diff --git a/ezbake/config/conf.d/auth.conf b/ezbake/config/conf.d/auth.conf
index 2f009a810..2f9c7a1d8 100644
--- a/ezbake/config/conf.d/auth.conf
+++ b/ezbake/config/conf.d/auth.conf
@@ -314,6 +314,20 @@ authorization: {
             sort-order: 500
             name: "puppet tasks information"
         },
+        {
+           match-request: {
+               path: "/puppet-admin-api/v1/environment-cache"
+               type: path
+               method: delete
+           }
+           allow: {
+               extensions: {
+                   pp_cli_auth: "true"
+               }
+           }
+           sort-order: 500
+           name: "primary can clean cache after code deploy"
+        },
         {
             # Deny everything else. This ACL is not strictly
             # necessary, but illustrates the default policy