diff --git a/src/lib/Hydra/Controller/Jobset.pm b/src/lib/Hydra/Controller/Jobset.pm
index 4d6db815..477cb111 100644
--- a/src/lib/Hydra/Controller/Jobset.pm
+++ b/src/lib/Hydra/Controller/Jobset.pm
@@ -219,6 +219,7 @@ sub submit : Chained('jobsetChain') PathPart Args(0) {
     my ($self, $c) = @_;
 
     requirePost($c);
+    requireProjectOwner($c, $c->stash->{project});
 
     if (($c->request->params->{submit} // "") eq "delete") {
         txn_do($c->model('DB')->schema, sub {
diff --git a/src/lib/Hydra/Controller/Project.pm b/src/lib/Hydra/Controller/Project.pm
index 4952fddb..bf9f4451 100644
--- a/src/lib/Hydra/Controller/Project.pm
+++ b/src/lib/Hydra/Controller/Project.pm
@@ -143,6 +143,8 @@ sub submit : Chained('projectChain') PathPart Args(0) {
     my ($self, $c) = @_;
 
     requirePost($c);
+    requireProjectOwner($c, $c->stash->{project});
+
     if (($c->request->params->{submit} // "") eq "delete") {
         txn_do($c->model('DB')->schema, sub {
             $c->stash->{project}->jobsetevals->delete_all;