diff --git a/src/ServiceControlInstaller.Engine/Instances/ServiceControlBaseService.cs b/src/ServiceControlInstaller.Engine/Instances/ServiceControlBaseService.cs
index a6658e3f7f..5343e2b713 100644
--- a/src/ServiceControlInstaller.Engine/Instances/ServiceControlBaseService.cs
+++ b/src/ServiceControlInstaller.Engine/Instances/ServiceControlBaseService.cs
@@ -71,7 +71,12 @@ public string AclMaintenanceUrl
         {
             get
             {
-                var baseUrl = $"http://+:{DatabaseMaintenancePort}/";
+                //RavenDB when provided with localhost as the hostname will try to open ports on all interfaces
+                //by using + http binding. This in turn requires a matching UrlAcl registration.
+                var baseUrl = string.Equals("localhost", HostName, StringComparison.OrdinalIgnoreCase)
+                    ? $"http://+:{DatabaseMaintenancePort}/"
+                    : $"http://{HostName}:{DatabaseMaintenancePort}/";
+
                 return baseUrl;
             }
         }
@@ -212,13 +217,19 @@ public void RemoveUrlAcl()
         {
             //This is an old aclurl registration for embedded RavenDB instance that includes the hostname.
             //We need that to make sure we can clean-up old registration when removing instances created
-            //using pre 4.17 versions of ServiceControl.
-            var legacyAclMaintenanceUrl = $"http://{HostName}:{DatabaseMaintenancePort}/";
+            //by previous versions of ServiceControl
+
+            //pre 4.17 versions of ServiceControl were using hostnames in all cases 
+            var pre417LegacyAclMaintenanceUrl = $"http://{HostName}:{DatabaseMaintenancePort}/";
+
+            //pre 4.21 version of ServiceControl were using + in all cases
+            var pre421LegacyAclMaintenanceUlr = $"http://+:{DatabaseMaintenancePort}";
 
             bool IsServiceControlAclUrl(UrlReservation r) =>
                 r.Url.StartsWith(AclUrl, StringComparison.OrdinalIgnoreCase) ||
                 r.Url.StartsWith(AclMaintenanceUrl, StringComparison.OrdinalIgnoreCase) ||
-                r.Url.StartsWith(legacyAclMaintenanceUrl, StringComparison.OrdinalIgnoreCase);
+                r.Url.StartsWith(pre417LegacyAclMaintenanceUrl, StringComparison.OrdinalIgnoreCase) ||
+                r.Url.StartsWith(pre421LegacyAclMaintenanceUlr, StringComparison.OrdinalIgnoreCase);
 
             foreach (var urlReservation in UrlReservation.GetAll().Where(IsServiceControlAclUrl))
             {
diff --git a/src/ServiceControlInstaller.Engine/Instances/ServiceControlNewInstance.cs b/src/ServiceControlInstaller.Engine/Instances/ServiceControlNewInstance.cs
index 4f7536531e..bb589826fe 100644
--- a/src/ServiceControlInstaller.Engine/Instances/ServiceControlNewInstance.cs
+++ b/src/ServiceControlInstaller.Engine/Instances/ServiceControlNewInstance.cs
@@ -237,7 +237,12 @@ public string AclMaintenanceUrl
         {
             get
             {
-                var baseUrl = $"http://+:{DatabaseMaintenancePort}/";
+                //RavenDB when provided with localhost as the hostname will try to open ports on all interfaces
+                //by using + http binding. This in turn requires a matching UrlAcl registration.
+                var baseUrl = string.Equals("localhost", HostName, StringComparison.OrdinalIgnoreCase)
+                    ? $"http://+:{DatabaseMaintenancePort}/"
+                    : $"http://{HostName}:{DatabaseMaintenancePort}/";
+
                 return baseUrl;
             }
         }