diff --git a/data_safe_haven/infrastructure/programs/sre/firewall.py b/data_safe_haven/infrastructure/programs/sre/firewall.py
index b4c5653c37..d274cc7176 100644
--- a/data_safe_haven/infrastructure/programs/sre/firewall.py
+++ b/data_safe_haven/infrastructure/programs/sre/firewall.py
@@ -244,7 +244,7 @@ def __init__(
                         type=network.AzureFirewallRCActionType.DENY
                     ),
                     name="workspaces-deny",
-                    priority=FirewallPriorities.SRE_WORKSPACES,
+                    priority=FirewallPriorities.SRE_WORKSPACES_DENY,
                     rules=[
                         network.AzureFirewallApplicationRuleArgs(
                             description="Deny external Ubuntu Snap Store upload and login access",
diff --git a/data_safe_haven/types/enums.py b/data_safe_haven/types/enums.py
index b67cb87a9a..8a468f0d13 100644
--- a/data_safe_haven/types/enums.py
+++ b/data_safe_haven/types/enums.py
@@ -38,7 +38,8 @@ class FirewallPriorities(int, Enum):
     SRE_GUACAMOLE_CONTAINERS = 3100
     SRE_IDENTITY_CONTAINERS = 3200
     SRE_USER_SERVICES_SOFTWARE_REPOSITORIES = 3300
-    SRE_WORKSPACES = 3400
+    SRE_WORKSPACES_DENY = 3400
+    SRE_WORKSPACES = 3450
 
 
 @verify(UNIQUE)