diff --git a/.changeset/cuddly-pillows-press.md b/.changeset/cuddly-pillows-press.md
new file mode 100644
index 0000000000..93980456aa
--- /dev/null
+++ b/.changeset/cuddly-pillows-press.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend': patch
+---
+
+Disallow anything but `'url'` locations from being registered via the location service.
diff --git a/plugins/catalog-backend/src/service/DefaultLocationService.test.ts b/plugins/catalog-backend/src/service/DefaultLocationService.test.ts
index 562bae4867..bd166cbd50 100644
--- a/plugins/catalog-backend/src/service/DefaultLocationService.test.ts
+++ b/plugins/catalog-backend/src/service/DefaultLocationService.test.ts
@@ -17,6 +17,7 @@
 import { DefaultLocationService } from './DefaultLocationService';
 import { CatalogProcessingOrchestrator } from '../processing/types';
 import { LocationStore } from './types';
+import { InputError } from '@backstage/errors';
 
 describe('DefaultLocationServiceTest', () => {
   const orchestrator: jest.Mocked<CatalogProcessingOrchestrator> = {
@@ -251,6 +252,18 @@ describe('DefaultLocationServiceTest', () => {
         type: 'url',
       });
     });
+
+    it('should not allow locations of unknown types', async () => {
+      await expect(
+        locationService.createLocation(
+          {
+            type: 'unknown',
+            target: 'https://backstage.io/catalog-info.yaml',
+          },
+          false,
+        ),
+      ).rejects.toThrow(InputError);
+    });
   });
 
   describe('listLocations', () => {
diff --git a/plugins/catalog-backend/src/service/DefaultLocationService.ts b/plugins/catalog-backend/src/service/DefaultLocationService.ts
index 7a1b923068..fc6ffb0825 100644
--- a/plugins/catalog-backend/src/service/DefaultLocationService.ts
+++ b/plugins/catalog-backend/src/service/DefaultLocationService.ts
@@ -27,6 +27,7 @@ import {
 } from '../processing/types';
 import { LocationInput, LocationService, LocationStore } from './types';
 import { locationSpecToMetadataName } from '../util/conversion';
+import { InputError } from '@backstage/errors';
 
 export class DefaultLocationService implements LocationService {
   constructor(
@@ -38,6 +39,9 @@ export class DefaultLocationService implements LocationService {
     input: LocationInput,
     dryRun: boolean,
   ): Promise<{ location: Location; entities: Entity[]; exists?: boolean }> {
+    if (input.type !== 'url') {
+      throw new InputError(`Registered locations must be of type 'url'`);
+    }
     if (dryRun) {
       return this.dryRunCreateLocation(input);
     }