diff --git a/cfe_internal/update/update_policy.cf b/cfe_internal/update/update_policy.cf
index b26a135628..82e582daed 100644
--- a/cfe_internal/update/update_policy.cf
+++ b/cfe_internal/update/update_policy.cf
@@ -220,6 +220,16 @@ bundle agent cfe_internal_update_policy_cpv
         comment => "Symlink to Python we found (if any)",
         handle => "cfe_internal_update_policy_python_symlink";
 
+      "input_paths_extra_safe" -> { "CFE-4708" }
+        slist => filter(
+          "^.*\.\..*$", "update_def.input_paths_extra", "true", "true", 999
+        ),
+        comment => concat(
+          "input_paths_extra with any entries containing a '..'",
+          " path-traversal segment dropped, since it's copied both",
+          " from the policy server and to every client verbatim."
+        );
+
   classes:
     "validated_updates_ready"
       expression => "cfengine_internal_disable_cf_promises_validated",
@@ -237,6 +247,14 @@ bundle agent cfe_internal_update_policy_cpv
         expression => "local_files_ok",
         classes => u_if_else("files_ok", "files_ok");
 
+      "have_input_paths_extra"
+        expression => some(".*", "input_paths_extra_safe"),
+        comment => concat(
+          "True if input_paths_extra (CFE-4708) has any entries",
+          " so the per-path copy can be skipped when the feature",
+          " is not in use."
+        );
+
   files:
     !am_policy_hub::
       # policy hub should not alter inputs/ uneccessary
@@ -273,6 +291,20 @@ bundle agent cfe_internal_update_policy_cpv
         depth_search => u_recurse("inf"),
         action => u_immediate;
 
+      "$(inputs_dir)/$(input_paths_extra_safe)"
+        comment => concat(
+          "Copy an explicitly listed extra file (input_paths_extra)",
+          " from the master source when a new policy validation is",
+          " acquired, for files not covered by input_name_patterns."
+        ),
+        handle => "cfe_internal_update_policy_files_input_paths_extra",
+        if => "have_input_paths_extra",
+        copy_from => u_remote_dcp_missing_ok(
+          "$(master_location)/$(input_paths_extra_safe)",
+          @(update_def.policy_servers)
+        ),
+        action => u_immediate;
+
     update_inputs_not_kept::
       "$(inputs_dir)/cf_promises_validated" -> { "CFE-2587" }
         delete => u_tidy,
diff --git a/controls/update_def.cf.in b/controls/update_def.cf.in
index f3d9900f60..307e26871a 100644
--- a/controls/update_def.cf.in
+++ b/controls/update_def.cf.in
@@ -93,6 +93,15 @@ bundle common update_def
         comment => "Additional filename patterns to copy during policy update.",
         if => not( isvariable( "input_name_patterns_extra" ) );
 
+      "input_paths_extra" -> { "CFE-4708" }
+        slist => {},
+        comment => concat("Additional literal file paths (relative to the",
+                    " policy set root) to copy during policy update,",
+                    " regardless of input_name_patterns[_extra]. Lets a",
+                    " specific file be included without widening the",
+                    " extension-based patterns for the whole policy set."),
+        if => not( isvariable( "input_paths_extra" ) );
+
       # the permissions for your masterfiles files (not dirs), which will propagate to inputs
       "masterfiles_perms_mode_not_dir" -> { "CFE-951" }
         string => "0600",