diff --git a/api/internal/image/image.go b/api/internal/image/image.go
index da6af527a..acc1745dc 100644
--- a/api/internal/image/image.go
+++ b/api/internal/image/image.go
@@ -21,7 +21,14 @@ func IsImageMatched(s, t string) bool {
 	// using any OCI-valid digest algorithm match consistently with Split,
 	// which accepts any algorithm.
 	// See https://github.com/opencontainers/image-spec/blob/main/descriptor.md#digests
-	pattern, _ := regexp.Compile("^" + t + "(:[a-zA-Z0-9_.{}-]*)?(@[a-zA-Z0-9]+([.+_-][a-zA-Z0-9]+)*:[a-zA-Z0-9_.{}-]*)?$")
+	// The name t comes from kustomization images[].name and is interpolated
+	// into the pattern directly, so it can be an invalid regexp (for example
+	// "["). When it fails to compile, treat it as matching nothing rather than
+	// dereferencing a nil *Regexp, which would panic during the build.
+	pattern, err := regexp.Compile("^" + t + "(:[a-zA-Z0-9_.{}-]*)?(@[a-zA-Z0-9]+([.+_-][a-zA-Z0-9]+)*:[a-zA-Z0-9_.{}-]*)?$")
+	if err != nil {
+		return false
+	}
 	return pattern.MatchString(s)
 }
 
diff --git a/api/internal/image/image_test.go b/api/internal/image/image_test.go
index 334f639f1..099cd9216 100644
--- a/api/internal/image/image_test.go
+++ b/api/internal/image/image_test.go
@@ -75,6 +75,14 @@ func TestIsImageMatched(t *testing.T) {
 			name:      "nginx",
 			isMatched: false,
 		},
+		{
+			// A name that is not a valid regexp must not panic. It can't
+			// compile, so it should simply match nothing.
+			testName:  "name is an invalid regexp",
+			value:     "nginx",
+			name:      "[",
+			isMatched: false,
+		},
 	}
 
 	for _, tc := range testCases {
diff --git a/api/krusty/transformersimage_test.go b/api/krusty/transformersimage_test.go
index 38f7d3775..b014f36c3 100644
--- a/api/krusty/transformersimage_test.go
+++ b/api/krusty/transformersimage_test.go
@@ -401,3 +401,42 @@ spec:
             image: solsa-echo:foo
 `)
 }
+
+// An images[].name value that is not a valid regexp (here "[") used to crash
+// the build with a nil-pointer panic. It should be treated as matching no
+// container image, so the resource passes through untouched.
+func TestTransfomersImageInvalidNameRegexp(t *testing.T) {
+	th := kusttest_test.MakeHarness(t)
+	th.WriteK(".", `
+resources:
+- deploy.yaml
+images:
+- name: "["
+  newTag: v2
+`)
+	th.WriteF("deploy.yaml", `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deploy
+spec:
+  template:
+    spec:
+      containers:
+      - name: nginx
+        image: nginx:1.7.9
+`)
+	m := th.Run(".", th.MakeDefaultOptions())
+	th.AssertActualEqualsExpected(m, `
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: deploy
+spec:
+  template:
+    spec:
+      containers:
+      - image: nginx:1.7.9
+        name: nginx
+`)
+}