diff --git a/homeassistant/components/hassio/http.py b/homeassistant/components/hassio/http.py
index 8a8583a7daf..fecf05f74b4 100644
--- a/homeassistant/components/hassio/http.py
+++ b/homeassistant/components/hassio/http.py
@@ -53,7 +53,7 @@ PATHS_NOT_ONBOARDED = re.compile(
     r")$"
 )
 
-# Authenticated users manage backups + download logs
+# Authenticated users manage backups + download logs, changelog and documentation
 PATHS_ADMIN = re.compile(
     r"^(?:"
     r"|backups/[a-f0-9]{8}(/info|/download|/restore/full|/restore/partial)?"
@@ -66,7 +66,7 @@ PATHS_ADMIN = re.compile(
     r"|multicast/logs"
     r"|observer/logs"
     r"|supervisor/logs"
-    r"|addons/[^/]+/logs"
+    r"|addons/[^/]+/(changelog|documentation|logs)"
     r")$"
 )
 
diff --git a/tests/components/hassio/test_http.py b/tests/components/hassio/test_http.py
index cb1dd639ec6..e659fbe4b8f 100644
--- a/tests/components/hassio/test_http.py
+++ b/tests/components/hassio/test_http.py
@@ -288,6 +288,8 @@ async def test_forward_request_not_onboarded_unallowed_paths(
         ("backups/1234abcd/info", True),
         ("supervisor/logs", True),
         ("addons/bl_b392/logs", True),
+        ("addons/bl_b392/changelog", True),
+        ("addons/bl_b392/documentation", True),
     ],
 )
 async def test_forward_request_admin_get(