diff --git a/cmd/ateapi/internal/controlapi/actor_template.go b/cmd/ateapi/internal/controlapi/actor_template.go
index adbf44c2e9..c53b808ab8 100644
--- a/cmd/ateapi/internal/controlapi/actor_template.go
+++ b/cmd/ateapi/internal/controlapi/actor_template.go
@@ -196,6 +196,17 @@ func ValidateCustom_HTTPGetAction_Path(_ context.Context, _ operation.Operation,
 	return nil
 }
 
+// pauseContainerName is the container the ateom creates for each actor,
+// an application container using the same will would collide with it.
+const pauseContainerName = "pause"
+
+func ValidateCustom_Container_Name(_ context.Context, _ operation.Operation, fldPath *field.Path, value, _ *string) field.ErrorList {
+	if *value == pauseContainerName {
+		return field.ErrorList{field.Invalid(fldPath, *value, "is reserved for the sandbox's pause container")}
+	}
+	return nil
+}
+
 // mountPathBadSegmentRE matches '.' or '..' path segments.
 var mountPathBadSegmentRE = regexp.MustCompile(`(^|/)[.][.]?(/|$)`)
 
diff --git a/cmd/ateapi/internal/controlapi/actor_template_test.go b/cmd/ateapi/internal/controlapi/actor_template_test.go
index 84d44cd48f..3ef2b3943b 100644
--- a/cmd/ateapi/internal/controlapi/actor_template_test.go
+++ b/cmd/ateapi/internal/controlapi/actor_template_test.go
@@ -118,6 +118,12 @@ func TestValidateCreateActorTemplateRequest(t *testing.T) {
 			tmpl.Containers[0].Name = "Main_1"
 		})},
 		field.ErrorList{field.Invalid(field.NewPath("actor_template", "containers").Index(0).Child("name"), "Main_1", "").WithOrigin("format=k8s-short-name")},
+	}, {
+		"container named pause",
+		&ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) {
+			tmpl.Containers[0].Name = "pause"
+		})},
+		field.ErrorList{field.Invalid(field.NewPath("actor_template", "containers").Index(0).Child("name"), "pause", "")},
 	}, {
 		"container missing image",
 		&ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) {
diff --git a/cmd/ateapi/internal/controlapi/zz_generated.validation.go b/cmd/ateapi/internal/controlapi/zz_generated.validation.go
index 435446bd8c..4f78398474 100644
--- a/cmd/ateapi/internal/controlapi/zz_generated.validation.go
+++ b/cmd/ateapi/internal/controlapi/zz_generated.validation.go
@@ -1334,6 +1334,10 @@ func Validate_Container(
 			if earlyReturn {
 				return // do not proceed
 			}
+			// custom validation
+			if e := ValidateCustom_Container_Name(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
+				errs = append(errs, e...)
+			}
 			if e := validate.ShortName(ctx, op, fldPath, obj, oldObj); len(e) != 0 {
 				errs = append(errs, e...)
 			}
diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go
index 4ef399a2ca..aac7caaf95 100644
--- a/pkg/proto/ateapipb/ateapi.pb.go
+++ b/pkg/proto/ateapipb/ateapi.pb.go
@@ -2669,6 +2669,7 @@ type Container struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// +k8s:required
 	// +k8s:format=k8s-short-name
+	// +k8s:customValidation # name must not be "pause" as we have it for every actor
 	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
 	// +k8s:required
 	// +k8s:maxLength=512 # matches ImageVolumeSource.reference's bound
diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto
index ffadb9e7bf..c382992566 100644
--- a/pkg/proto/ateapipb/ateapi.proto
+++ b/pkg/proto/ateapipb/ateapi.proto
@@ -888,6 +888,7 @@ message OnResumeConfig {
 message Container {
   // +k8s:required
   // +k8s:format=k8s-short-name
+  // +k8s:customValidation # name must not be "pause" as we have it for every actor
   string name = 1;
 
   // +k8s:required