diff --git a/chfs-ng/internal/auth/auth.go b/chfs-ng/internal/auth/auth.go
index 34c4744..85eeb31 100644
--- a/chfs-ng/internal/auth/auth.go
+++ b/chfs-ng/internal/auth/auth.go
@@ -112,7 +112,7 @@ func (a *Account) maskFor(path string, entry bool) PermMask {
 		if entry && r.ChildrenOnly && matchPathExact(d, path) {
 			continue
 		}
-		if len(d) > best {
+		if len(d) >= best {
 			best = len(d)
 			if r.Deny {
 				mask = None
diff --git a/chfs-ng/internal/auth/auth_test.go b/chfs-ng/internal/auth/auth_test.go
index 1def33e..037d63c 100644
--- a/chfs-ng/internal/auth/auth_test.go
+++ b/chfs-ng/internal/auth/auth_test.go
@@ -91,6 +91,18 @@ func TestSectionRuleSemantics(t *testing.T) {
 	}
 }
 
+func TestSectionRuleSamePathPriority(t *testing.T) {
+	a := &Account{Mask: Delete, Rules: []PathRule{
+		{Dir: "secret", Mask: None, Deny: true},
+		{Dir: "secret", Mask: ParseMask("r"), ChildrenOnly: true},
+		{Dir: "secret", Mask: ParseMask("w"), ChildrenOnly: true},
+		{Dir: "secret", Mask: ParseMask("d"), ChildrenOnly: true},
+	}}
+	if got := a.MaskFor("secret/file"); got != ParseMask("d") {
+		t.Fatalf("same-path rule priority=%v", got)
+	}
+}
+
 func TestWildcardSectionRules(t *testing.T) {
 	a := &Account{Mask: Read, Rules: []PathRule{{Dir: "project-*", Mask: Write, ChildrenOnly: true}}}
 	if got := a.MaskFor("project-one/file"); got != Write {