diff --git a/src/graphql/auth.rs b/src/graphql/auth.rs
index 3d85ff0..54ff884 100644
--- a/src/graphql/auth.rs
+++ b/src/graphql/auth.rs
@@ -124,10 +124,13 @@ impl PolicyCheck {
             "Checking authorization against {:?} using {:?} for admin and {:?} for access",
             endpoint.policy_host, endpoint.admin_query, endpoint.access_query
         );
+
+        let host = endpoint.policy_host.trim_end_matches('/');
+
         Self {
             client: reqwest::Client::new(),
-            admin: format!("{}/{}", endpoint.policy_host, endpoint.admin_query),
-            access: format!("{}/{}", endpoint.policy_host, endpoint.access_query),
+            admin: format!("{}/{}", host, endpoint.admin_query.trim_start_matches('/')),
+            access: format!("{}/{}", host, endpoint.access_query.trim_start_matches('/')),
         }
     }
     pub async fn check_access(
@@ -271,6 +274,68 @@ mod tests {
         mock.assert();
     }
 
+    #[tokio::test]
+    async fn successful_check_access_with_trailing_slash_on_host() {
+        let server = MockServer::start();
+        let mock = server
+            .mock_async(|when, then| {
+                when.method("POST")
+                    .path("/demo/access")
+                    .json_body_obj(&json!({
+                        "input": {
+                            "token": "token",
+                            "beamline": "i22",
+                            "visit": 4,
+                            "proposal": 1234,
+                            "audience": "account"
+                        }
+                    }));
+                then.status(200).json_body_obj(&json!({"result": true}));
+            })
+            .await;
+        let check = PolicyCheck::new(PolicyOptions {
+            policy_host: server.url("/"),
+            access_query: "demo/access".into(),
+            admin_query: "demo/admin".into(),
+        });
+        check
+            .check_access(token("token").as_ref(), "i22", "cm1234-4")
+            .await
+            .unwrap();
+        mock.assert();
+    }
+
+    #[tokio::test]
+    async fn successful_check_access_with_leading_slashes() {
+        let server = MockServer::start();
+        let mock = server
+            .mock_async(|when, then| {
+                when.method("POST")
+                    .path("/demo/access")
+                    .json_body_obj(&json!({
+                        "input": {
+                            "token": "token",
+                            "beamline": "i22",
+                            "visit": 4,
+                            "proposal": 1234,
+                            "audience": "account"
+                        }
+                    }));
+                then.status(200).json_body_obj(&json!({"result": true}));
+            })
+            .await;
+        let check = PolicyCheck::new(PolicyOptions {
+            policy_host: server.url(""),
+            access_query: "/demo/access".into(),
+            admin_query: "/demo/admin".into(),
+        });
+        check
+            .check_access(token("token").as_ref(), "i22", "cm1234-4")
+            .await
+            .unwrap();
+        mock.assert();
+    }
+
     #[tokio::test]
     async fn successful_check_instrument_admin() {
         let server = MockServer::start();