diff --git a/Sources/Services/ContainerAPIService/Client/Parser.swift b/Sources/Services/ContainerAPIService/Client/Parser.swift
index ef209df5c..3dd5fa3ba 100644
--- a/Sources/Services/ContainerAPIService/Client/Parser.swift
+++ b/Sources/Services/ContainerAPIService/Client/Parser.swift
@@ -369,7 +369,10 @@ public struct Parser {
         var directives = defaultDirectives
         for part in parts {
             let keyVal = part.split(separator: "=", maxSplits: 2)
-            var key = String(keyVal[0])
+            guard let rawKey = keyVal.first else {
+                throw ContainerizationError(.invalidArgument, message: "invalid mount directive '\(part)' in \(mount)")
+            }
+            var key = String(rawKey)
             var skipValue = false
             switch key {
             case "type", "size", "mode":
diff --git a/Tests/ContainerAPIClientTests/ParserTest.swift b/Tests/ContainerAPIClientTests/ParserTest.swift
index 0dcc6f7cf..41419f44b 100644
--- a/Tests/ContainerAPIClientTests/ParserTest.swift
+++ b/Tests/ContainerAPIClientTests/ParserTest.swift
@@ -512,6 +512,23 @@ struct ParserTest {
         }
     }
 
+    @Test
+    func testMountEmptyDirectiveSegment() throws {
+        // A comma-segment consisting solely of "=" characters splits to an empty
+        // array under Swift's default omittingEmptySubsequences, so reading the
+        // key without a guard would trap. These must surface a validation error.
+        for input in ["=", "==", "type=bind,=,dst=/foo"] {
+            #expect {
+                _ = try Parser.mount(input)
+            } throws: { error in
+                guard let error = error as? ContainerizationError else {
+                    return false
+                }
+                return error.description.contains("invalid mount directive")
+            }
+        }
+    }
+
     @Test
     func testIsValidDomainNameOk() throws {
         let names = [