diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 5e8571e93b2..9a453bc2f2f 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -1841,6 +1841,16 @@ func TestProxyByHostname(t *testing.T) {
 			accessURL:        "https://two.coder.com",
 			wildcardHostname: "*--suffix.two.coder.com",
 		},
+		{
+			name:             "three",
+			accessURL:        "https://three.coder.com:8443",
+			wildcardHostname: "*.wildcard.three.coder.com",
+		},
+		{
+			name:             "four",
+			accessURL:        "https://four.coder.com/",
+			wildcardHostname: "*.wildcard.four.coder.com",
+		},
 	}
 	for _, p := range proxies {
 		dbgen.WorkspaceProxy(t, db, database.WorkspaceProxy{
@@ -1871,6 +1881,34 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "one",
 		},
+		{
+			name:              "MatchAccessURLWithPort",
+			testHostname:      "three.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "three",
+		},
+		{
+			name:              "MatchAccessURLWithTrailingSlash",
+			testHostname:      "four.coder.com",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "four",
+		},
+		{
+			name:              "RejectAccessURLPrefix",
+			testHostname:      "one.coder",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
+		{
+			name:              "RejectAccessURLTLDPrefix",
+			testHostname:      "one.coder.co",
+			allowAccessURL:    true,
+			allowWildcardHost: false,
+			matchProxyName:    "",
+		},
 		{
 			name:              "MatchWildcard",
 			testHostname:      "something.wildcard.one.coder.com",
@@ -1878,6 +1916,13 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "one",
 		},
+		{
+			name:              "RejectWildcardHostnamePrefix",
+			testHostname:      "something.wildcard.one.coder",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
 		{
 			name:              "MatchSuffix",
 			testHostname:      "something--suffix.two.coder.com",
@@ -1885,6 +1930,13 @@ func TestProxyByHostname(t *testing.T) {
 			allowWildcardHost: true,
 			matchProxyName:    "two",
 		},
+		{
+			name:              "RejectSuffixHostnamePrefix",
+			testHostname:      "something--suffix.two.coder",
+			allowAccessURL:    false,
+			allowWildcardHost: true,
+			matchProxyName:    "",
+		},
 		{
 			name:              "ValidateHostname/1",
 			testHostname:      ".*ne.coder.com",
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 2e2e8a919b4..f6fe41c0287 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -21702,7 +21702,7 @@ WHERE
 	(
 		(
 			$2 :: bool = true AND
-			url SIMILAR TO '[^:]*://' || $1 :: text || '([:/]?%)*'
+			url SIMILAR TO '[^:]*://' || $1 :: text || '([:/]%)*'
 		) OR
 		(
 			$3 :: bool = true AND
diff --git a/coderd/database/queries/proxies.sql b/coderd/database/queries/proxies.sql
index df59d3baf10..cac44de84d4 100644
--- a/coderd/database/queries/proxies.sql
+++ b/coderd/database/queries/proxies.sql
@@ -120,7 +120,7 @@ WHERE
 	(
 		(
 			@allow_access_url :: bool = true AND
-			url SIMILAR TO '[^:]*://' || @hostname :: text || '([:/]?%)*'
+			url SIMILAR TO '[^:]*://' || @hostname :: text || '([:/]%)*'
 		) OR
 		(
 			@allow_wildcard_hostname :: bool = true AND
diff --git a/coderd/workspaceapps_test.go b/coderd/workspaceapps_test.go
index 8db2858e01e..db6f77ab951 100644
--- a/coderd/workspaceapps_test.go
+++ b/coderd/workspaceapps_test.go
@@ -115,6 +115,15 @@ func TestWorkspaceApplicationAuth(t *testing.T) {
 			redirectURI:      "https://proxy.test.coder.com/path",
 			expectRedirect:   "https://proxy.test.coder.com/path",
 		},
+		{
+			name:             "RejectProxyAccessURLPrefix",
+			accessURL:        "https://test.coder.com",
+			appHostname:      "*.test.coder.com",
+			proxyURL:         "https://proxy.test.coder.com",
+			proxyAppHostname: "*.proxy.test.coder.com",
+			redirectURI:      "https://proxy.test.coder/path",
+			expectRedirect:   "",
+		},
 		{
 			name:             "ProxySubdomainOK",
 			accessURL:        "https://test.coder.com",