diff --git a/src/API.jl b/src/API.jl
index 52c4362bfe..6b746f9e0b 100644
--- a/src/API.jl
+++ b/src/API.jl
@@ -1593,7 +1593,10 @@ end
 
 function handle_package_input!(pkg::PackageSpec)
     if pkg.path !== nothing && pkg.url !== nothing
-        pkgerror("`path` and `url` are conflicting specifications")
+        pkgerror("Conflicting `path` and `url` in PackageSpec")
+    end
+    if pkg.repo.source !== nothing || pkg.repo.rev !== nothing || pkg.repo.subdir !== nothing
+        pkgerror("`repo` is a private field of PackageSpec and should not be set directly")
     end
     pkg.repo = Types.GitRepo(rev = pkg.rev, source = pkg.url !== nothing ? pkg.url : pkg.path,
                          subdir = pkg.subdir)
diff --git a/src/Types.jl b/src/Types.jl
index 3607655d84..d13105b8b1 100644
--- a/src/Types.jl
+++ b/src/Types.jl
@@ -93,7 +93,7 @@ mutable struct PackageSpec
     uuid::Union{Nothing,UUID}
     version::Union{Nothing,VersionTypes,String}
     tree_hash::Union{Nothing,SHA1}
-    repo::GitRepo
+    repo::GitRepo # private
     path::Union{Nothing,String}
     pinned::Bool
     # used for input only
diff --git a/test/new.jl b/test/new.jl
index 9a3c01e6d2..3b1a0faa53 100644
--- a/test/new.jl
+++ b/test/new.jl
@@ -2164,6 +2164,8 @@ end
         Pkg.dependencies(exuuid) do pkg
             @test pkg.version > v"0.3.0"
         end
+
+        @test_throws PkgError("`repo` is a private field of PackageSpec and should not be set directly") Pkg.add([Pkg.PackageSpec(;repo=Pkg.Types.GitRepo(source="someurl"))])
     end
 end