diff --git a/src/variations/fpm-apache/etc/apache2/conf-available/security.conf b/src/variations/fpm-apache/etc/apache2/conf-available/security.conf
index f572f2501..945308494 100644
--- a/src/variations/fpm-apache/etc/apache2/conf-available/security.conf
+++ b/src/variations/fpm-apache/etc/apache2/conf-available/security.conf
@@ -57,7 +57,7 @@ Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains
 
 # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
 # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
-<LocationMatch "^/storage/.*\.php$">
+<LocationMatch "^/storage/.*\.php(?:/|$)">
     Require all denied
 </LocationMatch>
 
@@ -80,4 +80,4 @@ Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains
 <Files xmlrpc.php>
    Require all denied
 # allow from xxx.xxx.xxx.xxx
-</Files>
\ No newline at end of file
+</Files>
diff --git a/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template b/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template
index 08a90ff96..319843589 100644
--- a/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template
+++ b/src/variations/fpm-nginx/etc/nginx/site-opts.d/http.conf.template
@@ -15,7 +15,7 @@ absolute_redirect off;
 # Healthcheck: Set /healthcheck to be the static health check URL
 location /healthcheck {
     access_log off;
-    
+
     # set max 5 seconds for healthcheck
     fastcgi_read_timeout 5s;
 
@@ -32,7 +32,7 @@ location / {
 
 # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
 # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
-location ~* ^/storage/.*\.php$ {
+location ~* ^/storage/.*\.php(?:/|$) {
     deny all;
 }
 
@@ -42,10 +42,10 @@ location ~ \.php$ {
     fastcgi_index  index.php;
     fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
     include        fastcgi_params;
-    fastcgi_buffers $NGINX_FASTCGI_BUFFERS; 
+    fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
     fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE;
     fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME;
 }
 
 # additional config
-include /etc/nginx/server-opts.d/*.conf;
\ No newline at end of file
+include /etc/nginx/server-opts.d/*.conf;
diff --git a/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template b/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template
index 810ff0747..fce7efa3c 100644
--- a/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template
+++ b/src/variations/fpm-nginx/etc/nginx/site-opts.d/https.conf.template
@@ -21,7 +21,7 @@ absolute_redirect off;
 # Healthcheck: Set /healthcheck to be the static health check URL
 location /healthcheck {
     access_log off;
-    
+
     # set max 5 seconds for healthcheck
     fastcgi_read_timeout 5s;
 
@@ -38,7 +38,7 @@ location / {
 
 # Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
 # Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
-location ~* ^/storage/.*\.php$ {
+location ~* ^/storage/.*\.php(?:/|$) {
     deny all;
 }
 
@@ -48,10 +48,10 @@ location ~ \.php$ {
     fastcgi_index  index.php;
     fastcgi_param  SCRIPT_FILENAME  $document_root$fastcgi_script_name;
     include        fastcgi_params;
-    fastcgi_buffers $NGINX_FASTCGI_BUFFERS; 
+    fastcgi_buffers $NGINX_FASTCGI_BUFFERS;
     fastcgi_buffer_size $NGINX_FASTCGI_BUFFER_SIZE;
     fastcgi_read_timeout $PHP_MAX_EXECUTION_TIME;
 }
 
 # additional config
-include /etc/nginx/server-opts.d/*.conf;
\ No newline at end of file
+include /etc/nginx/server-opts.d/*.conf;
diff --git a/src/variations/frankenphp/etc/frankenphp/Caddyfile b/src/variations/frankenphp/etc/frankenphp/Caddyfile
index 50b2158be..add4cd7c4 100644
--- a/src/variations/frankenphp/etc/frankenphp/Caddyfile
+++ b/src/variations/frankenphp/etc/frankenphp/Caddyfile
@@ -97,7 +97,7 @@ fd00::/8 \
 	file_server
 
 	import performance
-	import security 
+	import security
 
 	{$CADDY_SERVER_EXTRA_DIRECTIVES}
 }
@@ -140,7 +140,7 @@ fd00::/8 \
 
 	# Block PHP execution in storage directory to prevent uploaded malicious PHP files from running
 	# Reference: Livewire arbitrary file upload (GHSA-29cq-5w36-x7w3)
-	@storage-php path_regexp ^/storage/.*\.php$
+	@storage-php path_regexp ^/storage/.*\.php(?:/|$)
 	respond @storage-php 403
 
 	# Block access to files that may expose sensitive information