diff --git a/plugins/catalog-backend/src/ingestion/CatalogRules.test.ts b/plugins/catalog-backend/src/ingestion/CatalogRules.test.ts
index e87296e0a1..06bb1389a9 100644
--- a/plugins/catalog-backend/src/ingestion/CatalogRules.test.ts
+++ b/plugins/catalog-backend/src/ingestion/CatalogRules.test.ts
@@ -54,6 +54,28 @@ const location: Record<string, LocationSpec> = {
 };
 
 describe('DefaultCatalogRulesEnforcer', () => {
+  it('should throw an error if both match and target are used', () => {
+    expect(() =>
+      DefaultCatalogRulesEnforcer.fromConfig(
+        new ConfigReader({
+          catalog: {
+            rules: [
+              {
+                allow: ['Component'],
+                locations: [
+                  {
+                    type: 'url',
+                    match: 'https://github.com/b/**',
+                    target: 'https://github.com/a/b/blob/master/w.yaml',
+                  },
+                ],
+              },
+            ],
+          },
+        }),
+      ),
+    ).toThrow(/cannot have both target and match values/i);
+  });
   it('should deny by default', () => {
     const enforcer = new DefaultCatalogRulesEnforcer([]);
     expect(enforcer.isAllowed(entity.user, location.x)).toBe(false);
diff --git a/plugins/catalog-backend/src/ingestion/CatalogRules.ts b/plugins/catalog-backend/src/ingestion/CatalogRules.ts
index 3428eeaabc..38561e0970 100644
--- a/plugins/catalog-backend/src/ingestion/CatalogRules.ts
+++ b/plugins/catalog-backend/src/ingestion/CatalogRules.ts
@@ -100,11 +100,19 @@ export class DefaultCatalogRulesEnforcer implements CatalogRulesEnforcer {
           allow: ruleConf.getStringArray('allow').map(kind => ({ kind })),
           locations: ruleConf
             .getOptionalConfigArray('locations')
-            ?.map(locationConfig => ({
-              match: locationConfig.getOptionalString('match'),
-              type: locationConfig.getString('type'),
-              target: locationConfig.getOptionalString('target'),
-            })),
+            ?.map(locationConfig => {
+              const location = {
+                match: locationConfig.getOptionalString('match'),
+                type: locationConfig.getString('type'),
+                target: locationConfig.getOptionalString('target'),
+              };
+              if (location.match && location.target) {
+                throw new Error(
+                  'A catalog rule location cannot have both target and match values',
+                );
+              }
+              return location;
+            }),
         }));
       rules.push(...globalRules);
     } else {