diff --git a/test/fuzz/OneFuzzConfig.json b/test/fuzz/OneFuzzConfig.json
index aadabc2..ae17c2c 100644
--- a/test/fuzz/OneFuzzConfig.json
+++ b/test/fuzz/OneFuzzConfig.json
@@ -27,7 +27,8 @@
                 "fuzz-inflate.pdb",
                 "clang_rt.asan_dynamic-x86_64.dll"
             ],
-            "SdlWorkItemId": 58760469
+            "SdlWorkItemId": 58760469,
+            "SourcesAllowListPath": "fuzzing-sources.txt"
         },
         {
             "jobNotificationEmail": "condev@microsoft.com",
@@ -55,7 +56,8 @@
                 "fuzz-inflate64.pdb",
                 "clang_rt.asan_dynamic-x86_64.dll"
             ],
-            "SdlWorkItemId": 58760469
+            "SdlWorkItemId": 58760469,
+            "SourcesAllowListPath": "fuzzing-sources.txt"
         }
     ]
-}
\ No newline at end of file
+}
diff --git a/test/fuzz/fuzzing-sources.txt b/test/fuzz/fuzzing-sources.txt
new file mode 100644
index 0000000..f40fde7
--- /dev/null
+++ b/test/fuzz/fuzzing-sources.txt
@@ -0,0 +1,10 @@
+# When using a source-allow-list (which this is), you have to specify * for everything to be included
+*
+
+# Now, exclude via wildcarded paths all of the following locations.
+# This is because code-coverage data on our fuzzers shouldn't be covering
+# how well we exercise the CRT, STL, etc.
+! *vctools*
+! *externalapis*
+! *internal_shared.h
+! *type_traits