diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 029f0e7d1f..3cb2a1aef6 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -12,7 +12,7 @@ use crate::{
     db::{ApiAuthed, DB},
     jobs::RunJobQuery,
     users::{require_owner_of_path, require_path_read_access_for_preview, OptAuthed},
-    utils::check_scopes,
+    utils::{build_scope_path_predicate, check_scopes},
     webhook_util::{WebhookMessage, WebhookShared},
     HTTP_CLIENT,
 };
@@ -355,6 +355,8 @@ async fn list_search_apps(
     let n = 3;
     let mut tx = user_db.begin(&authed).await?;
 
+    let allowed = build_scope_path_predicate(&authed, "apps", "read");
+
     let rows = sqlx::query_as::<_, SearchApp>(
         "SELECT path, app_version.value from app LEFT JOIN app_version ON app_version.id = versions[array_upper(versions, 1)]  WHERE workspace_id = $1 LIMIT $2",
     )
@@ -363,6 +365,7 @@ async fn list_search_apps(
     .fetch_all(&mut *tx)
     .await?
     .into_iter()
+    .filter(|r| allowed(&r.path))
     .collect::<Vec<_>>();
     tx.commit().await?;
     Ok(Json(rows))
@@ -539,6 +542,9 @@ async fn list_apps(
         }
     }
 
+    let allowed = build_scope_path_predicate(&authed, "apps", "read");
+    rows.retain(|r| allowed(&r.path));
+
     Ok(Json(rows))
 }
 
diff --git a/backend/windmill-api/src/utils.rs b/backend/windmill-api/src/utils.rs
index 4f55877e62..5f472c49d3 100644
--- a/backend/windmill-api/src/utils.rs
+++ b/backend/windmill-api/src/utils.rs
@@ -9,7 +9,9 @@
 use axum::{body::Body, response::Response};
 use serde::{Deserialize, Deserializer};
 
-pub use windmill_api_auth::{check_scopes, require_devops_role, require_super_admin};
+pub use windmill_api_auth::{
+    build_scope_path_predicate, check_scopes, require_devops_role, require_super_admin,
+};
 
 #[cfg(feature = "private")]
 pub use windmill_common::usernames::generate_instance_wide_unique_username;