diff --git a/functions/account/update.ts b/functions/account/update.ts
index 6113911..4f991da 100644
--- a/functions/account/update.ts
+++ b/functions/account/update.ts
@@ -3,6 +3,7 @@ import { AccountType, accountAttributes, stripAccountInfo, type FullAccount } fr
 import { setAccountAttribute, setDB } from '../../src/backend/api';
 import type { RequestContext } from '../../src/backend/context';
 import { checkAuth, checkBody, error, getAccountFromTokenOrID, parseError, response } from '../../src/backend/utils';
+import { Access } from '../../src/generic';
 
 export { onRequestOptions } from '../../src/backend/utils';
 
@@ -32,6 +33,7 @@ export async function onRequest({ env, request }: RequestContext): Promise<Respo
 			target,
 			allowIfSame: ['username', 'email'].includes(body.key),
 			requiredType: requiredTypeForChange[body.key],
+			access: Access.PROTECTED,
 		});
 
 		try {