diff --git a/src/core/Schemas.ts b/src/core/Schemas.ts
index d3f0256ae..285c704a7 100644
--- a/src/core/Schemas.ts
+++ b/src/core/Schemas.ts
@@ -179,10 +179,13 @@ export const AttackIntentSchema = BaseIntentSchema.extend({
   troops: z.number().nullable(),
 });
 
+export const UsernameSchema = SafeString;
+export const FlagSchema = z.string().max(128).optional();
+
 export const SpawnIntentSchema = BaseIntentSchema.extend({
-  flag: z.string().nullable(),
   type: z.literal("spawn"),
-  name: SafeString,
+  name: UsernameSchema,
+  flag: FlagSchema,
   playerType: PlayerTypeSchema,
   x: z.number(),
   y: z.number(),
@@ -346,8 +349,8 @@ export const ServerPrestartMessageSchema = ServerBaseMessageSchema.extend({
 
 export const PlayerSchema = z.object({
   clientID: ID,
-  username: SafeString,
-  flag: SafeString.optional(),
+  username: UsernameSchema,
+  flag: FlagSchema,
 });
 
 export const GameStartInfoSchema = z.object({
@@ -424,8 +427,8 @@ export const ClientJoinMessageSchema = z.object({
   token: TokenSchema, // WARNING: PII
   gameID: ID,
   lastTurn: z.number(), // The last turn the client saw.
-  username: SafeString,
-  flag: SafeString.optional(),
+  username: UsernameSchema,
+  flag: FlagSchema,
 });
 
 export const ClientMessageSchema = z.discriminatedUnion("type", [