diff --git a/pom.xml b/pom.xml
index f30d6ab..327950d 100644
--- a/pom.xml
+++ b/pom.xml
@@ -162,6 +162,10 @@
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-oidc-client</artifactId>
         </dependency>
+        <dependency>
+            <groupId>io.quarkus</groupId>
+            <artifactId>quarkus-oidc</artifactId>
+        </dependency>
         <dependency>
             <groupId>io.quarkus</groupId>
             <artifactId>quarkus-micrometer-registry-prometheus</artifactId>
diff --git a/src/main/java/org/jboss/pnc/causeway/CausewayResource.java b/src/main/java/org/jboss/pnc/causeway/CausewayResource.java
index cf5d40b..3058efd 100644
--- a/src/main/java/org/jboss/pnc/causeway/CausewayResource.java
+++ b/src/main/java/org/jboss/pnc/causeway/CausewayResource.java
@@ -4,6 +4,7 @@
  */
 package org.jboss.pnc.causeway;
 
+import jakarta.annotation.security.RolesAllowed;
 import jakarta.enterprise.context.ApplicationScoped;
 import jakarta.inject.Inject;
 import jakarta.ws.rs.WebApplicationException;
@@ -52,6 +53,7 @@ public class CausewayResource implements Causeway {
 
     @Override
     @Consumes(MediaType.APPLICATION_JSON)
+    @RolesAllowed({ "pnc-app-causeway-user" })
     public void importBuild(@Valid BuildPushRequest buildPushRequest) {
         HeartbeatConfig heartbeatConf = buildPushRequest.getHeartbeat();
         if (heartbeatConf != null) {
@@ -106,6 +108,7 @@ private static PushResult handleError(Throwable e, String buildId) {
     }
 
     @Override
+    @RolesAllowed({ "pnc-app-causeway-user" })
     public void untagBuild(@Valid UntagRequest request) {
         controller.untagBuild(request.getBuild().getBrewBuildId(), request.getBuild().getTagPrefix());
     }