diff --git a/pkl-core/src/main/java/org/pkl/core/util/IoUtils.java b/pkl-core/src/main/java/org/pkl/core/util/IoUtils.java
index 071742370..7c8500f6b 100644
--- a/pkl-core/src/main/java/org/pkl/core/util/IoUtils.java
+++ b/pkl-core/src/main/java/org/pkl/core/util/IoUtils.java
@@ -55,6 +55,9 @@ private IoUtils() {}
 
   public static URL toUrl(URI uri) throws IOException {
     try {
+      if ("file".equalsIgnoreCase(uri.getScheme()) && uri.getHost() != null) {
+        throw new UnsupportedOperationException("Remote file URIs are not supported: " + uri);
+      }
       return uri.toURL();
     } catch (Error e) {
       // best we can do for now
@@ -62,7 +65,6 @@ public static URL toUrl(URI uri) throws IOException {
       if (e.getClass().getName().equals("com.oracle.svm.core.jdk.UnsupportedFeatureError")) {
         throw new IOException("Unsupported protocol: " + uri.getScheme());
       }
-
       throw e;
     }
   }
@@ -140,6 +142,10 @@ public static String readString(InputStream inputStream) throws IOException {
   }
 
   public static byte[] readBytes(URI uri) throws IOException {
+    if ("file".equalsIgnoreCase(uri.getScheme()) && uri.getHost() != null) {
+      throw new UnsupportedOperationException("Remote file URIs are not supported: " + uri);
+    }
+
     if (HttpUtils.isHttpUrl(uri)) {
       throw new IllegalArgumentException("Should use HTTP client to GET " + uri);
     }
diff --git a/pkl-core/src/test/kotlin/org/pkl/core/util/IoUtilsTest.kt b/pkl-core/src/test/kotlin/org/pkl/core/util/IoUtilsTest.kt
index 54a8f0134..6b6eaeeab 100644
--- a/pkl-core/src/test/kotlin/org/pkl/core/util/IoUtilsTest.kt
+++ b/pkl-core/src/test/kotlin/org/pkl/core/util/IoUtilsTest.kt
@@ -400,6 +400,13 @@ class IoUtilsTest {
     assertThrows<IllegalArgumentException> { IoUtils.readString(URI("http://example.com").toURL()) }
   }
 
+  @Test
+  fun `toUrl() throws UnsupportedOperationException for file URIs with remote hostnames`() {
+    val uri = URI("file://example.com/bar/baz.pkl")
+    val exception = assertThrows<UnsupportedOperationException> { IoUtils.toUrl(uri) }
+    assertThat(exception.message).contains("Remote file URIs are not supported")
+  }
+
   @Test
   fun `encodePath encodes characters reserved on windows`() {
     assertThat(IoUtils.encodePath("foo:bar")).isEqualTo("foo(3a)bar")