diff --git a/roles/httpd/reverseproxy/templates/reversepassproxy.candidate-registry.conf b/roles/httpd/reverseproxy/templates/reversepassproxy.candidate-registry.conf
index cc62277402..a3f7ccf22b 100644
--- a/roles/httpd/reverseproxy/templates/reversepassproxy.candidate-registry.conf
+++ b/roles/httpd/reverseproxy/templates/reversepassproxy.candidate-registry.conf
@@ -6,8 +6,18 @@ ProxyPreserveHost On
 ProxyPass {{ localpath }} {{ proxyurl }}{{remotepath}}
 ProxyPassReverse {{ localpath }} {{ proxyurl }}{{remotepath}}
 
-# No more v1
+# Only pull from v1
 <Location /v1/>
+  <Limit GET HEAD>
+    Require all granted
+  </Limit>
+  <Limit POST PUT DELETE>
+    Require all denied
+  </Limit>
+</Location>
+
+# And disallow the fallback for v1 auth
+<Location /v1/users/>
   Require all denied
 </Location>