diff --git a/core/dnsserver/zdirectives.go b/core/dnsserver/zdirectives.go
index 171f8d1a6..ec8d654d7 100644
--- a/core/dnsserver/zdirectives.go
+++ b/core/dnsserver/zdirectives.go
@@ -42,11 +42,11 @@ var Directives = []string{
 	"loadbalance",
 	"tsig",
 	"rewrite",
+	"autopath",
 	"acl",
 	"cache",
 	"header",
 	"dnssec",
-	"autopath",
 	"minimal",
 	"template",
 	"transfer",
diff --git a/plugin.cfg b/plugin.cfg
index 0235cc126..055b08bdb 100644
--- a/plugin.cfg
+++ b/plugin.cfg
@@ -51,11 +51,11 @@ chaos:chaos
 loadbalance:loadbalance
 tsig:tsig
 rewrite:rewrite
+autopath:autopath
 acl:acl
 cache:cache
 header:header
 dnssec:dnssec
-autopath:autopath
 minimal:minimal
 template:template
 transfer:transfer
diff --git a/test/acl_autopath_test.go b/test/acl_autopath_test.go
new file mode 100644
index 000000000..cef820450
--- /dev/null
+++ b/test/acl_autopath_test.go
@@ -0,0 +1,70 @@
+package test
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/miekg/dns"
+)
+
+func TestACLAuthorizesAutopathExpandedName(t *testing.T) {
+	resolvConf := filepath.Join(t.TempDir(), "resolv.conf")
+	if err := os.WriteFile(
+		resolvConf,
+		[]byte("search public.example protected.example\n"),
+		0644,
+	); err != nil {
+		t.Fatalf("Could not write resolv.conf: %s", err)
+	}
+
+	corefile := `.:0 {
+		acl protected.example. {
+			block
+		}
+		autopath ` + resolvConf + `
+		hosts {
+			192.0.2.123 secret.protected.example
+		}
+	}`
+
+	server, udp, _, err := CoreDNSServerAndPorts(corefile)
+	if err != nil {
+		t.Fatalf("Could not get CoreDNS serving instance: %s", err)
+	}
+	defer server.Stop()
+
+	tests := []struct {
+		name  string
+		qname string
+	}{
+		{
+			name:  "direct protected query",
+			qname: "secret.protected.example.",
+		},
+		{
+			name:  "autopath expanded protected query",
+			qname: "secret.public.example.",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			m := new(dns.Msg)
+			m.SetQuestion(tc.qname, dns.TypeA)
+
+			r, err := dns.Exchange(m, udp)
+			if err != nil {
+				t.Fatalf("Query %q failed: %s", tc.qname, err)
+			}
+			if r.Rcode != dns.RcodeRefused {
+				t.Fatalf(
+					"Query %q: got rcode %s, want REFUSED; answers: %v",
+					tc.qname,
+					dns.RcodeToString[r.Rcode],
+					r.Answer,
+				)
+			}
+		})
+	}
+}