diff --git a/admin/reindexer-1.0.groovy b/admin/reindexer-1.0.groovy
index 5c32773..c3cc673 100644
--- a/admin/reindexer-1.0.groovy
+++ b/admin/reindexer-1.0.groovy
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import com.google.gerrit.common.data.GlobalCapability
 import com.google.gerrit.sshd.*
 import com.google.gerrit.extensions.annotations.*
 import com.google.gerrit.lucene.*
@@ -20,6 +21,7 @@
 
 @Export("start")
 @CommandMetaData(name = "start", description = "Start a new on-line re-indexing for a target Lucene index version")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class StartReindex extends SshCommand {
 
   @Inject OnlineReindexer.Factory reindexerFactory
diff --git a/admin/warm-cache-1.0.groovy b/admin/warm-cache-1.0.groovy
index dae00dd..5ba12c2 100644
--- a/admin/warm-cache-1.0.groovy
+++ b/admin/warm-cache-1.0.groovy
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+import com.google.gerrit.common.data.GlobalCapability
 import com.google.gerrit.sshd.*
 import com.google.gerrit.extensions.annotations.*
 import com.google.gerrit.server.project.*
@@ -32,6 +33,7 @@
 
 @Export("projects")
 @CommandMetaData(description = "Warm-up project_list and projects caches")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmProjectsCache extends BaseSshCommand {
 
   @Inject
@@ -61,6 +63,7 @@
 }
 
 @Export("groups")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmGroupsCache extends WarmProjectsCache {
 
   @Inject
@@ -107,6 +110,7 @@
 }
 
 @Export("accounts")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmAccountsCache extends BaseSshCommand {
 
   @Inject
@@ -141,6 +145,7 @@
 }
 
 @Export("groups-backends")
+@RequiresCapability(GlobalCapability.ADMINISTRATE_SERVER)
 class WarmGroupsBackendsCache extends WarmAccountsCache {
 
   @Inject