diff --git a/plugins/catalog-backend/src/ingestion/CatalogRules.ts b/plugins/catalog-backend/src/ingestion/CatalogRules.ts
index ea4e520177..f6026a84cd 100644
--- a/plugins/catalog-backend/src/ingestion/CatalogRules.ts
+++ b/plugins/catalog-backend/src/ingestion/CatalogRules.ts
@@ -19,6 +19,7 @@ import { Entity } from '@backstage/catalog-model';
 import path from 'path';
 import { LocationSpec } from '@backstage/plugin-catalog-common';
 import { minimatch } from 'minimatch';
+import { z } from 'zod';
 
 /**
  * Rules to apply to catalog entities.
@@ -47,6 +48,16 @@ export type CatalogRulesEnforcer = {
   isAllowed(entity: Entity, location: LocationSpec): boolean;
 };
 
+const allowRuleParser = z.array(
+  z
+    .object({
+      kind: z.string(),
+      'spec.type': z.string().optional(),
+    })
+    .or(z.string())
+    .transform(val => (typeof val === 'string' ? { kind: val } : val)),
+);
+
 /**
  * Implements the default catalog rule set, consuming the config keys
  * `catalog.rules` and `catalog.locations.[].rules`.
@@ -111,14 +122,7 @@ export class DefaultCatalogRulesEnforcer implements CatalogRulesEnforcer {
       const globalRules = config
         .getConfigArray('catalog.rules')
         .map(ruleConf => ({
-          allow: ruleConf
-            .get<Array<string | CatalogRuleAllow>>('allow')
-            .map(kindOrObject => {
-              if (typeof kindOrObject === 'string') {
-                return { kind: kindOrObject };
-              }
-              return kindOrObject;
-            }),
+          allow: allowRuleParser.parse(ruleConf.get('allow')),
           locations: ruleConf
             .getOptionalConfigArray('locations')
             ?.map(locationConfig => {