diff --git a/ci/dev/vscode.patch b/ci/dev/vscode.patch
index 9860ba965..83c8d9949 100644
--- a/ci/dev/vscode.patch
+++ b/ci/dev/vscode.patch
@@ -430,7 +430,7 @@ index 2c64061da7b01aef0bfe3cec851da232ca9461c8..c0ef8faedd406c38bf9c55bbbdbbb060
  			// Do nothing. If we can't read the file we have no
  			// language pack config.
 diff --git a/src/vs/code/browser/workbench/workbench.ts b/src/vs/code/browser/workbench/workbench.ts
-index 0ef8b9dc81419b53b27cf111fb206d72ba56bada..75d2ab3276049115829a38b8b7afee44bb748c2a 100644
+index 0ef8b9dc81419b53b27cf111fb206d72ba56bada..62a79602a831bca0dc62ad57dc10a9375f8b9cdb 100644
 --- a/src/vs/code/browser/workbench/workbench.ts
 +++ b/src/vs/code/browser/workbench/workbench.ts
 @@ -17,6 +17,7 @@ import { isStandalone } from 'vs/base/browser/browser';
@@ -468,7 +468,7 @@ index 0ef8b9dc81419b53b27cf111fb206d72ba56bada..75d2ab3276049115829a38b8b7afee44
  
 -	const config: IWorkbenchConstructionOptions & { folderUri?: UriComponents, workspaceUri?: UriComponents } = JSON.parse(configElementAttribute);
 +	const config: IWorkbenchConstructionOptions & { folderUri?: UriComponents, workspaceUri?: UriComponents } = {
-+		webviewEndpoint: `${window.location.origin}${window.location.pathname.replace(/\/+$/, '')}/webview/`,
++		webviewEndpoint: `${window.location.origin}${window.location.pathname.replace(/\/+$/, '')}/webview`,
 +		...JSON.parse(configElementAttribute),
 +	};
 +
diff --git a/src/node/routes/static.ts b/src/node/routes/static.ts
index e073219e4..cac4dd8cd 100644
--- a/src/node/routes/static.ts
+++ b/src/node/routes/static.ts
@@ -7,13 +7,33 @@ import * as tarFs from "tar-fs"
 import * as zlib from "zlib"
 import { HttpCode, HttpError } from "../../common/http"
 import { rootPath } from "../constants"
-import { authenticated, replaceTemplates } from "../http"
+import { authenticated, ensureAuthenticated, replaceTemplates } from "../http"
 import { getMediaMime, pathToFsPath } from "../util"
 
 export const router = Router()
 
 // The commit is for caching.
 router.get("/(:commit)(/*)?", async (req, res) => {
+  // Used by VS Code to load extensions into the web worker.
+  const tar = Array.isArray(req.query.tar) ? req.query.tar[0] : req.query.tar
+  if (typeof tar === "string") {
+    ensureAuthenticated(req)
+    let stream: Readable = tarFs.pack(pathToFsPath(tar))
+    if (req.headers["accept-encoding"] && req.headers["accept-encoding"].includes("gzip")) {
+      logger.debug("gzipping tar", field("path", tar))
+      const compress = zlib.createGzip()
+      stream.pipe(compress)
+      stream.on("error", (error) => compress.destroy(error))
+      stream.on("close", () => compress.end())
+      stream = compress
+      res.header("content-encoding", "gzip")
+    }
+    res.set("Content-Type", "application/x-tar")
+    stream.on("close", () => res.end())
+    return stream.pipe(res)
+  }
+
+  // If not a tar use the remainder of the path to load the resource.
   if (!req.params[0]) {
     throw new HttpError("Not Found", HttpCode.NotFound)
   }
@@ -32,26 +52,6 @@ router.get("/(:commit)(/*)?", async (req, res) => {
     res.header("Cache-Control", "public, max-age=31536000")
   }
 
-  /**
-   * Used by VS Code to load extensions into the web worker.
-   */
-  const tar = Array.isArray(req.query.tar) ? req.query.tar[0] : req.query.tar
-  if (typeof tar === "string") {
-    let stream: Readable = tarFs.pack(pathToFsPath(tar))
-    if (req.headers["accept-encoding"] && req.headers["accept-encoding"].includes("gzip")) {
-      logger.debug("gzipping tar", field("path", resourcePath))
-      const compress = zlib.createGzip()
-      stream.pipe(compress)
-      stream.on("error", (error) => compress.destroy(error))
-      stream.on("close", () => compress.end())
-      stream = compress
-      res.header("content-encoding", "gzip")
-    }
-    res.set("Content-Type", "application/x-tar")
-    stream.on("close", () => res.end())
-    return stream.pipe(res)
-  }
-
   res.set("Content-Type", getMediaMime(resourcePath))
 
   if (resourcePath.endsWith("manifest.json")) {