diff --git a/apps/api/src/config/graphql-complexity.plugin.ts b/apps/api/src/config/graphql-complexity.plugin.ts
index 9f92a6b..da505af 100644
--- a/apps/api/src/config/graphql-complexity.plugin.ts
+++ b/apps/api/src/config/graphql-complexity.plugin.ts
@@ -55,11 +55,17 @@ export class GraphQLComplexityPlugin implements ApolloServerPlugin {
   > {
     return {
       async didResolveOperation({ request, document, schema, contextValue }) {
-        if (
-          process.env["NODE_ENV"] !== "production" &&
-          isIntrospectionOnly(document)
-        ) {
-          return;
+        if (isIntrospectionOnly(document)) {
+          const isDev = process.env["NODE_ENV"] !== "production";
+          const isAdmin =
+            contextValue.req?.authContext?.role === UserRole.ADMIN;
+          if (isDev || isAdmin) {
+            return;
+          }
+          throw new GraphQLError(
+            "Introspection is restricted to admin users in production.",
+            { extensions: { code: "INTROSPECTION_FORBIDDEN" } },
+          );
         }
         const complexity = getComplexity({
           schema,
diff --git a/apps/api/src/modules/app.module.ts b/apps/api/src/modules/app.module.ts
index a481244..f20eac5 100644
--- a/apps/api/src/modules/app.module.ts
+++ b/apps/api/src/modules/app.module.ts
@@ -96,7 +96,7 @@ import { VacancyModule } from "./vacancies/vacancy.module";
           ? true
           : join(__dirname, "../../schema.gql"),
       sortSchema: true,
-      introspection: process.env["NODE_ENV"] !== "production",
+      introspection: true,
       context: ({ req, res }: { req: Request; res: Response }) => ({
         req,
         res,