diff --git a/www/config/ACLView.js b/www/config/ACLView.js
index 62cc4f9c..071a1d3d 100644
--- a/www/config/ACLView.js
+++ b/www/config/ACLView.js
@@ -39,6 +39,7 @@ Ext.define('PBS.config.ACLView', {
 	    Ext.create('PBS.window.ACLEdit', {
 		path: view.aclPath,
 		aclType: 'user',
+		datastore: view.datastore,
 		listeners: {
 		    destroy: () => me.reload(),
 		},
@@ -51,6 +52,7 @@ Ext.define('PBS.config.ACLView', {
 	    Ext.create('PBS.window.ACLEdit', {
 		path: view.aclPath,
 		aclType: 'token',
+		datastore: view.datastore,
 		listeners: {
 		    destroy: () => me.reload(),
 		},
diff --git a/www/datastore/Panel.js b/www/datastore/Panel.js
index 8439a83a..fdb457a4 100644
--- a/www/datastore/Panel.js
+++ b/www/datastore/Panel.js
@@ -97,6 +97,7 @@ Ext.define('PBS.DataStorePanel', {
 	    iconCls: 'fa fa-unlock',
 	    cbind: {
 		aclPath: '{aclPath}',
+		datastore: '{datastore}',
 	    },
 	},
     ],
diff --git a/www/form/PermissionPathSelector.js b/www/form/PermissionPathSelector.js
index 764b6af4..3f8b5376 100644
--- a/www/form/PermissionPathSelector.js
+++ b/www/form/PermissionPathSelector.js
@@ -50,6 +50,10 @@ Ext.define('PBS.data.PermissionPathsStore', {
 	    });
 	    me.resumeEvents();
 
+	    if (me.datastore) {
+		me.setDatastore(me.datastore);
+	    }
+
 	    me.fireEvent('refresh', me);
 	    me.fireEvent('datachanged', me);
 	}
@@ -58,6 +62,34 @@ Ext.define('PBS.data.PermissionPathsStore', {
 	    property: 'value',
 	    direction: 'ASC',
 	});
+	me.initialized = true;
+    },
+
+    setDatastore: async function(datastore) {
+	let me = this;
+	if (!datastore) {
+	    me.clearFilter();
+	    return;
+	}
+	let url = `/api2/extjs/admin/datastore/${datastore}/namespace?max-depth=7`;
+	let { result: { data: ns } } = await Proxmox.Async.api2({ url });
+	// TODO: remove "old" datastore's ns paths?
+	if (ns.length > 0) {
+	    if (me.initialized) {
+		me.suspendEvents();
+	    }
+	    for (const item of ns) {
+		if (item.ns !== '') {
+		    me.add({ value: `/datastore/${datastore}/${item.ns}` });
+		}
+	    }
+	    if (me.initialized) {
+		me.resumeEvents();
+		me.fireEvent('refresh', me);
+		me.fireEvent('datachanged', me);
+	    }
+	}
+	me.filter(item => item.get('value')?.startsWith(`/datastore/${datastore}`));
     },
 });
 
@@ -66,6 +98,26 @@ Ext.define('PBS.form.PermissionPathSelector', {
     xtype: 'pbsPermissionPathSelector',
     mixins: ['Proxmox.Mixin.CBind'],
 
+    config: {
+	datastore: null, // set to filter by a datastore, could be also made generic path
+    },
+
+    setDatastore: function(datastore) {
+	let me = this;
+	if (me.datastore === datastore) {
+	    return;
+	}
+	me.datastore = datastore;
+	let store = me.getStore();
+	if (!me.rendered) {
+	    if (store) {
+		store.datastore = datastore;
+	    }
+	} else {
+	    store.setDatastore(datastore);
+	}
+    },
+
     valueField: 'value',
     displayField: 'value',
     cbind: {
diff --git a/www/window/ACLEdit.js b/www/window/ACLEdit.js
index 300267d2..963f2ef4 100644
--- a/www/window/ACLEdit.js
+++ b/www/window/ACLEdit.js
@@ -21,15 +21,13 @@ Ext.define('PBS.window.ACLEdit', {
 	me.items = [];
 
 	me.items.push({
-	    xtype: 'pmxDisplayEditField',
+	    xtype: 'pbsPermissionPathSelector',
 	    name: 'path',
 	    fieldLabel: gettext('Path'),
-	    editConfig: {
-		xtype: 'pbsPermissionPathSelector',
-		allowBlank: false,
-	    },
-	    editable: !me.path,
+	    allowBlank: false,
+	    //editable: !me.path,
 	    value: me.path,
+	    datastore: me.datastore,
 	});
 
 	if (me.aclType === 'user') {
@@ -65,15 +63,4 @@ Ext.define('PBS.window.ACLEdit', {
 
 	me.callParent();
     },
-
-    getValues: function(dirtyOnly) {
-	let me = this;
-	let values = me.callParent(arguments);
-
-	if (me.path) {
-	    values.path = me.path;
-	}
-	return values;
-    },
-
 });