diff --git a/internal/api/api.go b/internal/api/api.go
index ba30a1f..c6979c6 100644
--- a/internal/api/api.go
+++ b/internal/api/api.go
@@ -332,7 +332,7 @@ func (s *Server) clusterDeviceNames() []string {
 }
 
 func (s *Server) Panel(password string) http.Handler {
-	p := panelweb.New(password, s)
+	p := panelweb.New(password, s.AdminToken, s)
 	go p.Cleanup()
 	return p.Handler()
 }
diff --git a/internal/web/panel.go b/internal/web/panel.go
index b702de3..c2818fd 100644
--- a/internal/web/panel.go
+++ b/internal/web/panel.go
@@ -24,14 +24,15 @@ type Runner interface {
 }
 
 type Panel struct {
-	Password string
-	Runner   Runner
-	mu       sync.RWMutex
-	sessions map[string]time.Time
+	Password   string
+	AdminToken string
+	Runner     Runner
+	mu         sync.RWMutex
+	sessions   map[string]time.Time
 }
 
-func New(password string, runner Runner) *Panel {
-	return &Panel{Password: password, Runner: runner, sessions: make(map[string]time.Time)}
+func New(password, adminToken string, runner Runner) *Panel {
+	return &Panel{Password: password, AdminToken: adminToken, Runner: runner, sessions: make(map[string]time.Time)}
 }
 
 func (p *Panel) Handler() http.Handler {
@@ -110,6 +111,9 @@ func (p *Panel) securitySettings(w http.ResponseWriter, r *http.Request) {
 	http.Error(w, "security API unavailable", 501)
 }
 func (p *Panel) updateSecuritySettings(w http.ResponseWriter, r *http.Request) {
+	if p.AdminToken != "" {
+		r.Header.Set("X-Admin-Token", p.AdminToken)
+	}
 	if v, ok := p.Runner.(securityPanelRunner); ok {
 		v.UpdateSecuritySettingsJSON(w, r)
 		return
diff --git a/internal/web/panel_test.go b/internal/web/panel_test.go
index 2fa1075..9068adc 100644
--- a/internal/web/panel_test.go
+++ b/internal/web/panel_test.go
@@ -16,7 +16,7 @@ func (testRunner) RotateAPIKey(w http.ResponseWriter, r *http.Request) {}
 func (testRunner) DeleteDevice(w http.ResponseWriter, r *http.Request) {}
 
 func TestStaticCSSContentType(t *testing.T) {
-	p := New("test-password", testRunner{})
+	p := New("test-password", "admin", testRunner{})
 	req := httptest.NewRequest("GET", "/static/app.css", nil)
 	rec := httptest.NewRecorder()