diff --git a/roles/distgit/files/lookaside-upload.conf b/roles/distgit/files/lookaside-upload.conf
index 501413291b..348c049b56 100644
--- a/roles/distgit/files/lookaside-upload.conf
+++ b/roles/distgit/files/lookaside-upload.conf
@@ -17,8 +17,6 @@ SSLCryptoDevice builtin
     # This alias must come before the /repo/ one to avoid being overridden.
     ScriptAlias /repo/pkgs/upload.cgi /srv/web/upload.cgi
 
-    Require all granted
-
     Alias /repo/ /srv/cache/lookaside/
     ServerName pkgs.fedoraproject.org
     ServerAdmin webmaster@fedoraproject.org
@@ -55,6 +53,9 @@ SSLCryptoDevice builtin
    <Location /repo/pkgs/upload.cgi>
        SSLRequireSSL
 
+       Options +ExecCGI
+       Require all granted
+
        SSLVerifyClient optional
        SSLVerifyDepth 1
        SSLOptions +StrictRequire +StdEnvVars +OptRenegotiate