fA-F:]+\]$/;
@@ -868,7 +868,7 @@ export class ZodString extends ZodType<string, ZodStringDef, string> {
           domainNameRegex.test(input.data) ||
           ipv4Regex.test(input.data) ||
           ipv6Regex.test(input.data) ||
-          punycodeRegex.test(input.data);
+          punycodeRegex.test(input.data); // Apply punycodeRegex here
 
         if (!isValid) {
           ctx = this._getOrReturnCtx(input, ctx);