diff --git a/pkgs/common-updater/directory-listing-updater.nix b/pkgs/common-updater/directory-listing-updater.nix
index bd0b5b1df30d..b717213fc3a7 100644
--- a/pkgs/common-updater/directory-listing-updater.nix
+++ b/pkgs/common-updater/directory-listing-updater.nix
@@ -6,6 +6,7 @@
 { pname ? null
 , version ? null
 , attrPath ? null
+, allowedVersions ? ""
 , ignoredVersions ? ""
 , rev-prefix ? ""
 , odd-unstable ? false
@@ -15,6 +16,6 @@
 }:
 
 genericUpdater {
-  inherit pname version attrPath ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
+  inherit pname version attrPath allowedVersions ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
   versionLister = "${common-updater-scripts}/bin/list-directory-versions ${lib.optionalString (url != null) "--url=${lib.escapeShellArg url}"} ${lib.optionalString (extraRegex != null) "--extra-regex=${lib.escapeShellArg extraRegex}"}";
 }
diff --git a/pkgs/common-updater/generic-updater.nix b/pkgs/common-updater/generic-updater.nix
index 2f8da2f308e6..2ebfb0fa6fc2 100644
--- a/pkgs/common-updater/generic-updater.nix
+++ b/pkgs/common-updater/generic-updater.nix
@@ -13,6 +13,7 @@
 , version ? null
 , attrPath ? null
 , versionLister
+, allowedVersions ? ""
 , ignoredVersions ? ""
 , rev-prefix ? ""
 , odd-unstable ? false
@@ -37,10 +38,11 @@ let
     version="$3"
     attr_path="$4"
     version_lister="$5"
-    ignored_versions="$6"
-    rev_prefix="$7"
-    odd_unstable="$8"
-    patchlevel_unstable="$9"
+    allowed_versions="$6"
+    ignored_versions="$7"
+    rev_prefix="$8"
+    odd_unstable="$9"
+    patchlevel_unstable="$${10}"
 
     [[ -n "$name" ]] || name="$UPDATE_NIX_NAME"
     [[ -n "$pname" ]] || pname="$UPDATE_NIX_PNAME"
@@ -52,7 +54,7 @@ let
 
     function version_is_ignored() {
       local tag="$1"
-      [ -n "$ignored_versions" ] && ${grep} -E "$ignored_versions" <<< "$tag"
+      [ -n "$ignored_versions" ] && ${grep} -E -e "$ignored_versions" <<< "$tag"
     }
 
     function version_is_unstable() {
@@ -86,6 +88,9 @@ let
       tags=$(echo "$tags" | ${sed} -e "s,^$rev_prefix,,")
     fi
     tags=$(echo "$tags" | ${grep} "^[0-9]")
+    if [ -n "$allowed_versions" ]; then
+      tags=$(echo "$tags" | ${grep} -E -e "$allowed_versions")
+    fi
 
     # sort the tags in decreasing order
     tags=$(echo "$tags" | ${coreutils}/bin/sort --reverse --version-sort)
@@ -127,7 +132,7 @@ let
 
 in {
   name = "generic-update-script";
-  command = [ updateScript name pname version attrPath versionLister ignoredVersions rev-prefix odd-unstable patchlevel-unstable ];
+  command = [ updateScript name pname version attrPath versionLister allowedVersions ignoredVersions rev-prefix odd-unstable patchlevel-unstable ];
   supportedFeatures = [
     # Stdout must contain output according to the updateScript commit protocol when the update script finishes with a non-zero exit code.
     "commit"
diff --git a/pkgs/common-updater/git-updater.nix b/pkgs/common-updater/git-updater.nix
index 86bf88ada8c4..314799c23f28 100644
--- a/pkgs/common-updater/git-updater.nix
+++ b/pkgs/common-updater/git-updater.nix
@@ -6,6 +6,7 @@
 { pname ? null
 , version ? null
 , attrPath ? null
+, allowedVersions ? ""
 , ignoredVersions ? ""
 , rev-prefix ? ""
 , odd-unstable ? false
@@ -16,6 +17,6 @@
 }:
 
 genericUpdater {
-  inherit pname version attrPath ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
+  inherit pname version attrPath allowedVersions ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
   versionLister = "${common-updater-scripts}/bin/list-git-tags ${lib.optionalString (url != null) "--url=${url}"}";
 }
diff --git a/pkgs/common-updater/http-two-levels-updater.nix b/pkgs/common-updater/http-two-levels-updater.nix
index 4656163c18a3..77594fc8a112 100644
--- a/pkgs/common-updater/http-two-levels-updater.nix
+++ b/pkgs/common-updater/http-two-levels-updater.nix
@@ -6,6 +6,7 @@
 { pname ? null
 , version ? null
 , attrPath ? null
+, allowedVersions ? ""
 , ignoredVersions ? ""
 , rev-prefix ? ""
 , odd-unstable ? false
@@ -14,6 +15,6 @@
 }:
 
 genericUpdater {
-  inherit pname version attrPath ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
+  inherit pname version attrPath allowedVersions ignoredVersions rev-prefix odd-unstable patchlevel-unstable;
   versionLister = "${common-updater-scripts}/bin/list-archive-two-levels-versions ${lib.optionalString (url != null) "--url=${lib.escapeShellArg url}"}";
 }