diff --git a/goosebit/__init__.py b/goosebit/__init__.py
index b5a791cf..dfabea09 100644
--- a/goosebit/__init__.py
+++ b/goosebit/__init__.py
@@ -15,6 +15,7 @@
 
 from goosebit import api, db, plugins, ui, updater
 from goosebit.auth import get_user_from_request, login_user, redirect_if_authenticated
+from goosebit.auth.permissions import GOOSEBIT_PERMISSIONS
 from goosebit.device_manager import DeviceManager
 from goosebit.settings import PWD_CXT, config  # type: ignore[attr-defined]
 from goosebit.ui.nav import nav
@@ -83,6 +84,8 @@ async def lifespan(_: FastAPI) -> AsyncGenerator[None, None]:
         DeviceManager.add_update_source(plugin.update_source_hook)
     if plugin.config_data_hook is not None:
         DeviceManager.add_config_callback(plugin.config_data_hook)
+    if plugin.permissions is not None and GOOSEBIT_PERMISSIONS.sub_permissions is not None:
+        GOOSEBIT_PERMISSIONS.sub_permissions.append(plugin.permissions)
 
 
 # Custom exception handler for Tortoise ValidationError
diff --git a/goosebit/schema/plugins.py b/goosebit/schema/plugins.py
index 029e39ac..8bb49382 100644
--- a/goosebit/schema/plugins.py
+++ b/goosebit/schema/plugins.py
@@ -13,6 +13,7 @@
     YamlConfigSettingsSource,
 )
 
+from goosebit.auth.permissions import Permission
 from goosebit.db import Device  # type: ignore[attr-defined]
 from goosebit.device_manager import HandlingType
 from goosebit.schema.updates import UpdateChunk
@@ -40,6 +41,7 @@ class Config:
     templates: Jinja2Templates | None = None
     update_source_hook: Callable[[Request, Device], Awaitable[tuple[HandlingType, UpdateChunk | None]]] | None = None
     config_data_hook: Callable[[Device, dict[str, Any]], Awaitable[None]] | None = None
+    permissions: Permission | None = None
 
     @computed_field  # type: ignore[prop-decorator]
     @property