diff --git a/src/main/java/com/DecodEat/domain/report/controller/AdminReportController.java b/src/main/java/com/DecodEat/domain/report/controller/AdminReportController.java
index d1b36b0..dd11479 100644
--- a/src/main/java/com/DecodEat/domain/report/controller/AdminReportController.java
+++ b/src/main/java/com/DecodEat/domain/report/controller/AdminReportController.java
@@ -10,12 +10,14 @@
 import io.swagger.v3.oas.annotations.responses.ApiResponses;
 import io.swagger.v3.oas.annotations.tags.Tag;
 import lombok.RequiredArgsConstructor;
+import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
 
 @RestController
 @RequiredArgsConstructor
 @RequestMapping("/api/admin/reports")
 @Tag(name = "[관리자] 신고 관리")
+@PreAuthorize("hasRole('ADMIN')")
 public class AdminReportController {
 
     private final ReportService reportService;
diff --git a/src/main/java/com/DecodEat/global/config/WebOAuthSecurityConfig.java b/src/main/java/com/DecodEat/global/config/WebOAuthSecurityConfig.java
index f6ba47e..348104f 100644
--- a/src/main/java/com/DecodEat/global/config/WebOAuthSecurityConfig.java
+++ b/src/main/java/com/DecodEat/global/config/WebOAuthSecurityConfig.java
@@ -54,13 +54,13 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti
 
         // 3. 요청별 인가 규칙 설정
         http.authorizeHttpRequests(auth -> auth
-                .anyRequest().permitAll());
-//                .requestMatchers("/img/**", "/css/**", "/js/**", "/favicon.ico", "/error").permitAll()
-//                .requestMatchers("/swagger-ui/**","/v3/api-docs/**").permitAll() // 토큰 재발급 요청은 누구나 가능
-//                .requestMatchers("/api/token").permitAll()
+//                .anyRequest().permitAll());
+                .requestMatchers("/img/**", "/css/**", "/js/**", "/favicon.ico", "/error").permitAll()
+                .requestMatchers("/swagger-ui/**","/v3/api-docs/**").permitAll() // 토큰 재발급 요청은 누구나 가능
+                .requestMatchers("/api/token").permitAll()
 //                .requestMatchers("/api/users/**").hasAnyRole("USER", "ADMIN") // 유저 관련 API는 USER 또는 ADMIN 권한 필요
-//                .requestMatchers("/api/admin/**").hasRole("ADMIN") // 어드민 관련 API는 ADMIN 권한만 가능
-//                .anyRequest().authenticated()); // 나머지 요청은 인증 필요
+                .requestMatchers("/api/admin/**").hasRole("ADMIN") // 어드민 관련 API는 ADMIN 권한만 가능
+                .anyRequest().authenticated()); // 나머지 요청은 인증 필요
 
         // 4. OAuth2 로그인 설정
         http.oauth2Login(oauth2 -> oauth2