diff --git a/app/routes/auth.py b/app/routes/auth.py
index d4cdff4..853c4c7 100644
--- a/app/routes/auth.py
+++ b/app/routes/auth.py
@@ -111,7 +111,7 @@ def profile():
 
 @bp.route('/users')
 @login_required
-@supervisor_required
+@admin_required
 def list_users():
     # Exclude customer accounts — those are managed exclusively via /customers
     users = (
@@ -127,7 +127,7 @@ def list_users():
 
 @bp.route('/users/new', methods=['GET', 'POST'])
 @login_required
-@supervisor_required
+@admin_required
 def create_user():
     form = UserForm()
 
@@ -159,7 +159,7 @@ def create_user():
 
 @bp.route('/users/<int:user_id>/edit', methods=['GET', 'POST'])
 @login_required
-@supervisor_required
+@admin_required
 def edit_user(user_id):
     user = db.session.get(User, user_id)
     if user is None:
@@ -196,7 +196,7 @@ def edit_user(user_id):
 
 @bp.route('/users/<int:user_id>/delete', methods=['POST'])
 @login_required
-@supervisor_required
+@admin_required
 def delete_user(user_id):
     user = db.session.get(User, user_id)
     if user is None:
@@ -256,7 +256,7 @@ def delete_user(user_id):
 
 @bp.route('/users/<int:user_id>/toggle-active', methods=['POST'])
 @login_required
-@supervisor_required
+@admin_required
 def toggle_active(user_id):
     user = db.session.get(User, user_id)
     if user is None:
diff --git a/app/routes/scheduled_reports.py b/app/routes/scheduled_reports.py
index 63649e3..6b3b371 100644
--- a/app/routes/scheduled_reports.py
+++ b/app/routes/scheduled_reports.py
@@ -38,7 +38,7 @@ from app.models.inspection import Inspection, InspectionTemplate
 from app.models.facility import Facility, Area
 from app.models.issue import Issue
 from app.models.user import User
-from app.utils.decorators import supervisor_required
+from app.utils.decorators import supervisor_required, admin_required
 from app.utils.audit import log_action, ACTION_CREATE, ACTION_UPDATE, ACTION_DELETE
 from app.utils.time_utils import now_eastern
 
@@ -276,7 +276,7 @@ def _send_report(report: ScheduledReport):
 
 @bp.route('/')
 @login_required
-@supervisor_required
+@admin_required
 def index():
     reports = ScheduledReport.query.order_by(ScheduledReport.name).all()
     return render_template('scheduled_reports/index.html', reports=reports)
@@ -284,7 +284,7 @@ def index():
 
 @bp.route('/new', methods=['GET', 'POST'])
 @login_required
-@supervisor_required
+@admin_required
 def create():
     facilities = Facility.query.filter_by(active=True).order_by(Facility.name).all()
 
@@ -332,7 +332,7 @@ def create():
 
 @bp.route('/<int:report_id>/edit', methods=['GET', 'POST'])
 @login_required
-@supervisor_required
+@admin_required
 def edit(report_id):
     report = db.session.get(ScheduledReport, report_id)
     if report is None:
@@ -362,7 +362,7 @@ def edit(report_id):
 
 @bp.route('/<int:report_id>/delete', methods=['POST'])
 @login_required
-@supervisor_required
+@admin_required
 def delete(report_id):
     report = db.session.get(ScheduledReport, report_id)
     if report is None:
@@ -378,7 +378,7 @@ def delete(report_id):
 
 @bp.route('/<int:report_id>/preview')
 @login_required
-@supervisor_required
+@admin_required
 def preview(report_id):
     """Render the scheduled report email in-browser for review."""
     report = db.session.get(ScheduledReport, report_id)
@@ -399,7 +399,7 @@ def preview(report_id):
 
 @bp.route('/<int:report_id>/preview-pdf')
 @login_required
-@supervisor_required
+@admin_required
 def preview_pdf(report_id):
     """Generate and stream the PDF attachment for in-browser review."""
     from flask import Response
@@ -436,7 +436,7 @@ def preview_pdf(report_id):
 
 @bp.route('/<int:report_id>/send-now', methods=['POST'])
 @login_required
-@supervisor_required
+@admin_required
 def send_now(report_id):
     """Manually trigger a single report — useful for testing."""
     report = db.session.get(ScheduledReport, report_id)
diff --git a/app/templates/base.html b/app/templates/base.html
index 4cd05b9..5dff644 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -133,7 +133,7 @@
                     <li class="nav-item">
                         <a class="nav-link {{ 'active' if request.endpoint and request.endpoint.startswith('reports.') }}" href="{{ url_for('reports.index') }}">Reports</a>
                     </li>
-                    {% if current_user.role in ['admin', 'director'] %}
+                    {% if current_user.role == 'admin' %}
                     <li class="nav-item">
                         <a class="nav-link {{ 'active' if request.endpoint and request.endpoint.startswith('scheduled_reports.') }}" href="{{ url_for('scheduled_reports.index') }}">Scheduled Reports</a>
                     </li>
@@ -155,10 +155,12 @@
                         </a>
                     </li>
                     {% endif %}
-                    {% if current_user.role in ['admin', 'director'] %}
+                    {% if current_user.role == 'admin' %}
                     <li class="nav-item">
                         <a class="nav-link {{ 'active' if request.endpoint and request.endpoint.startswith('auth.') and 'user' in request.endpoint }}" href="{{ url_for('auth.list_users') }}">Users</a>
                     </li>
+                    {% endif %}
+                    {% if current_user.role in ['admin', 'director'] %}
                     <li class="nav-item">
                         <a class="nav-link {{ 'active' if request.endpoint and request.endpoint.startswith('customers.') }}" href="{{ url_for('customers.index') }}">Customers</a>
                     </li>