diff --git a/internal/k8s/deployments.go b/internal/k8s/deployments.go
index 3a9ef045..97dee42f 100644
--- a/internal/k8s/deployments.go
+++ b/internal/k8s/deployments.go
@@ -187,7 +187,8 @@ func TruncateString(s string, n int) string {
 func CleanStringForDNS(s string) string {
 	// Keep only letters, numbers, and dashes.
 	re := regexp.MustCompile(`[^a-zA-Z0-9-]+`)
-	return re.ReplaceAllString(s, ResourceNameSeparator)
+	// Lowercase to ensure RFC 1123 DNS label compliance for Kubernetes resource names.
+	return strings.ToLower(re.ReplaceAllString(s, ResourceNameSeparator))
 }
 
 // Build ID is used as a label in k8s, and as the build ID for
diff --git a/internal/k8s/deployments_test.go b/internal/k8s/deployments_test.go
index 169053f3..7b5354bc 100644
--- a/internal/k8s/deployments_test.go
+++ b/internal/k8s/deployments_test.go
@@ -479,6 +479,12 @@ func TestComputeVersionedDeploymentName(t *testing.T) {
 			buildID:      "image-v2.1.0-a1b2c3d4",
 			expectedName: "worker-name-image-v2-1-0-a1b2c3d4",
 		},
+		{
+			name:         "uppercase characters in build ID are lowercased",
+			baseName:     "worker-name",
+			buildID:      "master--HEAD",
+			expectedName: "worker-name-master--head",
+		},
 		{
 			name:         "exceed max length",
 			baseName:     "worker-name-0123456789-0123456789",