diff --git a/CHANGELOG.md b/CHANGELOG.md
index dfcdc7093..ff047e135 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 * events: Fix panic when using the `hclog-text` event's format.
   ([PR](https://github.com/hashicorp/boundary/pull/1456))
+* oidc managed groups: Allow colons in selector paths
+  ([PR](https://github.com/hashicorp/boundary/pull/1453))
 
 ## 0.5.0 (2021/08/02)
 
diff --git a/go.mod b/go.mod
index 9ff51b9f5..696539984 100644
--- a/go.mod
+++ b/go.mod
@@ -24,7 +24,7 @@ require (
 	github.com/hashicorp/dawdle v0.4.0
 	github.com/hashicorp/dbassert v0.0.0-20200930125617-6218396928df
 	github.com/hashicorp/eventlogger v0.1.0
-	github.com/hashicorp/go-bexpr v0.1.8
+	github.com/hashicorp/go-bexpr v0.1.9
 	github.com/hashicorp/go-cleanhttp v0.5.2
 	github.com/hashicorp/go-hclog v0.16.2
 	github.com/hashicorp/go-kms-wrapping v0.6.3
diff --git a/go.sum b/go.sum
index ffb399df1..fa5e59a6a 100644
--- a/go.sum
+++ b/go.sum
@@ -407,8 +407,8 @@ github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/eventlogger v0.1.0 h1:S6xc4gZVzewuDUP4R4Ngko419h/CGDuV/b4ADL3XLik=
 github.com/hashicorp/eventlogger v0.1.0/go.mod h1:a3IXf1aEJfpCPzseTOrwKj4fVW/Qn3oEmpQeaIznzH0=
-github.com/hashicorp/go-bexpr v0.1.8 h1:ETfuLF1bBAuHW/Qg6l1xCdV8WJ7lfatLtJ1N1w0IsfE=
-github.com/hashicorp/go-bexpr v0.1.8/go.mod h1:oxlubA2vC/gFVfX1A6JGp7ls7uCDlfJn732ehYYg+g0=
+github.com/hashicorp/go-bexpr v0.1.9 h1:ouAaFgGdp28SwSFYbJycLo9hNWwbtgESzTVKeBC21pw=
+github.com/hashicorp/go-bexpr v0.1.9/go.mod h1:oxlubA2vC/gFVfX1A6JGp7ls7uCDlfJn732ehYYg+g0=
 github.com/hashicorp/go-cleanhttp v0.5.0/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.1/go.mod h1:JpRdi6/HCYpAwUzNwuwqhbovhLtngrth3wmdIIUrZ80=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
diff --git a/internal/auth/oidc/service_callback_test.go b/internal/auth/oidc/service_callback_test.go
index e5962f9e1..f1b66c3ca 100644
--- a/internal/auth/oidc/service_callback_test.go
+++ b/internal/auth/oidc/service_callback_test.go
@@ -679,10 +679,11 @@ func Test_ManagedGroupFiltering(t *testing.T) {
 	tp.SetExpectedSubject(sub)
 	tp.SetCustomAudience("foo", "alice-rp")
 	info := map[string]interface{}{
-		"roles": []string{"user", "operator"},
-		"sub":   "alice@example.com",
-		"email": "alice-alias@example.com",
-		"name":  "alice doe joe foe",
+		"roles":  []string{"user", "operator"},
+		"sub":    "alice@example.com",
+		"email":  "alice-alias@example.com",
+		"name":   "alice doe joe foe",
+		"co:lon": "colon",
 	}
 	tp.SetUserInfoReply(info)
 
@@ -733,6 +734,14 @@ func Test_ManagedGroupFiltering(t *testing.T) {
 			},
 			matchingMgs: mgs[1:2],
 		},
+		{
+			name: "colon test",
+			filters: []string{
+				TestFakeManagedGroupFilter,
+				`"/userinfo/co:lon" == "colon"`,
+			},
+			matchingMgs: mgs[1:2],
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {