diff --git a/apps/files_external/lib/Controller/GlobalStoragesController.php b/apps/files_external/lib/Controller/GlobalStoragesController.php
index cb785695647f4..e2dc9322c4a5e 100644
--- a/apps/files_external/lib/Controller/GlobalStoragesController.php
+++ b/apps/files_external/lib/Controller/GlobalStoragesController.php
@@ -30,6 +30,7 @@
 use OCA\Files_External\NotFoundException;
 use OCA\Files_External\Service\GlobalStoragesService;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\IConfig;
 use OCP\IGroupManager;
@@ -90,6 +91,7 @@ public function __construct(
 	 *
 	 * @return DataResponse
 	 */
+	#[PasswordConfirmationRequired]
 	public function create(
 		$mountPoint,
 		$backend,
@@ -155,6 +157,7 @@ public function create(
 	 *
 	 * @return DataResponse
 	 */
+	#[PasswordConfirmationRequired]
 	public function update(
 		$id,
 		$mountPoint,
diff --git a/apps/files_external/lib/Controller/StoragesController.php b/apps/files_external/lib/Controller/StoragesController.php
index 229e2d1930e75..34ff9682ee6e0 100644
--- a/apps/files_external/lib/Controller/StoragesController.php
+++ b/apps/files_external/lib/Controller/StoragesController.php
@@ -36,6 +36,7 @@
 use OCA\Files_External\Service\StoragesService;
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
+use OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired;
 use OCP\AppFramework\Http\DataResponse;
 use OCP\Files\StorageNotAvailableException;
 use OCP\IConfig;
@@ -322,6 +323,7 @@ public function show($id, $testOnly = true) {
 	 *
 	 * @return DataResponse
 	 */
+	#[PasswordConfirmationRequired]
 	public function destroy($id) {
 		try {
 			$this->service->removeStorage($id);