diff --git a/src/routes/betaApplications.js b/src/routes/betaApplications.js
index 0268674..1d57ae3 100644
--- a/src/routes/betaApplications.js
+++ b/src/routes/betaApplications.js
@@ -1,6 +1,6 @@
 "use strict";
 
-const { getUserContextById, verifyToken } = require("../auth");
+const { getUserContextById, requireAuth, verifyToken } = require("../auth");
 const { pool, withTransaction } = require("../db");
 const { loadBetaInviteCodes, normalizeBetaInviteCode } = require("../betaInviteCodes");
 
@@ -274,7 +274,7 @@ function registerBetaApplicationRoutes(router) {
     }
   });
 
-  router.get("/admin/beta-applications", requireBetaApplicationReviewer, async (req, res) => {
+  router.get("/admin/beta-applications", requireAuth, requireBetaApplicationReviewer, async (req, res) => {
     try {
       await ensureBetaApplicationSchema();
       const status = cleanText(req.query.status, 32);
@@ -305,7 +305,7 @@ function registerBetaApplicationRoutes(router) {
     }
   });
 
-  router.patch("/admin/beta-applications/:id", requireBetaApplicationReviewer, async (req, res) => {
+  router.patch("/admin/beta-applications/:id", requireAuth, requireBetaApplicationReviewer, async (req, res) => {
     const id = Number(req.params.id);
     const action = cleanText(req.body?.action, 32);
     const reviewNote = cleanText(req.body?.reviewNote ?? req.body?.review_note, 1000) || null;