Michael JohnsonIf your server accepts GitHub webhooks only from approved IP addresses, add three new prefixes to your allowlist. On October 29, 2026, GitHub announced that new ranges for deliveries to github.com had been added to the hooks field in the Meta API. The change applies to webhook deliveries to github.com across all plans, including GitHub Enterprise Cloud.
Which ranges to add
For a manual update, GitHub lists these CIDR prefixes:
9.234.98.160/289.234.98.176/289.234.106.48/28
Add them alongside the GitHub addresses already allowed, keeping the existing ranges. If your allowlist is already updated through the Meta API, no separate change is needed for these prefixes: the current webhook list is returned in the hooks field. The Meta API documentation warns that the values in its sample response are illustrative; request the current data directly for a production configuration.
Check how your allowlist is built
First, find out where the list of permitted addresses is defined: in the application firewall, reverse proxy, cloud policy, or corporate firewall. Then check whether the system updates the entire set from GET /meta or stores only manually entered records. In the first case, confirm that the hooks field is included in synchronization; in the second, add the three prefixes without removing the previous ones.
Public GET /meta data is available without authentication. GitHub recommends updating allowlists periodically because service addresses can change. To automate the process, extract the hooks field from the response and compare the complete set with your local configuration before applying network rules.
What to check after updating
Make sure the new CIDR prefixes are present in the active configuration and that the old entries remain. Then check webhook delivery logs and network logs for rejections after the change. It’s useful to combine IP filtering with other checks: GitHub’s recommendations include HTTPS with certificate verification, a webhook secret, and checking the event type before processing.
GitHub recommends responding to a delivery with a 2xx status code within 10 seconds; longer processing can be moved to a queue. The X-GitHub-Delivery header helps track delivery uniqueness and protect against request replay.
For a static allowlist, manually add all three published prefixes. If your configuration is managed automatically, update the hooks field through the Meta API and periodically compare its current values with your local list. This ensures new addresses aren’t left out of the rules that filter incoming webhooks.
