diff --git a/qubes-rpc-policy/qubes.UpdatesProxy.policy b/qubes-rpc-policy/qubes.UpdatesProxy.policy
index 21c68c56..4c82de84 100644
--- a/qubes-rpc-policy/qubes.UpdatesProxy.policy
+++ b/qubes-rpc-policy/qubes.UpdatesProxy.policy
@@ -3,6 +3,9 @@
 
 ## Please use a single # to start your custom comments
 
+$tag:whonix-updatevm $default allow,target=sys-whonix
+$tag:whonix-updatevm $anyvm deny
+
 # Default rule for all TemplateVMs - direct the connection to sys-net
 $type:TemplateVM $default allow,target=sys-net