diff --git a/backend/windmill-api/src/scopes.rs b/backend/windmill-api/src/scopes.rs
index 70f2122db5..28b6e70b01 100644
--- a/backend/windmill-api/src/scopes.rs
+++ b/backend/windmill-api/src/scopes.rs
@@ -413,6 +413,7 @@ impl ScopeAction {
     pub fn includes(&self, other: &ScopeAction) -> bool {
         match (self, other) {
             (ScopeAction::Write, ScopeAction::Read) => true,
+            (ScopeAction::Run, ScopeAction::Read) => true,
             (a, b) => a == b,
         }
     }
@@ -440,6 +441,7 @@ pub fn check_route_access(
     for scope_str in token_scopes {
         if !scope_str.starts_with("if_jobs:filter_tags:") {
             if let Ok(scope) = ScopeDefinition::from_scope_string(scope_str) {
+                // tracing::error!("Checking scope {:?} for required domain {:?} and action {:?} and kind {:?} and route suffix {:?}", scope, required_domain, required_action, required_kind, route_suffix);
                 if scope_grants_access(
                     &scope,
                     required_domain,
@@ -498,7 +500,7 @@ const FLOW_JOBS: [&'static str; 5] = [
 
 lazy_static::lazy_static! {
     static ref RUN_PATH_ACTIONS: Vec<&'static str> = {
-        let mut v = vec!["jobs/resume/", "jobs/run/batch_rerun_jobs", "jobs/run/workflow_as_code", "jobs/run/dependencies","jobs/run/flow_dependencies",];
+        let mut v = vec!["jobs/resume/", "jobs/run/batch_rerun_jobs", "jobs/run/workflow_as_code", "jobs/run/dependencies","jobs/run/flow_dependencies", "apps_u/execute_component"];
 
         v.extend(SCRIPT_JOBS);
         v.extend(FLOW_JOBS);
@@ -568,6 +570,7 @@ fn extract_domain_from_route(
     };
 
     if let Some(domain) = domain {
+        // tracing::error!("Extracted domain {:?} from route {:?} with kind {:?} and route suffix {:?}", domain, route_path, kind, route_suffix);
         return Ok((domain, kind, route_suffix));
     }