diff --git a/modules/datagovuk/datagovuk.vcl.tftpl b/modules/datagovuk/datagovuk.vcl.tftpl
index 8abd6a6..97eca4e 100644
--- a/modules/datagovuk/datagovuk.vcl.tftpl
+++ b/modules/datagovuk/datagovuk.vcl.tftpl
@@ -72,6 +72,10 @@ sub vcl_recv {
   if (!req.http.Fastly-SSL) {
      error 801 "Force SSL";
   }
+  
+  %{ if private_extra_vcl_recv != "" ~}
+    ${private_extra_vcl_recv}
+  %{ endif ~}
 
   ${indent(2, file("${module_path}/../shared/_security_txt_request.vcl"))}
 
diff --git a/modules/datagovuk/service.tf b/modules/datagovuk/service.tf
index bf20a54..961cebf 100644
--- a/modules/datagovuk/service.tf
+++ b/modules/datagovuk/service.tf
@@ -30,6 +30,8 @@ locals {
       gcs_mirror_prefix = null
       gcs_mirror_probe = null
       gcs_mirror_port = 443
+
+      private_extra_vcl_recv = ""
     },
     { # computed values
       formatted_allowed_ip_addresses = local.formatted_allowed_ips