diff --git a/.changeset/wild-knives-wait.md b/.changeset/wild-knives-wait.md
new file mode 100644
index 0000000000..6aafbe7acd
--- /dev/null
+++ b/.changeset/wild-knives-wait.md
@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-catalog-backend': minor
+'@backstage/plugin-catalog-node': minor
+---
+
+Permission rules can now be added for the Catalog plugin through the `CatalogPermissionExtensionPoint` interface.
diff --git a/plugins/catalog-backend/src/service/CatalogPlugin.ts b/plugins/catalog-backend/src/service/CatalogPlugin.ts
index fa53ef510b..0800d41340 100644
--- a/plugins/catalog-backend/src/service/CatalogPlugin.ts
+++ b/plugins/catalog-backend/src/service/CatalogPlugin.ts
@@ -17,12 +17,14 @@ import {
   createBackendPlugin,
   coreServices,
 } from '@backstage/backend-plugin-api';
-import { CatalogBuilder } from './CatalogBuilder';
+import { CatalogBuilder, CatalogPermissionRuleInput } from './CatalogBuilder';
 import {
   CatalogAnalysisExtensionPoint,
   catalogAnalysisExtensionPoint,
   CatalogProcessingExtensionPoint,
   catalogProcessingExtensionPoint,
+  CatalogPermissionExtensionPoint,
+  catalogPermissionExtensionPoint,
 } from '@backstage/plugin-catalog-node/alpha';
 import {
   CatalogProcessor,
@@ -86,6 +88,24 @@ class CatalogAnalysisExtensionPointImpl
   }
 }
 
+class CatalogPermissionExtensionPointImpl
+  implements CatalogPermissionExtensionPoint
+{
+  #permissionRules = new Array<CatalogPermissionRuleInput>();
+
+  addPermissionRules(
+    ...rules: Array<
+      CatalogPermissionRuleInput | Array<CatalogPermissionRuleInput>
+    >
+  ): void {
+    this.#permissionRules.push(...rules.flat());
+  }
+
+  get permissionRules() {
+    return this.#permissionRules;
+  }
+}
+
 /**
  * Catalog plugin
  * @alpha
@@ -106,6 +126,12 @@ export const catalogPlugin = createBackendPlugin({
       analysisExtensions,
     );
 
+    const permissionExtensions = new CatalogPermissionExtensionPointImpl();
+    env.registerExtensionPoint(
+      catalogPermissionExtensionPoint,
+      permissionExtensions,
+    );
+
     env.registerInit({
       deps: {
         logger: coreServices.logger,
@@ -142,6 +168,7 @@ export const catalogPlugin = createBackendPlugin({
           ([key, resolver]) => builder.setPlaceholderResolver(key, resolver),
         );
         builder.addLocationAnalyzers(...analysisExtensions.locationAnalyzers);
+        builder.addPermissionRules(...permissionExtensions.permissionRules);
 
         const { processingEngine, router } = await builder.build();
 
diff --git a/plugins/catalog-node/api-report-alpha.md b/plugins/catalog-node/api-report-alpha.md
index c4dc6b12e1..7350f9262c 100644
--- a/plugins/catalog-node/api-report-alpha.md
+++ b/plugins/catalog-node/api-report-alpha.md
@@ -5,8 +5,11 @@
 ```ts
 import { CatalogApi } from '@backstage/catalog-client';
 import { CatalogProcessor } from '@backstage/plugin-catalog-node';
+import { Entity } from '@backstage/catalog-model';
 import { EntityProvider } from '@backstage/plugin-catalog-node';
 import { ExtensionPoint } from '@backstage/backend-plugin-api';
+import { PermissionRule } from '@backstage/plugin-permission-node';
+import { PermissionRuleParams } from '@backstage/plugin-permission-common';
 import { PlaceholderResolver } from '@backstage/plugin-catalog-node';
 import { ScmLocationAnalyzer } from '@backstage/plugin-catalog-node';
 import { ServiceRef } from '@backstage/backend-plugin-api';
@@ -20,6 +23,24 @@ export interface CatalogAnalysisExtensionPoint {
 // @alpha (undocumented)
 export const catalogAnalysisExtensionPoint: ExtensionPoint<CatalogAnalysisExtensionPoint>;
 
+// @alpha (undocumented)
+export interface CatalogPermissionExtensionPoint {
+  // (undocumented)
+  addPermissionRules(
+    ...rules: Array<
+      CatalogPermissionRuleInput | Array<CatalogPermissionRuleInput>
+    >
+  ): void;
+}
+
+// @alpha (undocumented)
+export const catalogPermissionExtensionPoint: ExtensionPoint<CatalogPermissionExtensionPoint>;
+
+// @alpha (undocumented)
+export type CatalogPermissionRuleInput<
+  TParams extends PermissionRuleParams = PermissionRuleParams,
+> = PermissionRule<Entity, EntitiesSearchFilter, 'catalog-entity', TParams>;
+
 // @alpha (undocumented)
 export interface CatalogProcessingExtensionPoint {
   // (undocumented)
@@ -40,5 +61,11 @@ export const catalogProcessingExtensionPoint: ExtensionPoint<CatalogProcessingEx
 // @alpha
 export const catalogServiceRef: ServiceRef<CatalogApi, 'plugin'>;
 
+// @alpha (undocumented)
+export type EntitiesSearchFilter = {
+  key: string;
+  values?: string[];
+};
+
 // (No @packageDocumentation comment for this package)
 ```
diff --git a/plugins/catalog-node/package.json b/plugins/catalog-node/package.json
index f76fde6ecf..85ca35831c 100644
--- a/plugins/catalog-node/package.json
+++ b/plugins/catalog-node/package.json
@@ -47,6 +47,8 @@
     "@backstage/catalog-model": "workspace:^",
     "@backstage/errors": "workspace:^",
     "@backstage/plugin-catalog-common": "workspace:^",
+    "@backstage/plugin-permission-common": "workspace:^",
+    "@backstage/plugin-permission-node": "workspace:^",
     "@backstage/types": "workspace:^"
   },
   "devDependencies": {
diff --git a/plugins/catalog-node/src/alpha.ts b/plugins/catalog-node/src/alpha.ts
index cec1a0eedb..f7b2ceac12 100644
--- a/plugins/catalog-node/src/alpha.ts
+++ b/plugins/catalog-node/src/alpha.ts
@@ -19,3 +19,9 @@ export type { CatalogProcessingExtensionPoint } from './extensions';
 export { catalogProcessingExtensionPoint } from './extensions';
 export type { CatalogAnalysisExtensionPoint } from './extensions';
 export { catalogAnalysisExtensionPoint } from './extensions';
+export type {
+  EntitiesSearchFilter,
+  CatalogPermissionRuleInput,
+} from './extensions';
+export type { CatalogPermissionExtensionPoint } from './extensions';
+export { catalogPermissionExtensionPoint } from './extensions';
diff --git a/plugins/catalog-node/src/extensions.ts b/plugins/catalog-node/src/extensions.ts
index 247ef142ad..2dd0915ccf 100644
--- a/plugins/catalog-node/src/extensions.ts
+++ b/plugins/catalog-node/src/extensions.ts
@@ -20,6 +20,9 @@ import {
   PlaceholderResolver,
   ScmLocationAnalyzer,
 } from '@backstage/plugin-catalog-node';
+import { Entity } from '@backstage/catalog-model';
+import { PermissionRuleParams } from '@backstage/plugin-permission-common';
+import { PermissionRule } from '@backstage/plugin-permission-node';
 
 /**
  * @alpha
@@ -56,3 +59,37 @@ export const catalogAnalysisExtensionPoint =
   createExtensionPoint<CatalogAnalysisExtensionPoint>({
     id: 'catalog.analysis',
   });
+
+/**
+ * @alpha
+ */
+export type EntitiesSearchFilter = {
+  key: string;
+  values?: string[];
+};
+
+/**
+ * @alpha
+ */
+export type CatalogPermissionRuleInput<
+  TParams extends PermissionRuleParams = PermissionRuleParams,
+> = PermissionRule<Entity, EntitiesSearchFilter, 'catalog-entity', TParams>;
+
+/**
+ * @alpha
+ */
+export interface CatalogPermissionExtensionPoint {
+  addPermissionRules(
+    ...rules: Array<
+      CatalogPermissionRuleInput | Array<CatalogPermissionRuleInput>
+    >
+  ): void;
+}
+
+/**
+ * @alpha
+ */
+export const catalogPermissionExtensionPoint =
+  createExtensionPoint<CatalogPermissionExtensionPoint>({
+    id: 'catalog.permission',
+  });
diff --git a/yarn.lock b/yarn.lock
index 19ca7d4edc..35345de358 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -5940,6 +5940,8 @@ __metadata:
     "@backstage/cli": "workspace:^"
     "@backstage/errors": "workspace:^"
     "@backstage/plugin-catalog-common": "workspace:^"
+    "@backstage/plugin-permission-common": "workspace:^"
+    "@backstage/plugin-permission-node": "workspace:^"
     "@backstage/types": "workspace:^"
   languageName: unknown
   linkType: soft