diff --git a/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts b/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts
index 67f6ededc..6cba17f61 100644
--- a/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts
+++ b/apps/edr-freight-api/src/modules/contract-templates/contract-templates.controller.ts
@@ -26,16 +26,26 @@ import {
 export class ContractTemplatesController {
   constructor(private readonly service: ContractTemplatesService) {}
 
-  // Reads stay open to authenticated staff (the backoffice Templates tab);
+  // Reads are staff-only (the backoffice Templates tab is the only consumer);
   // writes are admin-guarded like other freight configuration resources.
 
   @Get()
+  @BookingStaff([
+    FREIGHT_PERMS.settings.contractTemplates.view,
+    FREIGHT_PERMS.settings.contractTemplates.manage,
+    FREIGHT_PERMS.admin,
+  ])
   @ApiOperation({ summary: "List the six contract document templates" })
   list() {
     return this.service.list();
   }
 
   @Get(":code")
+  @BookingStaff([
+    FREIGHT_PERMS.settings.contractTemplates.view,
+    FREIGHT_PERMS.settings.contractTemplates.manage,
+    FREIGHT_PERMS.admin,
+  ])
   @ApiOperation({ summary: "Get one contract template by code" })
   getByCode(@Param("code") code: string) {
     return this.service.getByCode(code);
@@ -49,6 +59,11 @@ export class ContractTemplatesController {
   }
 
   @Post(":code/preview")
+  @BookingStaff([
+    FREIGHT_PERMS.settings.contractTemplates.view,
+    FREIGHT_PERMS.settings.contractTemplates.manage,
+    FREIGHT_PERMS.admin,
+  ])
   @ApiOperation({
     summary: "Render an HTML preview of the template against mock contract data",
   })