diff --git a/packages/server/src/api/routes/workflow.js b/packages/server/src/api/routes/workflow.js
index a5f78dccf1..38563f0976 100644
--- a/packages/server/src/api/routes/workflow.js
+++ b/packages/server/src/api/routes/workflow.js
@@ -1,7 +1,7 @@
 const Router = require("@koa/router")
 const controller = require("../controllers/workflow")
 const authorized = require("../../middleware/authorized")
-const { BUILDER } = require("../../utilities/accessLevels")
+const { BUILDER, EXECUTE_WORKFLOW } = require("../../utilities/accessLevels")
 
 const router = Router()
 
@@ -17,7 +17,7 @@ router
   .post("/api/:instanceId/workflows", authorized(BUILDER), controller.create)
   .post(
     "/api/:instanceId/workflows/action",
-    authorized(BUILDER),
+    authorized(EXECUTE_WORKFLOW),
     controller.executeAction
   )
   .delete(