diff --git a/java-spiffe-core/src/main/java/io/spiffe/workloadapi/Address.java b/java-spiffe-core/src/main/java/io/spiffe/workloadapi/Address.java
index a76a244d..9c208e85 100644
--- a/java-spiffe-core/src/main/java/io/spiffe/workloadapi/Address.java
+++ b/java-spiffe-core/src/main/java/io/spiffe/workloadapi/Address.java
@@ -157,8 +157,10 @@ private static void validateTcpAddress(final URI parsedAddress) throws SocketEnd
             throw new SocketEndpointAddressException(String.format(error, parsedAddress));
         }
 
-        boolean ipValid;
-        ipValid = InetAddresses.isInetAddress(parsedAddress.getHost());
+        // URI.getHost() returns IPv6 literals enclosed in square brackets (e.g. '[::1]').
+        // Zone IDs (e.g. '[fe80::1%eth0]') are not allowed by RFC 3986, so hosts containing '%' are rejected.
+        String host = parsedAddress.getHost();
+        boolean ipValid = host.indexOf('%') < 0 && InetAddresses.isUriInetAddress(host);
         if (!ipValid) {
             String error = "Workload endpoint tcp socket URI host component must be an IP:port: %s";
             throw new SocketEndpointAddressException(String.format(error, parsedAddress));
diff --git a/java-spiffe-core/src/test/java/io/spiffe/workloadapi/AddressTest.java b/java-spiffe-core/src/test/java/io/spiffe/workloadapi/AddressTest.java
index ff6f0b6e..28037097 100644
--- a/java-spiffe-core/src/test/java/io/spiffe/workloadapi/AddressTest.java
+++ b/java-spiffe-core/src/test/java/io/spiffe/workloadapi/AddressTest.java
@@ -46,6 +46,9 @@ static Stream<Arguments> provideTestAddress() {
                 Arguments.of("unix:/path/to/endpoint.sock", URI.create("unix:/path/to/endpoint.sock")),
                 Arguments.of("unix:///path/to/endpoint.sock", URI.create("unix:///path/to/endpoint.sock")),
                 Arguments.of("tcp://127.0.0.1:8000", URI.create("tcp://127.0.0.1:8000")),
+                Arguments.of("tcp://[::1]:8000", URI.create("tcp://[::1]:8000")),
+                Arguments.of("tcp://[2001:db8::1]:8000", URI.create("tcp://[2001:db8::1]:8000")),
+                Arguments.of("tcp://[::ffff:127.0.0.1]:8000", URI.create("tcp://[::ffff:127.0.0.1]:8000")),
 
                 Arguments.of("", "Workload endpoint socket URI must have a tcp:// or unix:// scheme: "),
                 Arguments.of("\\t", "Workload endpoint socket is not a valid URI: \\t"),
@@ -69,7 +72,11 @@ static Stream<Arguments> provideTestAddress() {
                 Arguments.of("tcp://1.2.3.4:5#whatever", "Workload endpoint tcp socket URI must not include a fragment: tcp://1.2.3.4:5#whatever"),
                 Arguments.of("tcp://john:doe@1.2.3.4:5/path", "Workload endpoint tcp socket URI must not include user info: tcp://john:doe@1.2.3.4:5/path"),
                 Arguments.of("tcp://foo:9000", "Workload endpoint tcp socket URI host component must be an IP:port: tcp://foo:9000"),
-                Arguments.of("tcp://1.2.3.4", "Workload endpoint tcp socket URI host component must include a port: tcp://1.2.3.4")
+                Arguments.of("tcp://[foo]:9000", "Workload endpoint socket is not a valid URI: tcp://[foo]:9000"),
+                Arguments.of("tcp://[fe80::1%eth0]:8000", "Workload endpoint tcp socket URI host component must be an IP:port: tcp://[fe80::1%eth0]:8000"),
+                Arguments.of("tcp://[fe80::1%25eth0]:8000", "Workload endpoint tcp socket URI host component must be an IP:port: tcp://[fe80::1%25eth0]:8000"),
+                Arguments.of("tcp://1.2.3.4", "Workload endpoint tcp socket URI host component must include a port: tcp://1.2.3.4"),
+                Arguments.of("tcp://[::1]", "Workload endpoint tcp socket URI host component must include a port: tcp://[::1]")
         );
     }