diff --git a/lib/config/validation.ts b/lib/config/validation.ts
index bb648fcdc58db1eb882272afe663c00933b43b85..812d33e64d5e889788bfb41719ece77e80a0439f 100644
--- a/lib/config/validation.ts
+++ b/lib/config/validation.ts
@@ -706,7 +706,7 @@ export async function validateConfig(
     }
 
     if (key === 'hostRules' && is.array(val)) {
-      const allowedHeaders = GlobalConfig.get('allowedHeaders');
+      const allowedHeaders = GlobalConfig.get('allowedHeaders', []);
       for (const rule of val as HostRule[]) {
         if (!rule.headers) {
           continue;
@@ -718,7 +718,7 @@ export async function validateConfig(
               message: `Invalid hostRules headers value configuration: header must be a string.`,
             });
           }
-          if (!anyMatchRegexOrMinimatch(allowedHeaders, header)) {
+          if (!anyMatchRegexOrMinimatch(header, allowedHeaders)) {
             errors.push({
               topic: 'Configuration Error',
               message: `hostRules header \`${header}\` is not allowed by this bot's \`allowedHeaders\`.`,
diff --git a/lib/util/http/host-rules.ts b/lib/util/http/host-rules.ts
index 75919272ca1a0a4fdd2dd2e782f8963544b6af73..4eab58e53957ef3dc9832bdfea9a6c8e7dacef2f 100644
--- a/lib/util/http/host-rules.ts
+++ b/lib/util/http/host-rules.ts
@@ -165,11 +165,11 @@ export function applyHostRule<GotOptions extends HostRulesGotOptions>(
   }
 
   if (hostRule.headers) {
-    const allowedHeaders = GlobalConfig.get('allowedHeaders');
+    const allowedHeaders = GlobalConfig.get('allowedHeaders', []);
     const filteredHeaders: Record<string, string> = {};
 
     for (const [header, value] of Object.entries(hostRule.headers)) {
-      if (anyMatchRegexOrMinimatch(allowedHeaders, header)) {
+      if (anyMatchRegexOrMinimatch(header, allowedHeaders)) {
         filteredHeaders[header] = value;
       } else {
         logger.once.error(
diff --git a/lib/util/package-rules/match.ts b/lib/util/package-rules/match.ts
index c66f19284d187857bdc4f3eea5b4dfe65d69d100..1d14d19e58fbf51809f6bdc8be5bec42e884e341 100644
--- a/lib/util/package-rules/match.ts
+++ b/lib/util/package-rules/match.ts
@@ -1,9 +1,8 @@
-import is from '@sindresorhus/is';
 import { logger } from '../../logger';
 import { minimatch } from '../minimatch';
 import { regEx } from '../regex';
 
-export function matchRegexOrMinimatch(pattern: string, input: string): boolean {
+export function matchRegexOrMinimatch(input: string, pattern: string): boolean {
   if (pattern.length > 2 && pattern.startsWith('/') && pattern.endsWith('/')) {
     try {
       const regex = regEx(pattern.slice(1, -1));
@@ -18,14 +17,8 @@ export function matchRegexOrMinimatch(pattern: string, input: string): boolean {
 }
 
 export function anyMatchRegexOrMinimatch(
-  patterns: string[] | undefined,
-  input: string | undefined,
+  input: string,
+  patterns: string[],
 ): boolean | null {
-  if (is.undefined(patterns)) {
-    return null;
-  }
-  if (is.undefined(input)) {
-    return false;
-  }
-  return patterns.some((pattern) => matchRegexOrMinimatch(pattern, input));
+  return patterns.some((pattern) => matchRegexOrMinimatch(input, pattern));
 }
diff --git a/lib/util/package-rules/repositories.ts b/lib/util/package-rules/repositories.ts
index 01c958d4615335f5bc7221c3f78086df87c844b0..824df9164ec4ddaa9b7e19f342adc1e6f23df9e9 100644
--- a/lib/util/package-rules/repositories.ts
+++ b/lib/util/package-rules/repositories.ts
@@ -1,3 +1,4 @@
+import is from '@sindresorhus/is';
 import type { PackageRule, PackageRuleInputConfig } from '../../config/types';
 import { Matcher } from './base';
 import { anyMatchRegexOrMinimatch } from './match';
@@ -7,13 +8,29 @@ export class RepositoriesMatcher extends Matcher {
     { repository }: PackageRuleInputConfig,
     { matchRepositories }: PackageRule,
   ): boolean | null {
-    return anyMatchRegexOrMinimatch(matchRepositories, repository);
+    if (is.undefined(matchRepositories)) {
+      return null;
+    }
+
+    if (is.undefined(repository)) {
+      return false;
+    }
+
+    return anyMatchRegexOrMinimatch(repository, matchRepositories);
   }
 
   override excludes(
     { repository }: PackageRuleInputConfig,
     { excludeRepositories }: PackageRule,
   ): boolean | null {
-    return anyMatchRegexOrMinimatch(excludeRepositories, repository);
+    if (is.undefined(excludeRepositories)) {
+      return null;
+    }
+
+    if (is.undefined(repository)) {
+      return false;
+    }
+
+    return anyMatchRegexOrMinimatch(repository, excludeRepositories);
   }
 }