diff --git a/app/api/incidents/[id]/investigation/route.ts b/app/api/incidents/[id]/investigation/route.ts
index a2adba2..bfb9d3d 100644
--- a/app/api/incidents/[id]/investigation/route.ts
+++ b/app/api/incidents/[id]/investigation/route.ts
@@ -15,7 +15,7 @@ export async function POST(
 
   const { data: profile } = await supabase
     .from('users').select('role').eq('id', user.id).single()
-  if (!profile || profile.role !== 'hse')
+  if (!profile || !['hse', 'admin'].includes(profile.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   const { data: incident } = await supabase
@@ -79,7 +79,7 @@ export async function PATCH(
 
   const { data: profile } = await supabase
     .from('users').select('role').eq('id', user.id).single()
-  if (!profile || profile.role !== 'hse')
+  if (!profile || !['hse', 'admin'].includes(profile.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   const body = await request.json()
diff --git a/app/api/incidents/[id]/triage/route.ts b/app/api/incidents/[id]/triage/route.ts
index 3cf98a4..1f1abbc 100644
--- a/app/api/incidents/[id]/triage/route.ts
+++ b/app/api/incidents/[id]/triage/route.ts
@@ -24,7 +24,7 @@ export async function PATCH(
 
   const { data: profile } = await supabase
     .from('users').select('role').eq('id', user.id).single()
-  if (!profile || profile.role !== 'hse')
+  if (!profile || !['hse', 'admin'].includes(profile.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
   const body: TriageBody = await request.json()