diff --git a/packages/backend-common/src/reading/FetchUrlReader.test.ts b/packages/backend-common/src/reading/FetchUrlReader.test.ts
index 124abb799c..9d6edee765 100644
--- a/packages/backend-common/src/reading/FetchUrlReader.test.ts
+++ b/packages/backend-common/src/reading/FetchUrlReader.test.ts
@@ -77,6 +77,10 @@ describe('FetchUrlReader', () => {
               { host: 'example.com:700' },
               { host: '*.examples.org' },
               { host: '*.examples.org:700' },
+              {
+                host: 'foobar.org',
+                paths: ['/dir1/'],
+              },
             ],
           },
         },
@@ -106,6 +110,9 @@ describe('FetchUrlReader', () => {
     expect(predicate(new URL('https://examples.org:700/test'))).toBe(false);
     expect(predicate(new URL('https://a.examples.org:700/test'))).toBe(true);
     expect(predicate(new URL('https://a.b.examples.org:700/test'))).toBe(true);
+    expect(predicate(new URL('https://foobar.org/dir1/subpath'))).toBe(true);
+    expect(predicate(new URL('https://foobar.org/dir12'))).toBe(false);
+    expect(predicate(new URL('https://foobar.org/'))).toBe(false);
   });
 
   describe('read', () => {
diff --git a/packages/backend-common/src/reading/FetchUrlReader.ts b/packages/backend-common/src/reading/FetchUrlReader.ts
index 732d3b9f59..1ae9677a85 100644
--- a/packages/backend-common/src/reading/FetchUrlReader.ts
+++ b/packages/backend-common/src/reading/FetchUrlReader.ts
@@ -24,6 +24,7 @@ import {
   SearchResponse,
   UrlReader,
 } from './types';
+import { normalize as normalizePath } from 'path';
 
 /**
  * A UrlReader that does a plain fetch of the URL.
@@ -39,18 +40,28 @@ export class FetchUrlReader implements UrlReader {
    * `host`:
    *   Either full hostnames to match, or subdomain wildcard matchers with a leading `*`.
    *   For example `example.com` and `*.example.com` are valid values, `prod.*.example.com` is not.
+   *
+   * `paths`:
+   *   An optional list of paths which are allowed. If the list is omitted all paths are allowed.
    */
   static factory: ReaderFactory = ({ config }) => {
     const predicates =
       config
         .getOptionalConfigArray('backend.reading.allow')
         ?.map(allowConfig => {
+          const paths = allowConfig.getOptionalStringArray('paths');
+          const checkPath = paths
+            ? (url: URL) => {
+                const targetPath = normalizePath(url.pathname);
+                return paths.some(path => targetPath.startsWith(path));
+              }
+            : (_url: URL) => true;
           const host = allowConfig.getString('host');
           if (host.startsWith('*.')) {
             const suffix = host.slice(1);
-            return (url: URL) => url.host.endsWith(suffix);
+            return (url: URL) => url.host.endsWith(suffix) && checkPath(url);
           }
-          return (url: URL) => url.host === host;
+          return (url: URL) => url.host === host && checkPath(url);
         }) ?? [];
 
     const reader = new FetchUrlReader();