diff --git a/components/sidebar/SidebarProduct.tsx b/components/sidebar/SidebarProduct.tsx
index ae80a37f5a5e..dce102c1a7fb 100644
--- a/components/sidebar/SidebarProduct.tsx
+++ b/components/sidebar/SidebarProduct.tsx
@@ -54,8 +54,8 @@ export const SidebarProduct = () => {
                 const isStandaloneCategory = childPage.page.documentType === 'article'
 
                 const childTitle = childPage.renderedShortTitle || childPage.renderedFullTitle
-
-                const isActive = routePath.includes(childPage.href) || routePath === childPage.href
+                const isActive =
+                  routePath.includes(childPage.href + '/') || routePath === childPage.href
                 const defaultOpen = hasExactCategory ? isActive : false
                 return (
                   <li
diff --git a/middleware/index.js b/middleware/index.js
index b63c2def24cc..17ab9d010989 100644
--- a/middleware/index.js
+++ b/middleware/index.js
@@ -1,4 +1,5 @@
 import express from 'express'
+import basicAuth from 'express-basic-auth'
 import instrument from '../lib/instrument-middleware.js'
 import haltOnDroppedConnection from './halt-on-dropped-connection.js'
 import abort from './abort.js'
@@ -61,6 +62,7 @@ import renderPage from './render-page.js'
 const { NODE_ENV } = process.env
 const isDevelopment = NODE_ENV === 'development'
 const isTest = NODE_ENV === 'test' || process.env.GITHUB_ACTIONS === 'true'
+const isProduction = NODE_ENV === 'production' && process.env.HEROKU_PRODUCTION_APP
 
 // Catch unhandled promise rejections and passing them to Express's error handler
 // https://medium.com/@Abazhenov/using-async-await-in-express-with-node-8-b8af872c0016
@@ -143,16 +145,18 @@ export default function (app) {
       instrument(archivedEnterpriseVersionsAssets, './archived-enterprise-versions-assets')
     )
   )
-  app.use(
-    '/storybook',
+  app.use('/storybook', [
+    (isProduction &&
+      basicAuth({ users: { octocat: process.env.STORYBOOK_PASSWORD }, challenge: true })) ||
+      ((req, res, next) => next()),
     express.static('storybook', {
       index: false,
       etag: false,
       immutable: true,
       lastModified: false,
       maxAge: '1 day', // Relatively short in case we update index.html
-    })
-  )
+    }),
+  ])
   app.use(
     '/assets',
     express.static('assets', {
diff --git a/package-lock.json b/package-lock.json
index 4f071e14148b..737e8a950bb7 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -29,6 +29,7 @@
         "dayjs": "^1.10.6",
         "dotenv": "^10.0.0",
         "express": "^4.17.1",
+        "express-basic-auth": "^1.2.0",
         "express-rate-limit": "^5.3.0",
         "express-timeout-handler": "^2.2.2",
         "flat": "^5.0.2",
@@ -15784,6 +15785,14 @@
         "node": ">= 0.10.0"
       }
     },
+    "node_modules/express-basic-auth": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/express-basic-auth/-/express-basic-auth-1.2.0.tgz",
+      "integrity": "sha512-iJ0h1Gk6fZRrFmO7tP9nIbxwNgCUJASfNj5fb0Hy15lGtbqqsxpt7609+wq+0XlByZjXmC/rslWQtnuSTVRIcg==",
+      "dependencies": {
+        "basic-auth": "^2.0.1"
+      }
+    },
     "node_modules/express-rate-limit": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-5.3.0.tgz",
@@ -48491,6 +48500,14 @@
         }
       }
     },
+    "express-basic-auth": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/express-basic-auth/-/express-basic-auth-1.2.0.tgz",
+      "integrity": "sha512-iJ0h1Gk6fZRrFmO7tP9nIbxwNgCUJASfNj5fb0Hy15lGtbqqsxpt7609+wq+0XlByZjXmC/rslWQtnuSTVRIcg==",
+      "requires": {
+        "basic-auth": "^2.0.1"
+      }
+    },
     "express-rate-limit": {
       "version": "5.3.0",
       "resolved": "https://registry.npmjs.org/express-rate-limit/-/express-rate-limit-5.3.0.tgz",
diff --git a/package.json b/package.json
index 9f736474546f..48ecb47b553d 100644
--- a/package.json
+++ b/package.json
@@ -31,6 +31,7 @@
     "dayjs": "^1.10.6",
     "dotenv": "^10.0.0",
     "express": "^4.17.1",
+    "express-basic-auth": "^1.2.0",
     "express-rate-limit": "^5.3.0",
     "express-timeout-handler": "^2.2.2",
     "flat": "^5.0.2",