diff --git a/apps/api/src/fonts/custom-fonts.controller.ts b/apps/api/src/fonts/custom-fonts.controller.ts
index dbda4de..a4ea9ff 100644
--- a/apps/api/src/fonts/custom-fonts.controller.ts
+++ b/apps/api/src/fonts/custom-fonts.controller.ts
@@ -23,6 +23,7 @@ import type { Response } from 'express';
 
 import { SiteAdminGuard } from '../admin/site-admin.guard';
 import { AuthedRequest, Public } from '../auth/auth.guard';
+import { AuthenticatedOnly } from '../permissions/permission.decorators';
 import { CustomFontStorageService } from './custom-font-storage.service';
 import { CustomFontsService, WeightUpload } from './custom-fonts.service';
 
@@ -125,6 +126,10 @@ export class CustomFontsFileController {
     private readonly fonts: CustomFontsService,
   ) {}
 
+  // Explicit access declaration, as every route needs (issue #52's fence
+  // `route-permissions.e2e.db.test.ts`): a session, no further permission —
+  // the list says which families exist, which is what the pickers offer.
+  @AuthenticatedOnly()
   @Get()
   list(): Promise<CustomFontView[]> {
     return this.fonts.list();