diff --git a/pkg/plugins/manager/signature/authorizer.go b/pkg/plugins/manager/signature/authorizer.go
index a96aa6f16b943..46051b1e136c4 100644
--- a/pkg/plugins/manager/signature/authorizer.go
+++ b/pkg/plugins/manager/signature/authorizer.go
@@ -34,5 +34,14 @@ func (u *UnsignedPluginAuthorizer) CanLoadPlugin(p *plugins.Plugin) bool {
 		}
 	}
 
+	// Allow a plugin to be unsigned when nested in an whitelisted app plugin
+	if p.Parent != nil {
+		for _, pID := range u.cfg.PluginsAllowUnsigned {
+			if pID == p.Parent.ID {
+				return true
+			}
+		}
+	}
+
 	return false
 }