diff --git a/hgext/narrow/narrowwirepeer.py b/hgext/narrow/narrowwirepeer.py
--- a/hgext/narrow/narrowwirepeer.py
+++ b/hgext/narrow/narrowwirepeer.py
@@ -9,6 +9,7 @@
 from mercurial import (
     bundle2,
     error,
+    exchange,
     extensions,
     hg,
     narrowspec,
@@ -85,6 +86,11 @@
         newincludes = splitpaths(newincludes)
         oldexcludes = splitpaths(oldexcludes)
         newexcludes = splitpaths(newexcludes)
+
+        # enforce narrow acl if set
+        if repo.ui.has_section(exchange._NARROWACL_SECTION):
+            exchange.applynarrowacl(repo, {'includepats': newincludes})
+
         # validate the patterns
         narrowspec.validatepatterns(set(oldincludes))
         narrowspec.validatepatterns(set(newincludes))
diff --git a/tests/test-narrow-acl.t b/tests/test-narrow-acl.t
--- a/tests/test-narrow-acl.t
+++ b/tests/test-narrow-acl.t
@@ -41,3 +41,39 @@
   $ hg -R narrowclone1 tracked
   I path:f1
   I path:f2
+
+Narrow should not be able to widen to include f3
+  $ hg -R narrowclone1 tracked --addinclude f3
+  comparing with http://localhost:$HGPORT1/
+  searching for changes
+  abort: The following includes are not accessible for test: ['path:f3']
+  [255]
+  $ ls -A -1 narrowclone1 | sort
+  .hg
+  f1
+  f2
+  $ hg -R narrowclone1 tracked
+  I path:f1
+  I path:f2
+
+Narrow should allow widen to include f2
+  $ hg -R narrowclone1 tracked --removeinclude f2 > /dev/null
+  $ hg -R narrowclone1 tracked
+  I path:f1
+  $ ls -A -1 narrowclone1 | sort
+  .hg
+  f1
+  $ hg -R narrowclone1 tracked --addinclude f2
+  comparing with http://localhost:$HGPORT1/
+  searching for changes
+  adding changesets
+  adding manifests
+  adding file changes
+  added 0 changesets with 1 changes to 1 files
+  $ hg -R narrowclone1 tracked
+  I path:f1
+  I path:f2
+  $ ls -A -1 narrowclone1 | sort
+  .hg
+  f1
+  f2