diff --git a/Moonlight.ApiServer/Http/Controllers/Admin/Users/UsersController.cs b/Moonlight.ApiServer/Http/Controllers/Admin/Users/UsersController.cs
index 9d02396d..d583a5f0 100644
--- a/Moonlight.ApiServer/Http/Controllers/Admin/Users/UsersController.cs
+++ b/Moonlight.ApiServer/Http/Controllers/Admin/Users/UsersController.cs
@@ -44,7 +44,8 @@ public class UsersController : Controller
             {
                 Id = x.Id,
                 Email = x.Email,
-                Username = x.Username
+                Username = x.Username,
+                PermissionsJson = x.PermissionsJson
             })
             .ToArray();
 
@@ -73,7 +74,8 @@ public class UsersController : Controller
         {
             Id = user.Id,
             Email = user.Email,
-            Username = user.Username
+            Username = user.Username,
+            PermissionsJson = user.PermissionsJson
         };
     }
 
@@ -108,7 +110,8 @@ public class UsersController : Controller
         {
             Id = finalUser.Id,
             Email = finalUser.Email,
-            Username = finalUser.Username
+            Username = finalUser.Username,
+            PermissionsJson = finalUser.PermissionsJson
         };
     }
 
@@ -138,12 +141,17 @@ public class UsersController : Controller
         if (!string.IsNullOrEmpty(request.Password))
         {
             user.Password = HashHelper.Hash(request.Password);
-            user.TokenValidTimestamp = DateTime.UtcNow; // This change will get applied by the crud helper
+            user.TokenValidTimestamp = DateTime.UtcNow; // Log out user after password change
+        }
+
+        if (user.PermissionsJson != request.PermissionsJson)
+        {
+            user.PermissionsJson = request.PermissionsJson;
+            user.TokenValidTimestamp = DateTime.UtcNow; // Log out user after permission change
         }
 
         user.Email = request.Email;
         user.Username = request.Username;
-        // TODO: Add permissions update here
 
         await UserRepository.Update(user);
 
@@ -151,7 +159,8 @@ public class UsersController : Controller
         {
             Id = user.Id,
             Email = user.Email,
-            Username = user.Username
+            Username = user.Username,
+            PermissionsJson = user.PermissionsJson
         };
     }
 
diff --git a/Moonlight.Client/UI/Views/Admin/Users/Update.razor b/Moonlight.Client/UI/Views/Admin/Users/Update.razor
index bd4ef88a..eed54284 100644
--- a/Moonlight.Client/UI/Views/Admin/Users/Update.razor
+++ b/Moonlight.Client/UI/Views/Admin/Users/Update.razor
@@ -35,6 +35,12 @@
                         <input @bind="Request.Email" type="email" autocomplete="off" class="form-input w-full">
                     </div>
                 </div>
+                <div class="sm:col-span-2">
+                    <label class="block text-sm font-medium leading-6 text-white">Permissions</label>
+                    <div class="mt-2">
+                        <input @bind="Request.PermissionsJson" type="text" autocomplete="off" class="form-input w-full">
+                    </div>
+                </div>
                 <div class="sm:col-span-2">
                     <label class="block text-sm font-medium leading-6 text-white">Password</label>
                     <div class="mt-2">
@@ -56,7 +62,13 @@
     private async Task Load(LazyLoader _)
     {
         var detail = await ApiClient.GetJson<UserResponse>($"api/admin/users/{Id}");
-        Request = Mapper.Map<UpdateUserRequest>(detail);
+
+        Request = new()
+        {
+            Email = detail.Email,
+            PermissionsJson = detail.PermissionsJson,
+            Username = detail.Username
+        };
     }
 
     private async Task OnSubmit()
diff --git a/Moonlight.Shared/Http/Requests/Admin/Users/UpdateUserRequest.cs b/Moonlight.Shared/Http/Requests/Admin/Users/UpdateUserRequest.cs
index 9dd2d4b1..99b506e9 100644
--- a/Moonlight.Shared/Http/Requests/Admin/Users/UpdateUserRequest.cs
+++ b/Moonlight.Shared/Http/Requests/Admin/Users/UpdateUserRequest.cs
@@ -13,4 +13,7 @@ public class UpdateUserRequest
     public string Username { get; set; }
     
     public string? Password { get; set; }
+    
+    [Required(ErrorMessage = "You need to provide permissions")]
+    public string PermissionsJson { get; set; } = "[]";
 }
\ No newline at end of file
diff --git a/Moonlight.Shared/Http/Responses/Admin/Users/UserResponse.cs b/Moonlight.Shared/Http/Responses/Admin/Users/UserResponse.cs
index 12cd0e2d..60b0964e 100644
--- a/Moonlight.Shared/Http/Responses/Admin/Users/UserResponse.cs
+++ b/Moonlight.Shared/Http/Responses/Admin/Users/UserResponse.cs
@@ -5,4 +5,5 @@ public class UserResponse
     public int Id { get; set; }
     public string Username { get; set; }
     public string Email { get; set; }
+    public string PermissionsJson { get; set; }
 }
\ No newline at end of file