diff --git a/changelogs/unreleased/po-fix-cache-invalidator-ff.yml b/changelogs/unreleased/po-fix-cache-invalidator-ff.yml
new file mode 100644
index 0000000000000000000000000000000000000000..6c9bbced27a21cd44cb744cc90f6be976c93be3a
--- /dev/null
+++ b/changelogs/unreleased/po-fix-cache-invalidator-ff.yml
@@ -0,0 +1,5 @@
+---
+title: Fix cache invalidator feature flag
+merge_request: 1714
+author:
+type: fixed
diff --git a/internal/metadata/featureflag/feature_flags.go b/internal/metadata/featureflag/feature_flags.go
index ea26ca3c16858eb4c28713e0f7275e4d61e467b3..97e5c6cf035695bfbaefdf84d0b98133f45cc8ef 100644
--- a/internal/metadata/featureflag/feature_flags.go
+++ b/internal/metadata/featureflag/feature_flags.go
@@ -1,20 +1,37 @@
 package featureflag
 
-const (
-	// UploadPackFilter enables partial clones by sending uploadpack.allowFilter and uploadpack.allowAnySHA1InWant
-	// to upload-pack
-	UploadPackFilter = "upload_pack_filter"
-	// LinguistFileCountStats will invoke an additional git-linguist command to get the number of files per language
-	LinguistFileCountStats = "linguist_file_count_stats"
-	// HooksRPC will invoke update, pre receive, and post receive hooks by using RPCs
-	HooksRPC = "hooks_rpc"
-	// CacheInvalidator controls the tracking of repo state via gRPC
-	// annotations (i.e. accessor and mutator RPC's). This enables cache
-	// invalidation by changing state when the repo is modified.
-	CacheInvalidator = "cache-invalidator"
+import (
+	"fmt"
+	"regexp"
+)
+
+// UploadPackFilter enables partial clones by sending uploadpack.allowFilter and uploadpack.allowAnySHA1InWant
+// to upload-pack
+//
+// LinguistFileCountStats will invoke an additional git-linguist command to get the number of files per language
+//
+// HooksRPC will invoke update, pre receive, and post receive hooks by using RPCs
+//
+// CacheInvalidator controls the tracking of repo state via gRPC
+// annotations (i.e. accessor and mutator RPC's). This enables cache
+// invalidation by changing state when the repo is modified.
+var (
+	UploadPackFilter       = mustValidateFF("upload_pack_filter")
+	LinguistFileCountStats = mustValidateFF("linguist_file_count_stats")
+	HooksRPC               = mustValidateFF("hooks_rpc")
+	CacheInvalidator       = mustValidateFF("cache_invalidator")
 )
 
 const (
 	// HooksRPCEnvVar is the name of the environment variable we use to pass the feature flag down into gitaly-hooks
 	HooksRPCEnvVar = "GITALY_HOOK_RPCS_ENABLED"
 )
+
+var ffRegex = regexp.MustCompile(`^[[:alpha:]_]+$`)
+
+func mustValidateFF(ff string) string {
+	if !ffRegex.MatchString(ff) {
+		panic(fmt.Sprintf("invalid chars found in feature flag: %q", ff))
+	}
+	return ff
+}