diff --git a/data/etc/apache2/conf-available/ikiwiki-plinth.conf b/data/etc/apache2/conf-available/ikiwiki-plinth.conf
index 5127ce162..a1fda86d6 100644
--- a/data/etc/apache2/conf-available/ikiwiki-plinth.conf
+++ b/data/etc/apache2/conf-available/ikiwiki-plinth.conf
@@ -13,5 +13,6 @@ AddHandler cgi-script .cgi
     AuthName "login required"
     AuthBasicProvider ldap
     AuthLDAPURL "ldap:///ou=users,dc=thisbox?uid"
-    Require valid-user
+    Require ldap-group cn=admin,ou=groups,dc=thisbox
+    Require ldap-group cn=wiki,ou=groups,dc=thisbox
 </Location>