diff --git a/cfe_internal/update/update_policy.cf b/cfe_internal/update/update_policy.cf
index b26a135628..687ce4bd43 100644
--- a/cfe_internal/update/update_policy.cf
+++ b/cfe_internal/update/update_policy.cf
@@ -237,6 +237,12 @@ bundle agent cfe_internal_update_policy_cpv
         expression => "local_files_ok",
         classes => u_if_else("files_ok", "files_ok");
 
+      "have_input_paths_extra"
+        expression => some(".*", "update_def.input_paths_extra"),
+        comment => "True if `input_paths_extra` (CFE-4708) has any entries,
+                    so the always-runs copy below can be skipped entirely
+                    (no tree walk) when the feature isn't in use.";
+
   files:
     !am_policy_hub::
       # policy hub should not alter inputs/ uneccessary
@@ -273,6 +279,19 @@ bundle agent cfe_internal_update_policy_cpv
         depth_search => u_recurse("inf"),
         action => u_immediate;
 
+    have_input_paths_extra::
+      # Runs every time, unlike the promise above, because the release ID
+      # gating `validated_updates_ready` only hashes a fixed set of
+      # extensions (GeneratePolicyReleaseIDFromTree() in generic_agent.c),
+      # so changes to arbitrary-extension files here wouldn't be noticed.
+      "$(inputs_dir)"
+        comment => "Copy explicitly listed extra files (input_paths_extra) from master source on every run, since they aren't covered by the release ID hash that gates the promise above",
+        handle => "cfe_internal_update_policy_files_input_paths_extra",
+        copy_from => u_rcp("$(master_location)", @(update_def.policy_servers)),
+        depth_search => u_infinite_client_policy,
+        file_select => u_input_paths_extra,
+        action => u_immediate;
+
     update_inputs_not_kept::
       "$(inputs_dir)/cf_promises_validated" -> { "CFE-2587" }
         delete => u_tidy,
@@ -554,6 +573,15 @@ body file_select u_input_files
   file_result => "leaf_name";
 }
 
+#########################################################
+body file_select u_input_paths_extra
+# @brief Select files by explicit full path that we should include when updating inputs,
+# regardless of extension
+{
+  path_name => { @(update_def.input_paths_extra) };
+  file_result => "path_name";
+}
+
 #########################################################
 body copy_from u_rcp(from, server)
 # @brief Ensure file is a copy of `from` on `server` using digest comparison
diff --git a/controls/update_def.cf.in b/controls/update_def.cf.in
index f3d9900f60..7903c59a14 100644
--- a/controls/update_def.cf.in
+++ b/controls/update_def.cf.in
@@ -93,6 +93,15 @@ bundle common update_def
         comment => "Additional filename patterns to copy during policy update.",
         if => not( isvariable( "input_name_patterns_extra" ) );
 
+      "input_paths_extra" -> { "CFE-4708" }
+        slist => {},
+        comment => "Additional file paths (matched against the full
+                    path via file_select's path_name) to copy during policy
+                    update, regardless of input_name_patterns[_extra]. Lets a
+                    specific file be included without widening the
+                    extension-based patterns for the whole policy set.",
+        if => not( isvariable( "input_paths_extra" ) );
+
       # the permissions for your masterfiles files (not dirs), which will propagate to inputs
       "masterfiles_perms_mode_not_dir" -> { "CFE-951" }
         string => "0600",