diff --git a/modules/controller/cinder.nix b/modules/controller/cinder.nix
index a209696..55b31a7 100644
--- a/modules/controller/cinder.nix
+++ b/modules/controller/cinder.nix
@@ -31,6 +31,8 @@ let
     project_name = service
     username = cinder
     password = cinder
+    service_token_roles_required = true
+    service_token_roles = admin
 
     [oslo_concurrency]
     lock_path = /var/lib/cinder/tmp
diff --git a/modules/storage/cinder-storage-node.nix b/modules/storage/cinder-storage-node.nix
index e4e7064..a6f7ca2 100644
--- a/modules/storage/cinder-storage-node.nix
+++ b/modules/storage/cinder-storage-node.nix
@@ -62,6 +62,8 @@ let
     project_name = service
     username = cinder
     password = cinder
+    service_token_roles_required = true
+    service_token_roles = admin
 
     [oslo_concurrency]
     lock_path = /var/lib/cinder/tmp
@@ -104,6 +106,8 @@ let
     project_name = service
     username = cinder
     password = cinder
+    service_token_roles_required = true
+    service_token_roles = admin
 
     [oslo_concurrency]
     lock_path = /var/lib/cinder/tmp