diff --git a/pantheon.upstream.yml b/pantheon.upstream.yml
index 5742dffde11..fb89aefee91 100644
--- a/pantheon.upstream.yml
+++ b/pantheon.upstream.yml
@@ -8,3 +8,14 @@ drush_version: 8
 
 # See https://pantheon.io/docs/pantheon-yml/#enforce-https--hsts for valid values.
 enforce_https: transitional
+
+# See https://pantheon.io/docs/pantheon-yml#protected-web-paths for usage.
+protected_web_paths:
+  - /private/
+  - /sites/default/files/private/
+
+# By default, any 'protected_web_paths' added to the pantheon.yml file
+# are combined with the paths from the pantheon.upstream.yml file. If
+# 'protected_web_paths_override' is set to true, then the upstream paths
+# are disabled.
+protected_web_paths_override: false