diff --git a/.htaccess b/.htaccess
index 32060738ab193..dc8a04aee1343 100644
--- a/.htaccess
+++ b/.htaccess
@@ -140,6 +140,16 @@
 
     RewriteRule ^(?:build|tests|config|lib|3rdparty|templates)/.* - [R=404,L]
 
+##
+## Rule: Prevent access to package manager metadata and our shipped app list
+##
+## Context:
+##    - Mirrors the equivalent `return 404` of our nginx reference configuration
+##    - Required because `.json` is excluded from the front controller rule
+##      generated by `lib/private/Setup.php`, so these would otherwise be served
+##
+    RewriteRule ^(?:composer\.(?:json|lock)|package(?:-lock)?\.json|core/shipped\.json)$ - [R=404,L]
+
 ##
 ## Rule: Maps most RFC 8615 compliant well-known URIs to our main frontend controller (/index.php) by default
 ##
diff --git a/lib/private/Setup.php b/lib/private/Setup.php
index 8033bd520998b..e5823fe780c9b 100644
--- a/lib/private/Setup.php
+++ b/lib/private/Setup.php
@@ -614,7 +614,7 @@ public static function updateHtaccess(): bool {
 			$content .= "\n  Options -MultiViews";
 			$content .= "\n  RewriteRule ^core/js/oc.js$ index.php [PT,E=PATH_INFO:$1]";
 			$content .= "\n  RewriteRule ^core/preview.png$ index.php [PT,E=PATH_INFO:$1]";
-			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !\\.(css|js|mjs|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$";
+			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !\\.(css|js|mjs|json|ftl|svg|gif|ico|jpg|jpeg|png|webp|html|otf|ttf|woff2?|map|webm|mp4|mp3|ogg|wav|flac|wasm|tflite)$";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/core/ajax/update\\.php";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/core/img/(favicon\\.ico|manifest\\.json)$";
 			$content .= "\n  RewriteCond %{REQUEST_FILENAME} !/(cron|public|remote|status)\\.php";