diff --git a/ssh_filter_btrbk.sh b/ssh_filter_btrbk.sh
index 0817563..d8adcb0 100755
--- a/ssh_filter_btrbk.sh
+++ b/ssh_filter_btrbk.sh
@@ -96,12 +96,12 @@ reject_filtered_cmd()
     # allow multiple paths (e.g. "btrfs subvolume snapshot <src> <dst>")
     allow_cmd_match="(${allow_list})( ${option_match})*( ${path_match})+"
     stream_in_match="(${decompress_match} \| )?(${mbuffer_match} \| )?"
-    stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match}$)?"
+    stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match})?"
 
     # `grep`’s `-q`-option is not used as it may cause an exit status of `0` even
     # when an error occurred.
 
-    allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}"
+    allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}$"
     if printf '%s' "${SSH_ORIGINAL_COMMAND}" | grep -E "${allow_stream_match}" >/dev/null 2>/dev/null; then
         return 0
     fi