Literal dash in regular expression brackets

I'm trying to place a literal '-' in a bracketed character set in a regular
expression for a check constraint. I am currently escaping it with a '\',
however, it still winds up in the table definition as a non-literal dash and
is interpreted as a character range. For instance:

CREATE TABLE retest
(
    hostname VARCHAR(100) CHECK (hostname ~ '^[a-zA-Z0-9\-\.]+$' )
);

works (in the psql utility). Then if I do

INSERT INTO retest(hostname) VALUES ('asdf.com');

psql says

ERROR:  Invalid regular expression: invalid character range in [ ]

If I look at the table definition, the regex reads as '^[a-zA-Z0-9-.]+$'. So
how do I put a literal '-' in the bracket set? Backslashing doesn't seem to
work. Is the '.' being interpreted too? The '.' is supposed to be a literal
'.' as well.

Thanks