diff --git a/app/main/views/uploads.py b/app/main/views/uploads.py
index 9c77bb2ac..d65ce6ffe 100644
--- a/app/main/views/uploads.py
+++ b/app/main/views/uploads.py
@@ -379,6 +379,7 @@ def send_uploaded_letter(service_id, file_id):
 @user_has_permissions('send_messages')
 def upload_contact_list(service_id):
     form = CsvUploadForm()
+    allowed_spreadsheet_file_extensions = ','.join([f'.{ext}' for ext in Spreadsheet.ALLOWED_FILE_EXTENSIONS])
 
     if form.validate_on_submit():
         try:
@@ -415,6 +416,7 @@ def upload_contact_list(service_id):
     return render_template(
         'views/uploads/contact-list/upload.html',
         form=form,
+        allowed_spreadsheet_file_extensions=allowed_spreadsheet_file_extensions,
     )
 
 
@@ -449,6 +451,7 @@ def check_contact_list(service_id, upload_id):
     )
 
     non_empty_column_headers = list(filter(None, recipients.column_headers))
+    allowed_spreadsheet_file_extensions = ','.join([f'.{ext}' for ext in Spreadsheet.ALLOWED_FILE_EXTENSIONS])
 
     if len(non_empty_column_headers) > 1 or not template_type or not recipients:
         return render_template(
@@ -457,6 +460,7 @@ def check_contact_list(service_id, upload_id):
             original_file_name=original_file_name,
             template_type=template_type,
             form=form,
+            allowed_spreadsheet_file_extensions=allowed_spreadsheet_file_extensions
         )
 
     if recipients.too_many_rows or not len(recipients):
@@ -465,6 +469,7 @@ def check_contact_list(service_id, upload_id):
             recipients=recipients,
             original_file_name=original_file_name,
             form=form,
+            allowed_spreadsheet_file_extensions=allowed_spreadsheet_file_extensions
         )
 
     row_errors = get_errors_for_csv(recipients, template_type)
@@ -475,6 +480,7 @@ def check_contact_list(service_id, upload_id):
             original_file_name=original_file_name,
             row_errors=row_errors,
             form=form,
+            allowed_spreadsheet_file_extensions=allowed_spreadsheet_file_extensions
         )
 
     if recipients.has_errors:
@@ -483,6 +489,7 @@ def check_contact_list(service_id, upload_id):
             recipients=recipients,
             original_file_name=original_file_name,
             form=form,
+            allowed_spreadsheet_file_extensions=allowed_spreadsheet_file_extensions
         )
 
     metadata_kwargs = {
diff --git a/app/templates/views/uploads/contact-list/column-errors.html b/app/templates/views/uploads/contact-list/column-errors.html
index 96a7becb1..b69503e88 100644
--- a/app/templates/views/uploads/contact-list/column-errors.html
+++ b/app/templates/views/uploads/contact-list/column-errors.html
@@ -49,6 +49,7 @@
     <div class="form-group">
       {{ file_upload(
         form.file,
+        allowed_file_extensions=allowed_spreadsheet_file_extensions,
         action=url_for('.upload_contact_list', service_id=current_service.id),
         button_text='Upload your file again'
       ) }}
diff --git a/app/templates/views/uploads/contact-list/row-errors.html b/app/templates/views/uploads/contact-list/row-errors.html
index 97e496568..0e9bd6be6 100644
--- a/app/templates/views/uploads/contact-list/row-errors.html
+++ b/app/templates/views/uploads/contact-list/row-errors.html
@@ -44,6 +44,7 @@
     <div class="form-group">
       {{ file_upload(
         form.file,
+        allowed_file_extensions=allowed_spreadsheet_file_extensions,
         action=url_for('.upload_contact_list', service_id=current_service.id),
         button_text='Upload your file again'
       ) }}
diff --git a/app/templates/views/uploads/contact-list/too-many-columns.html b/app/templates/views/uploads/contact-list/too-many-columns.html
index 83ed244e6..313e14d47 100644
--- a/app/templates/views/uploads/contact-list/too-many-columns.html
+++ b/app/templates/views/uploads/contact-list/too-many-columns.html
@@ -58,6 +58,7 @@
     <div class="form-group">
       {{ file_upload(
         form.file,
+        allowed_file_extensions=allowed_spreadsheet_file_extensions,
         action=url_for('.upload_contact_list', service_id=current_service.id),
         button_text='Upload your file again'
       ) }}
diff --git a/app/templates/views/uploads/contact-list/upload.html b/app/templates/views/uploads/contact-list/upload.html
index 8ca7b374e..a4c487e7e 100644
--- a/app/templates/views/uploads/contact-list/upload.html
+++ b/app/templates/views/uploads/contact-list/upload.html
@@ -35,6 +35,7 @@
 <div class="bottom-gutter">
   {{ file_upload(
     form.file,
+    allowed_file_extensions=allowed_spreadsheet_file_extensions,
     button_text='Upload your file again' if error else 'Choose file',
     show_errors=False
   )}}
diff --git a/tests/app/main/views/uploads/test_upload_contact_list.py b/tests/app/main/views/uploads/test_upload_contact_list.py
index 6d39337b5..9915d0696 100644
--- a/tests/app/main/views/uploads/test_upload_contact_list.py
+++ b/tests/app/main/views/uploads/test_upload_contact_list.py
@@ -18,6 +18,8 @@ def test_upload_contact_list_page(client_request):
     assert 'action' not in page.select_one('form')
     assert page.select_one('form input')['name'] == 'file'
     assert page.select_one('form input')['type'] == 'file'
+    assert page.select_one('form input').has_attr('accept')
+    assert set(page.select_one('form input')['accept'].split(',')) == {'.csv', '.xlsx', '.xls', '.ods', '.xlsm', '.tsv'}
 
     assert normalize_spaces(page.select('.spreadsheet')[0].text) == (
         'Example A '
@@ -234,6 +236,8 @@ def test_upload_csv_file_shows_error_banner(
         service_id=SERVICE_ONE_ID,
     )
     assert page.select_one('form input')['type'] == 'file'
+    assert page.select_one('form input').has_attr('accept')
+    assert set(page.select_one('form input')['accept'].split(',')) == {'.csv', '.xlsx', '.xls', '.ods', '.xlsm', '.tsv'}
 
     assert normalize_spaces(page.select_one('thead').text) == expected_thead
     assert normalize_spaces(page.select_one('tbody').text) == expected_tbody