diff --git a/app/routes/calendar/$id/report-winners.tsx b/app/routes/calendar/$id/report-winners.tsx
index 574f836fb..55d86e500 100644
--- a/app/routes/calendar/$id/report-winners.tsx
+++ b/app/routes/calendar/$id/report-winners.tsx
@@ -96,6 +96,7 @@ const reportWinnersParamsSchema = z.object({
 });
 
 export const action: ActionFunction = async ({ request, params }) => {
+  const user = await requireUser(request);
   const parsedParams = reportWinnersParamsSchema.parse(params);
   const parsedInput = await safeParseRequestFormData({
     request,
@@ -108,6 +109,16 @@ export const action: ActionFunction = async ({ request, params }) => {
     };
   }
 
+  const event = notFoundIfFalsy(db.calendarEvents.findById(parsedParams.id));
+  validate(
+    canReportCalendarEventWinners({
+      user,
+      event,
+      startTimes: event.startTimes,
+    }),
+    401
+  );
+
   db.calendarEvents.upsertReportedScores({
     eventId: parsedParams.id,
     participantCount: parsedInput.data.participantCount,