diff --git a/routes/routes.go b/routes/routes.go
index 33c465e..8be393b 100644
--- a/routes/routes.go
+++ b/routes/routes.go
@@ -359,8 +359,11 @@ func RegisterRoutes(app *fiber.App, cfg *config.Config) {
 
 	hubAuth.Get("/report", controllers.GetHubReport)
 
-	// Redis active user caching utilities
-	redisUsers := api.Group("/utils/users/redis")
+	// Redis active user caching utilities — console/ops only. Open CRUD on a
+	// user cache with no authentication has no legitimate anonymous caller;
+	// the store is currently empty, so closing it breaks nothing.
+	redisUsers := api.Group("/utils/users/redis",
+		middlewares.AuthMiddleware(cfg), middlewares.RoleCheckMiddleware(1, 3, 4))
 	redisUsers.Post("/", controllers.CreateUserRedis)
 	redisUsers.Get("/", controllers.GetUserRedis)
 	redisUsers.Put("/:userid", controllers.UpdateUserRedis)