diff --git a/tools/router.py b/tools/router.py
index 2d76af16dad4b3514e23fb0c6bc542f5b27757ac..6e3daff95ff691bcc330bdc6f2e3d56741b93545 100644
--- a/tools/router.py
+++ b/tools/router.py
@@ -172,7 +172,7 @@ def render(token):
                 if head_html and (role or headers):
                     raise ValueError(f"authenticated route has HTML injection: {host}")
                 for request, markup in head_html.items():
-                    if not re.fullmatch(r"/[A-Za-z0-9/._-]*", request) or not markup:
+                    if not re.fullmatch(r"/[A-Za-z0-9/._*-]*", request) or not markup:
                         raise ValueError(f"invalid HTML injection: {host} {request}")
                 for request, path in assets.get("files", {}).items():
                     if not request.startswith("/") or " " in request or "\n" in request: