diff --git a/app/routes/groups.py b/app/routes/groups.py
index fe84d7d..2d9d010 100644
--- a/app/routes/groups.py
+++ b/app/routes/groups.py
@@ -21,7 +21,7 @@ router = APIRouter(prefix="/api/v1/groups", tags=["groups"])
 @router.get("")
 async def list_groups(
     db: AsyncSession = Depends(get_db),
-    current_user: dict = Depends(get_current_user),
+    current_user: dict = Depends(require_permission("groups:read")),
 ):
     """List all groups in the current tenant."""
     import uuid as _uuid