diff --git a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
index 6afd5219..acf2fe40 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/HsBookingItemController.java
@@ -71,6 +71,7 @@ public class HsBookingItemController implements HsBookingItemsApi {
                         .buildAndExpand(saved.getUuid())
                         .toUri();
         final var mapped = mapper.map(saved, HsBookingItemResource.class, ENTITY_TO_RESOURCE_POSTMAPPER);
+
         return ResponseEntity.created(uri).body(mapped);
     }
 
diff --git a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidator.java b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidator.java
index c9fd731a..f42ea4e0 100644
--- a/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidator.java
+++ b/src/main/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidator.java
@@ -1,3 +1,4 @@
+
 package net.hostsharing.hsadminng.hs.booking.item.validators;
 
 import net.hostsharing.hsadminng.hs.booking.item.HsBookingItem;
@@ -15,6 +16,9 @@ class HsDomainSetupBookingItemValidator extends HsBookingItemEntityValidator {
 
     public static final String FQDN_REGEX = "^((?!-)[A-Za-z0-9-]{1,63}(?<!-)\\.)+[A-Za-z]{2,12}";
     public static final String DOMAIN_NAME_PROPERTY_NAME = "domainName";
+    public static final String TARGET_UNIX_USER_PROPERTY_NAME = "targetUnixUser";
+    public static final String WEBSPACE_NAME_REGEX = "[a-z][a-z0-9]{2}[0-9]{2}";
+    public static final String TARGET_UNIX_USER_NAME_REGEX = "^"+WEBSPACE_NAME_REGEX+"$|^"+WEBSPACE_NAME_REGEX+"-[a-z0-9\\._-]+$";
     public static final String VERIFICATION_CODE_PROPERTY_NAME = "verificationCode";
 
     HsDomainSetupBookingItemValidator() {
@@ -24,6 +28,12 @@ class HsDomainSetupBookingItemValidator extends HsBookingItemEntityValidator {
                         .matchesRegEx(FQDN_REGEX).describedAs("is not a (non-top-level) fully qualified domain name")
                         .notMatchesRegEx(REGISTRAR_LEVEL_DOMAINS).describedAs("is a forbidden registrar-level domain name")
                         .required(),
+                // TODO.legacy: remove the following property once we give up legacy compatibility
+                stringProperty(TARGET_UNIX_USER_PROPERTY_NAME).writeOnce()
+                        .maxLength(253)
+                        .matchesRegEx(TARGET_UNIX_USER_NAME_REGEX).describedAs("is not a valid unix-user name")
+                        .writeOnce()
+                        .required(),
                 stringProperty(VERIFICATION_CODE_PROPERTY_NAME)
                         .minLength(12)
                         .maxLength(64)
diff --git a/src/test/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidatorUnitTest.java b/src/test/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidatorUnitTest.java
index 60356401..52a63509 100644
--- a/src/test/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidatorUnitTest.java
+++ b/src/test/java/net/hostsharing/hsadminng/hs/booking/item/validators/HsDomainSetupBookingItemValidatorUnitTest.java
@@ -35,7 +35,8 @@ class HsDomainSetupBookingItemValidatorUnitTest {
                 .project(project)
                 .caption("Test-Domain")
                 .resources(Map.ofEntries(
-                        entry("domainName", "example.org")
+                        entry("domainName", "example.org"),
+                        entry("targetUnixUser", "xyz00")
                 ))
                 .build();
 
@@ -55,6 +56,7 @@ class HsDomainSetupBookingItemValidatorUnitTest {
                 .caption("Test-Domain")
                 .resources(Map.ofEntries(
                         entry("domainName", "example.org"),
+                        entry("targetUnixUser", "xyz00"),
                         entry("verificationCode", "1234-5678-9100")
                 ))
                 .build();
@@ -73,7 +75,8 @@ class HsDomainSetupBookingItemValidatorUnitTest {
                 .project(project)
                 .caption("Test-Domain")
                 .resources(Map.ofEntries(
-                        entry("domainName", right(TOO_LONG_DOMAIN_NAME, 253))
+                        entry("domainName", right(TOO_LONG_DOMAIN_NAME, 253)),
+                        entry("targetUnixUser", "xyz00")
                 ))
                 .build();
 
@@ -91,7 +94,8 @@ class HsDomainSetupBookingItemValidatorUnitTest {
                 .project(project)
                 .caption("Test-Domain")
                 .resources(Map.ofEntries(
-                        entry("domainName", right(TOO_LONG_DOMAIN_NAME, 254))
+                        entry("domainName", right(TOO_LONG_DOMAIN_NAME, 254)),
+                        entry("targetUnixUser", "xyz00")
                 ))
                 .build();
 
@@ -102,6 +106,44 @@ class HsDomainSetupBookingItemValidatorUnitTest {
         assertThat(result).contains("'D-12345:Test-Project:Test-Domain.resources.domainName' length is expected to be at max 253 but length of 'dfghijklmnopqrstuvwxyz0123456789.asdfghijklmnopqrstuvwxyz0123456789.asdfghijklmnopqrstuvwxyz0123456789.asdfghijklmnopqrstuvwxyz0123456789.asdfghijklmnopqrstuvwxyz0123456789.asdfghijklmnopqrstuvwxyz0123456789.asdfghijklmnopqrstuvwxyz0123456789.example.org' is 254");
     }
 
+    @Test
+    void acceptsValidUnixUser() {
+        final var domainSetupBookingItemEntity = HsBookingItemRealEntity.builder()
+                .type(DOMAIN_SETUP)
+                .project(project)
+                .caption("Test-Domain")
+                .resources(Map.ofEntries(
+                        entry("domainName", "example.com"),
+                        entry("targetUnixUser", "xyz00-test")
+                ))
+                .build();
+
+        // when
+        final var result = HsBookingItemEntityValidatorRegistry.doValidate(em, domainSetupBookingItemEntity);
+
+        // then
+        assertThat(result).isEmpty();
+    }
+
+    @Test
+    void rejectsInvalidUnixUser() {
+        final var domainSetupBookingItemEntity = HsBookingItemRealEntity.builder()
+                .type(DOMAIN_SETUP)
+                .project(project)
+                .caption("Test-Domain")
+                .resources(Map.ofEntries(
+                        entry("domainName", "example.com"),
+                        entry("targetUnixUser", "xyz00test")
+                ))
+                .build();
+
+        // when
+        final var result = HsBookingItemEntityValidatorRegistry.doValidate(em, domainSetupBookingItemEntity);
+
+        // then
+        assertThat(result).contains("'D-12345:Test-Project:Test-Domain.resources.targetUnixUser' = 'xyz00test' is not a valid unix-user name");
+    }
+
     @ParameterizedTest
     @ValueSource(strings = {
             "de", "com", "net", "org", "actually-any-top-level-domain",
@@ -123,7 +165,8 @@ class HsDomainSetupBookingItemValidatorUnitTest {
                 .project(project)
                 .caption("Test-Domain")
                 .resources(Map.ofEntries(
-                        entry("domainName", secondLevelRegistrarDomain)
+                        entry("domainName", secondLevelRegistrarDomain),
+                        entry("targetUnixUser", "xyz00")
                 ))
                 .build();
 
@@ -148,7 +191,8 @@ class HsDomainSetupBookingItemValidatorUnitTest {
                 .project(project)
                 .caption("Test-Domain")
                 .resources(Map.ofEntries(
-                        entry("domainName", secondLevelRegistrarDomain)
+                        entry("domainName", secondLevelRegistrarDomain),
+                        entry("targetUnixUser", "xyz00")
                 ))
                 .build();
 
@@ -170,6 +214,7 @@ class HsDomainSetupBookingItemValidatorUnitTest {
         // then
         assertThat(validator.properties()).map(Map::toString).containsExactlyInAnyOrder(
                 "{type=string, propertyName=domainName, matchesRegEx=[^((?!-)[A-Za-z0-9-]{1,63}(?<!-)\\.)+[A-Za-z]{2,12}], matchesRegExDescription=is not a (non-top-level) fully qualified domain name, notMatchesRegEx=[[^.]+, (co|org|gov|ac|sch)\\.uk, (com|net|org|edu|gov|asn|id)\\.au, (co|ne|or|ac|go)\\.jp, (com|net|org|gov|edu|ac)\\.cn, (com|net|org|gov|edu|mil|art)\\.br, (co|net|org|gen|firm|ind)\\.in, (com|net|org|gob|edu)\\.mx, (gov|edu)\\.it, (co|net|org|govt|ac|school|geek|kiwi)\\.nz, (co|ne|or|go|re|pe)\\.kr], notMatchesRegExDescription=is a forbidden registrar-level domain name, maxLength=253, required=true, writeOnce=true}",
+                "{type=string, propertyName=targetUnixUser, matchesRegEx=[^[a-z][a-z0-9]{2}[0-9]{2}$|^[a-z][a-z0-9]{2}[0-9]{2}-[a-z0-9\\._-]+$], matchesRegExDescription=is not a valid unix-user name, maxLength=253, required=true, writeOnce=true}",
                 "{type=string, propertyName=verificationCode, minLength=12, maxLength=64, computed=IN_INIT}");
     }
 }