diff --git a/server.js b/server.js
index 2905131..0f7d375 100644
--- a/server.js
+++ b/server.js
@@ -540,8 +540,7 @@ app.get('/api/client-users', auth, (req, res) => {
   res.json(result);
 });
 
-app.post('/api/admin/sync-client-users', auth, (req, res) => {
-  if (!req.user?.is_admin) return res.status(403).json({ error: 'forbidden' });
+app.post('/api/admin/sync-client-users', auth, adminOnly, (req, res) => {
   refreshService.syncClientUsers()
     .then(() => {
       const count = db.prepare('SELECT COUNT(*) as c FROM client_users').get();