diff --git a/services/openldap-bootstrap/assets/scripts/00-base.sh b/services/openldap-bootstrap/assets/scripts/00-base.sh
index e459927..ef045c8 100755
--- a/services/openldap-bootstrap/assets/scripts/00-base.sh
+++ b/services/openldap-bootstrap/assets/scripts/00-base.sh
@@ -37,6 +37,10 @@ if [ "${TYPE}" = "env" ]; then
 
     OPENLDAP_BOOTSTRAP_ORGANIZATION_DC=$(get_dn_attr dc "${OPENLDAP_BOOTSTRAP_SUFFIX}")
 
+    if [ -z "${OPENLDAP_BOOTSTRAP_ORGANIZATION_DC}" ]; then
+        container log fatal "OPENLDAP_BOOTSTRAP_SUFFIX must start with dc= (got ${OPENLDAP_BOOTSTRAP_SUFFIX})"
+    fi
+
     prepare_env_file "${ENV_FILE}" OPENLDAP_GROUP_GID OPENLDAP_USER_UID OPENLDAP_BOOTSTRAP_CONFIG_ROOT_PASSWORD_HASHED OPENLDAP_BOOTSTRAP_DATA_ROOT_PASSWORD_HASHED OPENLDAP_BOOTSTRAP_MODULES_LDIF OPENLDAP_BOOTSTRAP_SCHEMAS_LDIF OPENLDAP_BOOTSTRAP_MONITOR_ENABLED OPENLDAP_BOOTSTRAP_ORGANIZATION_DC
 
 elif [ "${TYPE}" = "ldif" ]; then
diff --git a/services/openldap-bootstrap/assets/scripts/80-replication.sh b/services/openldap-bootstrap/assets/scripts/80-replication.sh
index 640a44c..ccf188a 100755
--- a/services/openldap-bootstrap/assets/scripts/80-replication.sh
+++ b/services/openldap-bootstrap/assets/scripts/80-replication.sh
@@ -44,6 +44,10 @@ if [ "${OPENLDAP_BOOTSTRAP_REPLICATION}" = "true" ]; then
             container log fatal "OPENLDAP_BOOTSTRAP_REPLICATION_HOSTS must contain at least 2 hosts, got $((i - 1)) (${OPENLDAP_BOOTSTRAP_REPLICATION_HOSTS})"
         fi
 
+        if [ "${i}" -gt 10 ]; then
+            container log fatal "OPENLDAP_BOOTSTRAP_REPLICATION_HOSTS must contain at most 9 hosts, got $((i - 1))"
+        fi
+
         if [ "${current_host_id}" -eq 0 ]; then
             container log fatal "Current host ${current_fqdn} not found in OPENLDAP_BOOTSTRAP_REPLICATION_HOSTS=${OPENLDAP_BOOTSTRAP_REPLICATION_HOSTS}"
         fi