diff --git a/bazel/external_deps.bzl b/bazel/external_deps.bzl
index cd9b6759..2563a4d2 100644
--- a/bazel/external_deps.bzl
+++ b/bazel/external_deps.bzl
@@ -101,8 +101,8 @@ def load_repository_locations(repository_locations_spec):
             # Starlark doesn't have regexes.
             cpe_components = len(cpe.split(":"))
 
-            # We allow cpe:2.3:a:foo:* and cpe:2.3.:a:foo:bar:* only.
-            cpe_components_valid = cpe_components in [5, 6]
+            # We allow cpe:2.3:a:foo:*:* and cpe:2.3.:a:foo:bar:* only.
+            cpe_components_valid = (cpe_components == 6)
             cpe_matches = (cpe == "N/A" or (cpe.startswith("cpe:2.3:a:") and cpe.endswith(":*") and cpe_components_valid))
             if not cpe_matches:
                 fail("CPE must match cpe:2.3:a:<facet>:<facet>:*: " + cpe)