diff --git a/weed/s3api/object_lock_utils.go b/weed/s3api/object_lock_utils.go
index d58bc7b8e..a3eddca45 100644
--- a/weed/s3api/object_lock_utils.go
+++ b/weed/s3api/object_lock_utils.go
@@ -326,6 +326,11 @@ func validateDefaultRetention(retention *DefaultRetention) error {
 		return ErrInvalidRetentionPeriod
 	}
 
+	// Check for invalid Years value (zero is invalid when explicitly provided)
+	if retention.YearsSet && retention.Years == 0 {
+		return ErrInvalidRetentionPeriod
+	}
+
 	// Check for neither Days nor Years being specified
 	if !retention.DaysSet && !retention.YearsSet {
 		return ErrDefaultRetentionMissingPeriod
diff --git a/weed/s3api/s3api_object_retention_test.go b/weed/s3api/s3api_object_retention_test.go
index 34c772acd..be42df700 100644
--- a/weed/s3api/s3api_object_retention_test.go
+++ b/weed/s3api/s3api_object_retention_test.go
@@ -786,6 +786,16 @@ func TestValidateDefaultRetention(t *testing.T) {
 			expectError: true,
 			errorMsg:    "default retention must specify either Days or Years",
 		},
+		{
+			name: "Zero years",
+			retention: &DefaultRetention{
+				Mode:     "GOVERNANCE",
+				Years:    0,
+				YearsSet: true,
+			},
+			expectError: true,
+			errorMsg:    "invalid retention period specified",
+		},
 	}
 
 	for _, tt := range tests {