diff --git a/core/src/main/java/jenkins/security/admin/CallableWhitelistConfig.java b/core/src/main/java/jenkins/security/admin/CallableWhitelistConfig.java
index 6fe5fde4a2..063a5ebc37 100644
--- a/core/src/main/java/jenkins/security/admin/CallableWhitelistConfig.java
+++ b/core/src/main/java/jenkins/security/admin/CallableWhitelistConfig.java
@@ -13,7 +13,7 @@ import java.util.Set;
  *
  * @author Kohsuke Kawaguchi
  */
-class CallableWhitelistConfig extends ConfigFile<String,Set<String>> {
+class CallableWhitelistConfig extends ConfigDirectory<String,Set<String>> {
     CallableWhitelistConfig(File file) {
         super(file);
     }
diff --git a/core/src/main/java/jenkins/security/admin/ConfigDirectory.java b/core/src/main/java/jenkins/security/admin/ConfigDirectory.java
new file mode 100644
index 0000000000..7b2356265b
--- /dev/null
+++ b/core/src/main/java/jenkins/security/admin/ConfigDirectory.java
@@ -0,0 +1,65 @@
+package jenkins.security.admin;
+
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileReader;
+import java.io.FilenameFilter;
+import java.io.IOException;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+
+/**
+ * Bit of a hack to expand {@link ConfigFile} to support conf.d format that assembles the fragment.
+ *
+ * <p>
+ * {@link #file} points to the "primary" file that we programmatically write to.
+ *
+ * @author Kohsuke Kawaguchi
+ */
+abstract class ConfigDirectory<T,COL extends Collection<T>> extends ConfigFile<T,COL> {
+    private final File dir;
+
+    protected ConfigDirectory(File file) {
+        super(file);
+        this.dir = file.getParentFile();
+    }
+
+    @Override
+    public synchronized void load() {
+        COL result = create();
+
+        if (dir.exists()) {
+            String[] fragments = dir.list(new FilenameFilter() {
+                @Override
+                public boolean accept(File dir, String name) {
+                    return name.endsWith(".conf");
+                }
+            });
+            if (fragments!=null) {
+                Arrays.sort(fragments);
+
+                for (String fragment : fragments) {
+                    File f = new File(dir, fragment);
+                    try {
+                        BufferedReader reader = new BufferedReader(new FileReader(f));
+                        String line;
+                        while ((line=reader.readLine())!=null) {
+                            if (line.startsWith("#")) continue;   // comment
+                            T r = parse(line);
+                            if (r != null)
+                                result.add(r);
+                        }
+                    } catch (IOException e) {
+                        LOGGER.log(Level.WARNING, "Failed to parse "+f,e);
+                    }
+                }
+            }
+        }
+
+        parsed = readOnly(result);
+    }
+
+    private static final Logger LOGGER = Logger.getLogger(ConfigDirectory.class.getName());
+}
diff --git a/core/src/main/java/jenkins/security/admin/ConfigFile.java b/core/src/main/java/jenkins/security/admin/ConfigFile.java
index d6392df594..e696192e11 100644
--- a/core/src/main/java/jenkins/security/admin/ConfigFile.java
+++ b/core/src/main/java/jenkins/security/admin/ConfigFile.java
@@ -17,7 +17,7 @@ import java.util.Collection;
  */
 abstract class ConfigFile<T,COL extends Collection<T>> extends TextFile {
     @CopyOnWrite
-    private volatile COL parsed;
+    protected volatile COL parsed;
 
     public ConfigFile(File file) {
         super(file);
diff --git a/core/src/main/java/jenkins/security/admin/FilePathRuleConfig.java b/core/src/main/java/jenkins/security/admin/FilePathRuleConfig.java
index a8645e765a..a0fb96d02a 100644
--- a/core/src/main/java/jenkins/security/admin/FilePathRuleConfig.java
+++ b/core/src/main/java/jenkins/security/admin/FilePathRuleConfig.java
@@ -2,6 +2,8 @@ package jenkins.security.admin;
 
 import com.google.common.collect.ImmutableList;
 import com.google.common.collect.ImmutableSet;
+import hudson.Util;
+import jenkins.model.Jenkins;
 
 import java.io.File;
 import java.util.ArrayList;
@@ -14,7 +16,7 @@ import java.util.regex.Pattern;
  *
  * @author Kohsuke Kawaguchi
  */
-class FilePathRuleConfig extends ConfigFile<FilePathRule,List<FilePathRule>> {
+class FilePathRuleConfig extends ConfigDirectory<FilePathRule,List<FilePathRule>> {
     FilePathRuleConfig(File file) {
         super(file);
     }
@@ -32,6 +34,9 @@ class FilePathRuleConfig extends ConfigFile<FilePathRule,List<FilePathRule>> {
     @Override
     protected FilePathRule parse(String line) {
         line = line.trim();
+        line = line.replace("<BUILDDIR>","<JENKIN_HOME>/jobs/.+/builds/<BUILDID>");
+        line = line.replace("<JENKINS_HOME>",Jenkins.getInstance().getRootDir().getPath());
+        line = line.replace("<BUILDID>","[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]_[0-9][0-9]-[0-9][0-9]-[0-9][0-9]");
 
         Matcher m = PARSER.matcher(line);
         if (!m.matches())