diff --git a/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java b/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java
index e43e9456975..0390736fe61 100644
--- a/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java
+++ b/modules/gplazma2-voms/src/main/java/org/dcache/gplazma/plugins/VomsPlugin.java
@@ -103,9 +103,11 @@ public void authenticate(Set<Object> publicCredentials,
 
                         String voName = attr.getVO();
                         for (String fqan : attr.getFQANs()) {
-                            // fqan must start with vo name, e.g. for atlas must start with '/atlas/'
+                            // fqan must match the VO root or start with it,
+                            // e.g. '/atlas' or '/atlas/...'
                             // See https://ogf.org/documents/GFD.182.pdf p.6 §3.4.1.2
-                            if (!fqan.startsWith('/' + voName + '/')) {
+                            String voRoot = "/" + voName;
+                            if (!fqan.equals(voRoot) && !fqan.startsWith(voRoot + '/')) {
                                 continue;
                             }