diff --git a/src/lib/openapi.generated.json b/src/lib/openapi.generated.json
index ed52f43..eb86403 100644
--- a/src/lib/openapi.generated.json
+++ b/src/lib/openapi.generated.json
@@ -13706,6 +13706,9 @@
           "400": {
             "description": "The id path segment is not a valid integer"
           },
+          "403": {
+            "description": "Caller lacks the git:edit permission"
+          },
           "404": {
             "description": "No repository exists with that ID"
           },
@@ -13769,6 +13772,9 @@
           "400": {
             "description": "The id path segment is not a valid integer"
           },
+          "403": {
+            "description": "Caller lacks the git:view permission"
+          },
           "404": {
             "description": "No repository exists with that ID"
           },
@@ -13830,6 +13836,9 @@
           "400": {
             "description": "The id path segment is not a valid integer"
           },
+          "403": {
+            "description": "Caller lacks the git:edit permission"
+          },
           "404": {
             "description": "No repository exists with that ID"
           },
@@ -13893,6 +13902,9 @@
           "400": {
             "description": "The id path segment is not a valid integer"
           },
+          "403": {
+            "description": "Caller lacks the git:edit permission"
+          },
           "404": {
             "description": "No repository exists with that ID"
           },
@@ -14850,7 +14862,8 @@
             "description": "The deployment triggered by the webhook failed"
           }
         },
-        "security": []
+        "security": [],
+        "description": "A secret is required by default; set ALLOW_WEBHOOKS_WITHOUT_SECRET=true to accept a secret-less trigger on an isolated network."
       },
       "post": {
         "operationId": "post_api_git_webhook_id",
@@ -14908,7 +14921,7 @@
           }
         },
         "security": [],
-        "description": "Public endpoint authenticated by the repository's webhook secret via `X-Hub-Signature-256` (GitHub) or `X-Gitlab-Token` (GitLab); the raw request body is used for HMAC verification."
+        "description": "Public endpoint authenticated by the repository's webhook secret via `X-Hub-Signature-256` (GitHub) or `X-Gitlab-Token` (GitLab); the raw request body is used for HMAC verification. A secret is required by default; set ALLOW_WEBHOOKS_WITHOUT_SECRET=true to accept a secret-less trigger on an isolated network."
       }
     },
     "/api/hawser/connect": {
diff --git a/src/routes/api/git/repositories/[id]/deploy/+server.ts b/src/routes/api/git/repositories/[id]/deploy/+server.ts
index e72c260..49d5491 100644
--- a/src/routes/api/git/repositories/[id]/deploy/+server.ts
+++ b/src/routes/api/git/repositories/[id]/deploy/+server.ts
@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getGitRepository } from '$lib/server/db';
 import { deployFromRepository } from '$lib/server/git';
+import { authorize } from '$lib/server/authorize';
 
 /**
  * @openapi
@@ -10,10 +11,16 @@ import { deployFromRepository } from '$lib/server/git';
  * resp-200: {success:boolean!, error:string}
  * resp-200-example: {"success":true}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:edit permission
  * resp-404: No repository exists with that ID
  * resp-500: The deployment failed
  */
-export const POST: RequestHandler = async ({ params }) => {
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {
diff --git a/src/routes/api/git/repositories/[id]/sync/+server.ts b/src/routes/api/git/repositories/[id]/sync/+server.ts
index 5484a5a..fb35064 100644
--- a/src/routes/api/git/repositories/[id]/sync/+server.ts
+++ b/src/routes/api/git/repositories/[id]/sync/+server.ts
@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getGitRepository } from '$lib/server/db';
 import { syncRepository, checkForUpdates } from '$lib/server/git';
+import { authorize } from '$lib/server/authorize';
 
 /**
  * @openapi
@@ -10,10 +11,16 @@ import { syncRepository, checkForUpdates } from '$lib/server/git';
  * resp-200: {success:boolean!, error:string}
  * resp-200-example: {"success":true}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:edit permission
  * resp-404: No repository exists with that ID
  * resp-500: The sync failed
  */
-export const POST: RequestHandler = async ({ params }) => {
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {
@@ -40,10 +47,16 @@ export const POST: RequestHandler = async ({ params }) => {
  * resp-200: {hasUpdates:boolean!, error:string}
  * resp-200-example: {"hasUpdates":false}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:view permission
  * resp-404: No repository exists with that ID
  * resp-500: The update check failed
  */
-export const GET: RequestHandler = async ({ params }) => {
+export const GET: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'view')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	// Check for updates without syncing
 	try {
 		const id = parseInt(params.id);
diff --git a/src/routes/api/git/repositories/[id]/test/+server.ts b/src/routes/api/git/repositories/[id]/test/+server.ts
index a40ecb8..09cd1e8 100644
--- a/src/routes/api/git/repositories/[id]/test/+server.ts
+++ b/src/routes/api/git/repositories/[id]/test/+server.ts
@@ -2,6 +2,7 @@ import { json } from '@sveltejs/kit';
 import type { RequestHandler } from './$types';
 import { getGitRepository } from '$lib/server/db';
 import { testRepository } from '$lib/server/git';
+import { authorize } from '$lib/server/authorize';
 
 /**
  * @openapi
@@ -10,10 +11,16 @@ import { testRepository } from '$lib/server/git';
  * resp-200: {success:boolean!, error:string}
  * resp-200-example: {"success":true}
  * resp-400: The id path segment is not a valid integer
+ * resp-403: Caller lacks the git:edit permission
  * resp-404: No repository exists with that ID
  * resp-500: The connectivity test failed
  */
-export const POST: RequestHandler = async ({ params }) => {
+export const POST: RequestHandler = async ({ params, cookies }) => {
+	const auth = await authorize(cookies);
+	if (auth.authEnabled && !await auth.can('git', 'edit')) {
+		return json({ error: 'Permission denied' }, { status: 403 });
+	}
+
 	try {
 		const id = parseInt(params.id);
 		if (isNaN(id)) {