diff --git a/apps/labrinth/src/routes/internal/medal.rs b/apps/labrinth/src/routes/internal/medal.rs
index 5b2cb8184..2f5e55b14 100644
--- a/apps/labrinth/src/routes/internal/medal.rs
+++ b/apps/labrinth/src/routes/internal/medal.rs
@@ -45,7 +45,7 @@ pub async fn verify(
     }
 }
 
-#[post("redeem")]
+#[post("redeem", guard = "medal_key_guard")]
 pub async fn redeem(
     _req: HttpRequest,
     _pool: web::Data<PgPool>,