diff --git a/src/main/java/com/googlesource/gerrit/plugins/labelui/GetPreferences.java b/src/main/java/com/googlesource/gerrit/plugins/labelui/GetPreferences.java
index b1fd600..e2a582a 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/labelui/GetPreferences.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/labelui/GetPreferences.java
@@ -23,6 +23,9 @@
 import com.google.gerrit.server.account.VersionedAccountPreferences;
 import com.google.gerrit.server.config.AllUsersName;
 import com.google.gerrit.server.git.GitRepositoryManager;
+import com.google.gerrit.server.permissions.GlobalPermission;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 import com.google.inject.Singleton;
@@ -38,24 +41,26 @@
   private final Provider<CurrentUser> self;
   private final AllUsersName allUsersName;
   private final GitRepositoryManager gitMgr;
+  private final PermissionBackend permissionBackend;
 
   @Inject
   public GetPreferences(@PluginName String pluginName,
       Provider<CurrentUser> self,
       AllUsersName allUsersName,
-      GitRepositoryManager gitMgr) {
+      GitRepositoryManager gitMgr,
+      PermissionBackend permissionBackend) {
     this.pluginName = pluginName;
     this.self = self;
     this.allUsersName = allUsersName;
     this.gitMgr = gitMgr;
+    this.permissionBackend = permissionBackend;
   }
 
   @Override
   public PreferencesInfo apply(AccountResource rsrc) throws AuthException,
-      ResourceNotFoundException, IOException, ConfigInvalidException {
-    if (self.get() != rsrc.getUser()
-        && !self.get().getCapabilities().canModifyAccount()) {
-      throw new AuthException("not allowed to get preferences");
+      ResourceNotFoundException, IOException, ConfigInvalidException, PermissionBackendException {
+    if (self.get() != rsrc.getUser()) {
+      permissionBackend.user(self).check(GlobalPermission.MODIFY_ACCOUNT);
     }
 
     try (Repository git = gitMgr.openRepository(allUsersName)) {
diff --git a/src/main/java/com/googlesource/gerrit/plugins/labelui/SetPreferences.java b/src/main/java/com/googlesource/gerrit/plugins/labelui/SetPreferences.java
index 3cbc264..ca53199 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/labelui/SetPreferences.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/labelui/SetPreferences.java
@@ -22,6 +22,9 @@
 import com.google.gerrit.server.account.VersionedAccountPreferences;
 import com.google.gerrit.server.config.AllUsersName;
 import com.google.gerrit.server.git.MetaDataUpdate;
+import com.google.gerrit.server.permissions.GlobalPermission;
+import com.google.gerrit.server.permissions.PermissionBackend;
+import com.google.gerrit.server.permissions.PermissionBackendException;
 import com.google.inject.Inject;
 import com.google.inject.Provider;
 
@@ -42,25 +45,27 @@
   private final Provider<CurrentUser> self;
   private final AllUsersName allUsersName;
   private final Provider<MetaDataUpdate.User> metaDataUpdateFactory;
+  private final PermissionBackend permissionBackend;
 
   @Inject
   public SetPreferences(@PluginName String pluginName,
       Provider<CurrentUser> self,
       AllUsersName allUsersName,
-      Provider<MetaDataUpdate.User> metaDataUpdateFactory) {
+      Provider<MetaDataUpdate.User> metaDataUpdateFactory,
+      PermissionBackend permissionBackend) {
     this.pluginName = pluginName;
     this.self = self;
     this.allUsersName = allUsersName;
     this.metaDataUpdateFactory = metaDataUpdateFactory;
+    this.permissionBackend = permissionBackend;
   }
 
   @Override
   public GetPreferences.PreferencesInfo apply(AccountResource rsrc, Input input)
       throws AuthException, RepositoryNotFoundException, IOException,
-      ConfigInvalidException {
-    if (self.get() != rsrc.getUser()
-        && !self.get().getCapabilities().canModifyAccount()) {
-      throw new AuthException("not allowed to set preferences");
+      ConfigInvalidException, PermissionBackendException {
+    if (self.get() != rsrc.getUser()) {
+      permissionBackend.user(self).check(GlobalPermission.MODIFY_ACCOUNT);
     }
 
     if (input == null) {