diff --git a/src/app-layer-ssl.c b/src/app-layer-ssl.c
index 3bffa3f7dc..edbef8a5d7 100644
--- a/src/app-layer-ssl.c
+++ b/src/app-layer-ssl.c
@@ -952,20 +952,18 @@ static inline int TLSDecodeHSHelloExtensionSni(SSLState *ssl_state,
         return (int)(input - initial_input);
     }
 
-    const size_t sni_strlen = sni_len + 1;
-    ssl_state->curr_connp->sni = SCMalloc(sni_strlen);
+    ssl_state->curr_connp->sni_len = sni_len;
+    ssl_state->curr_connp->sni = SCMalloc(sni_len);
     if (unlikely(ssl_state->curr_connp->sni == NULL))
         return -1;
 
     const size_t consumed = input - initial_input;
-    if (SafeMemcpy(ssl_state->curr_connp->sni, 0, sni_strlen,
-                initial_input, consumed, input_len, sni_len) != 0) {
+    if (SafeMemcpy(ssl_state->curr_connp->sni, 0, sni_len, initial_input, consumed, input_len,
+                sni_len) != 0) {
         SCFree(ssl_state->curr_connp->sni);
         ssl_state->curr_connp->sni = NULL;
         return -1;
     }
-    ssl_state->curr_connp->sni[sni_strlen-1] = 0;
-
     input += sni_len;
 
     return (int)(input - initial_input);
diff --git a/src/app-layer-ssl.h b/src/app-layer-ssl.h
index a3fe03e45f..3f8af2255f 100644
--- a/src/app-layer-ssl.h
+++ b/src/app-layer-ssl.h
@@ -197,7 +197,8 @@ typedef struct SSLStateConnp_ {
     char **cert0_sans;
     uint16_t cert0_sans_len;
     /* ssl server name indication extension */
-    char *sni;
+    uint8_t *sni;
+    uint16_t sni_len;
 
     char *session_id;
 
diff --git a/src/detect-tls-sni.c b/src/detect-tls-sni.c
index c9a228c1f2..099138c9d9 100644
--- a/src/detect-tls-sni.c
+++ b/src/detect-tls-sni.c
@@ -1,4 +1,4 @@
-/* Copyright (C) 2007-2023 Open Information Security Foundation
+/* Copyright (C) 2007-2025 Open Information Security Foundation
  *
  * You can copy, redistribute or modify this Program under the terms of
  * the GNU General Public License version 2 as published by the Free
@@ -120,8 +120,8 @@ static InspectionBuffer *GetData(DetectEngineThreadCtx *det_ctx,
             return NULL;
         }
 
-        const uint32_t data_len = (uint32_t)strlen(ssl_state->client_connp.sni);
-        const uint8_t *data = (uint8_t *)ssl_state->client_connp.sni;
+        const uint32_t data_len = ssl_state->client_connp.sni_len;
+        const uint8_t *data = ssl_state->client_connp.sni;
 
         InspectionBufferSetupAndApplyTransforms(
                 det_ctx, list_id, buffer, data, data_len, transforms);
diff --git a/src/output-json-tls.c b/src/output-json-tls.c
index 44800115bd..6b02eab5ee 100644
--- a/src/output-json-tls.c
+++ b/src/output-json-tls.c
@@ -188,7 +188,8 @@ static void JsonTlsLogFingerprint(SCJsonBuilder *js, SSLState *ssl_state)
 static void JsonTlsLogSni(SCJsonBuilder *js, SSLState *ssl_state)
 {
     if (ssl_state->client_connp.sni) {
-        SCJbSetString(js, "sni", ssl_state->client_connp.sni);
+        SCJbSetStringFromBytes(
+                js, "sni", ssl_state->client_connp.sni, ssl_state->client_connp.sni_len);
     }
 }
 
diff --git a/src/util-lua-tls.c b/src/util-lua-tls.c
index cc37ff3197..7cd5a73c28 100644
--- a/src/util-lua-tls.c
+++ b/src/util-lua-tls.c
@@ -205,8 +205,8 @@ static int GetSNI(lua_State *luastate, const SSLState *ssl_state)
     if (ssl_state->client_connp.sni == NULL)
         return LuaCallbackError(luastate, "error: no server name indication");
 
-    return LuaPushStringBuffer(luastate, (uint8_t *)ssl_state->client_connp.sni,
-                               strlen(ssl_state->client_connp.sni));
+    return LuaPushStringBuffer(
+            luastate, ssl_state->client_connp.sni, ssl_state->client_connp.sni_len);
 }
 
 static int LuaTlsGetSNI(lua_State *luastate)