diff --git a/src/registrar/admin.py b/src/registrar/admin.py
index c04975cb9..117f689f8 100644
--- a/src/registrar/admin.py
+++ b/src/registrar/admin.py
@@ -2442,10 +2442,12 @@ class DomainRequestAdmin(ListHeaderAdmin, ImportExportModelAdmin):
             obj_id = domain.id
             change_url = reverse("admin:%s_%s_change" % (app_label, model_name), args=[obj_id])
 
-            message = f"<li>The status of this domain request cannot be changed because it has been joined to a domain in Ready status: "  # noqa
-            message += f"<a href='{change_url}'>{domain}</a></li>"
-
-            message_html = mark_safe(message)  # nosec
+message = format_html(
+    "<li>The status of this domain request cannot be changed because it has been joined to a domain in Ready status:"
+    "<a href='{}'>{}</a></li>",
+    mark_safe(change_url),
+    escape(str(domain))
+)
             messages.warning(
                 request,
                 message_html,