diff --git a/src/API.jl b/src/API.jl
index 834fbdcef5..75f541240f 100644
--- a/src/API.jl
+++ b/src/API.jl
@@ -1557,7 +1557,10 @@ end
 
 function handle_package_input!(pkg::PackageSpec)
     if pkg.path !== nothing && pkg.url !== nothing
-        pkgerror("`path` and `url` are conflicting specifications")
+        pkgerror("Conflicting `path` and `url` in PackageSpec")
+    end
+    if pkg.repo.source !== nothing || pkg.repo.rev !== nothing || pkg.repo.subdir !== nothing
+        pkgerror("`repo` is a private field of PackageSpec and should not be set directly")
     end
     pkg.repo = Types.GitRepo(rev = pkg.rev, source = pkg.url !== nothing ? pkg.url : pkg.path,
                          subdir = pkg.subdir)
diff --git a/src/Types.jl b/src/Types.jl
index 5f72f49c96..ca670c4b8b 100644
--- a/src/Types.jl
+++ b/src/Types.jl
@@ -92,7 +92,7 @@ mutable struct PackageSpec
     uuid::Union{Nothing,UUID}
     version::Union{Nothing,VersionTypes,String}
     tree_hash::Union{Nothing,SHA1}
-    repo::GitRepo
+    repo::GitRepo # private
     path::Union{Nothing,String}
     pinned::Bool
     # used for input only
diff --git a/test/new.jl b/test/new.jl
index 6b6a96abfd..be5e6d9baf 100644
--- a/test/new.jl
+++ b/test/new.jl
@@ -1925,6 +1925,8 @@ end
         Pkg.dependencies(exuuid) do pkg
             @test pkg.version > v"0.3.0"
         end
+
+        @test_throws PkgError("`repo` is a private field of PackageSpec and should not be set directly") Pkg.add([PackageSpec(;repo=Pkg.Types.GitRepo(url="someurl"))])
     end
 end