diff --git a/pkg/services/query/query.go b/pkg/services/query/query.go
index 02803abf92b..773d0577f43 100644
--- a/pkg/services/query/query.go
+++ b/pkg/services/query/query.go
@@ -259,6 +259,14 @@ func (pr parsedRequest) validateRequest() error {
 		return nil
 	}
 
+	if pr.hasExpression {
+		hasExpr := pr.httpRequest.URL.Query().Get("expression")
+		if hasExpr == "" || hasExpr == "true" {
+			return nil
+		}
+		return ErrQueryParamMismatch
+	}
+
 	vals := splitHeaders(pr.httpRequest.Header.Values(HeaderDatasourceUID))
 	count := len(vals)
 	if count > 0 { // header exists
diff --git a/pkg/services/query/query_test.go b/pkg/services/query/query_test.go
index f5d931c8784..e8da4ab6481 100644
--- a/pkg/services/query/query_test.go
+++ b/pkg/services/query/query_test.go
@@ -288,8 +288,16 @@ func TestQueryDataMultipleSources(t *testing.T) {
 			HTTPRequest:                nil,
 		}
 
+		// without query parameter
 		_, err = tc.queryService.QueryData(context.Background(), tc.signedInUser, true, reqDTO)
+		require.NoError(t, err)
 
+		httpreq, _ := http.NewRequest(http.MethodPost, "http://localhost/ds/query?expression=true", bytes.NewReader([]byte{}))
+		httpreq.Header.Add("X-Datasource-Uid", "gIEkMvIVz")
+		reqDTO.HTTPRequest = httpreq
+
+		// with query parameter
+		_, err = tc.queryService.QueryData(context.Background(), tc.signedInUser, true, reqDTO)
 		require.NoError(t, err)
 	})