diff --git a/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts b/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
index 5263f4a22..b11ac3098 100644
--- a/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
+++ b/apps/edr-passenger-api/src/modules/schedules/schedules.controller.ts
@@ -80,7 +80,7 @@ export class SchedulesController {
   }
 
   @Patch('routes/fare-rules/:id')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
   @ApiOperation({ summary: 'Update a route-level fare override' })
   @ApiParam({ name: 'id', description: 'RouteFareRule UUID' })
   updateRouteFareRule(@Param('id') id: string, @Body() dto: any) {
@@ -96,7 +96,7 @@ export class SchedulesController {
   }
 
   @Post('routes/:routeId/fare-rules')
-  @UseGuards(JwtGuard) @ApiBearerAuth('JWT-auth')
+  @PassengerStaff([PASSENGER_PERMS.schedules.manage, PASSENGER_PERMS.admin]) @ApiBearerAuth('IAM-auth')
   @ApiOperation({ summary: 'Create a route-level fare override' })
   @ApiParam({ name: 'routeId', description: 'Route UUID' })
   createRouteFareRule(@Param('routeId') routeId: string, @Body() dto: any) {