diff --git a/config/environments/production.rb b/config/environments/production.rb
index 0a2ef69715c..ac0d9e1b437 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -104,7 +104,7 @@
 
   # Enable DNS rebinding protection and other `Host` header attacks.
   config.hosts = [
-    /whitehall-admin\..*gov.uk?/,
+    /whitehall-admin\..*\.gov.uk?/,
   ]
 
   # Skip DNS rebinding protection for the default health check endpoint.