diff --git a/compute_tools/src/compute.rs b/compute_tools/src/compute.rs
index 0055feebdb..8e57a13fa3 100644
--- a/compute_tools/src/compute.rs
+++ b/compute_tools/src/compute.rs
@@ -676,12 +676,12 @@ LIMIT 100",
             let spec = &pspec.spec;
 
             // 1. parse private extension paths from spec
-            // TODO parse private extension paths from spec instead of tenant_id
-            let mut private_ext_prefixes = Vec::new();
+            let private_ext_prefixes = match &spec.private_extensions {
+                Some(private_extensions) => private_extensions.clone(),
+                None => Vec::new(),
+            };
 
-            if let Some(tenant_id) = spec.tenant_id {
-                private_ext_prefixes.push(tenant_id.to_string());
-            }
+            info!("private_ext_prefixes: {:?}", &private_ext_prefixes);
 
             // 2. parse shared_preload_libraries from spec
             let mut libs_vec = Vec::new();
@@ -737,9 +737,12 @@ LIMIT 100",
                 let compute_state = self.state.lock().unwrap().clone();
                 let pspec = compute_state.pspec.as_ref().expect("spec must be set");
 
-                // TODO parse private extension paths from spec instead of tenant_id
-                let tenant_id = pspec.tenant_id.to_string();
-                let private_ext_prefixes: Vec<String> = vec![tenant_id];
+                let private_ext_prefixes = match &pspec.spec.private_extensions {
+                    Some(private_extensions) => private_extensions.clone(),
+                    None => Vec::new(),
+                };
+
+                info!("private_ext_prefixes: {:?}", &private_ext_prefixes);
 
                 extension_server::download_extension_sql_files(
                     &filename,
@@ -759,9 +762,12 @@ LIMIT 100",
                 let compute_state = self.state.lock().unwrap().clone();
                 let pspec = compute_state.pspec.as_ref().expect("spec must be set");
 
-                // TODO parse private extension paths from spec instead of tenant_id
-                let tenant_id = pspec.tenant_id.to_string();
-                let private_ext_prefixes: Vec<String> = vec![tenant_id];
+                let private_ext_prefixes = match &pspec.spec.private_extensions {
+                    Some(private_extensions) => private_extensions.clone(),
+                    None => Vec::new(),
+                };
+
+                info!("private_ext_prefixes: {:?}", &private_ext_prefixes);
 
                 extension_server::download_library_file(
                     &filename,
diff --git a/control_plane/src/endpoint.rs b/control_plane/src/endpoint.rs
index 31f66b0fe0..76a1db3506 100644
--- a/control_plane/src/endpoint.rs
+++ b/control_plane/src/endpoint.rs
@@ -481,6 +481,7 @@ impl Endpoint {
             pageserver_connstring: Some(pageserver_connstring),
             safekeeper_connstrings,
             storage_auth_token: auth_token.clone(),
+            private_extensions: Some(vec![self.tenant_id.to_string()]), //DEBUG ONLY
         };
         let spec_path = self.endpoint_path().join("spec.json");
         std::fs::write(spec_path, serde_json::to_string_pretty(&spec)?)?;
diff --git a/libs/compute_api/src/spec.rs b/libs/compute_api/src/spec.rs
index b3f0e9ba43..9440f8188f 100644
--- a/libs/compute_api/src/spec.rs
+++ b/libs/compute_api/src/spec.rs
@@ -60,6 +60,8 @@ pub struct ComputeSpec {
     /// If set, 'storage_auth_token' is used as the password to authenticate to
     /// the pageserver and safekeepers.
     pub storage_auth_token: Option<String>,
+
+    pub private_extensions: Option<Vec<String>>,
 }
 
 #[serde_as]