diff --git a/perms/reducers/mutation.js b/perms/reducers/mutation.js
index a49a901fa..8614bad96 100644
--- a/perms/reducers/mutation.js
+++ b/perms/reducers/mutation.js
@@ -22,17 +22,17 @@ module.exports = (user, perm) => {
   case types.REMOVE_COMMENT_TAG:
     return check(user, ['ADMIN', 'MODERATOR', 'STAFF']);
 
-  case types.UPDATE_USER_ROLES:
   case types.SET_COMMENT_STATUS:
   case types.SET_USER_USERNAME_STATUS:
   case types.SET_USER_BAN_STATUS:
   case types.SET_USER_SUSPENSION_STATUS:
-  case types.UPDATE_CONFIG:
-  case types.UPDATE_SETTINGS:
   case types.UPDATE_ASSET_SETTINGS:
   case types.UPDATE_ASSET_STATUS:
     return check(user, ['ADMIN', 'MODERATOR']);
 
+  case types.UPDATE_CONFIG:
+  case types.UPDATE_SETTINGS:
+  case types.UPDATE_USER_ROLES:
   case types.CREATE_TOKEN:
   case types.REVOKE_TOKEN:
     return check(user, ['ADMIN']);
diff --git a/test/server/graph/mutations/updateSettings.js b/test/server/graph/mutations/updateSettings.js
index c660ea169..3f7eac701 100644
--- a/test/server/graph/mutations/updateSettings.js
+++ b/test/server/graph/mutations/updateSettings.js
@@ -27,8 +27,8 @@ describe('graph.mutations.updateSettings', () => {
 
     [
       {error: 'NOT_AUTHORIZED', role: 'COMMENTER'},
+      {error: 'NOT_AUTHORIZED', role: 'MODERATOR'},
       {role: 'ADMIN'},
-      {role: 'MODERATOR'},
     ].forEach(({role, error}) => {
       it(`role = ${role}`, async () => {
         const user = new UserModel({role});