diff --git a/e2e/src/specs/server/api/user-admin.e2e-spec.ts b/e2e/src/specs/server/api/user-admin.e2e-spec.ts
index df6fea84bc..7b9f644a29 100644
--- a/e2e/src/specs/server/api/user-admin.e2e-spec.ts
+++ b/e2e/src/specs/server/api/user-admin.e2e-spec.ts
@@ -358,6 +358,22 @@ describe('/admin/users', () => {
     });
   });
 
+  describe('GET /admin/users/:id/calendar-heatmap', () => {
+    it('should require authentication', async () => {
+      const { status, body } = await request(app).get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`);
+      expect(status).toBe(401);
+      expect(body).toEqual(errorDto.unauthorized);
+    });
+
+    it('should require admin permissions', async () => {
+      const { status, body } = await request(app)
+        .get(`/admin/users/${nonAdmin.userId}/calendar-heatmap`)
+        .set('Authorization', `Bearer ${nonAdmin.accessToken}`);
+      expect(status).toBe(403);
+      expect(body).toEqual(errorDto.forbidden);
+    });
+  });
+
   describe('POST /admin/users/:id/restore', () => {
     it('should require authentication', async () => {
       const { status, body } = await request(app).post(`/admin/users/${userToDelete.userId}/restore`);
diff --git a/open-api/immich-openapi-specs.json b/open-api/immich-openapi-specs.json
index b61f87d88d..2bbe961ccc 100644
--- a/open-api/immich-openapi-specs.json
+++ b/open-api/immich-openapi-specs.json
@@ -1639,6 +1639,7 @@
         "tags": [
           "Users (admin)"
         ],
+        "x-immich-admin-only": true,
         "x-immich-history": [
           {
             "version": "v3",
diff --git a/server/src/controllers/user-admin.controller.ts b/server/src/controllers/user-admin.controller.ts
index fbc18478ab..76ac15c0ad 100644
--- a/server/src/controllers/user-admin.controller.ts
+++ b/server/src/controllers/user-admin.controller.ts
@@ -102,7 +102,7 @@ export class UserAdminController {
   }
 
   @Get(':id/calendar-heatmap')
-  @Authenticated({ permission: Permission.UserRead })
+  @Authenticated({ permission: Permission.UserRead, admin: true })
   @Endpoint({
     summary: 'Retrieve calendar heatmap activity',
     description: 'Retrieve activity counts for a specified period, in a calendar heatmap format.',