diff --git a/src/main.zig b/src/main.zig
index b396d1d..e59baff 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -387,6 +387,8 @@ fn handleRequestCrawl(request: *http.Server.Request, slurper: *slurper_mod.Slurp
 // --- admin host management ---
 
 fn handleAdminListHosts(request: *http.Server.Request, persist: *event_log_mod.DiskPersist, slurper: *slurper_mod.Slurper) void {
+    if (!checkAdmin(request)) return;
+
     const hosts = persist.listAllHosts(persist.allocator) catch {
         respondJson(request, .internal_server_error, "{\"error\":\"DatabaseError\",\"message\":\"query failed\"}");
         return;
@@ -399,9 +401,9 @@ fn handleAdminListHosts(request: *http.Server.Request, persist: *event_log_mod.D
         persist.allocator.free(hosts);
     }
 
-    var buf: [65536]u8 = undefined;
-    var fbs = std.io.fixedBufferStream(&buf);
-    const w = fbs.writer();
+    var list: std.ArrayListUnmanaged(u8) = .{};
+    defer list.deinit(persist.allocator);
+    const w = list.writer(persist.allocator);
 
     w.writeAll("{\"hosts\":[") catch return;
 
@@ -417,7 +419,7 @@ fn handleAdminListHosts(request: *http.Server.Request, persist: *event_log_mod.D
     }
 
     std.fmt.format(w, "],\"active_workers\":{d}}}", .{slurper.workerCount()}) catch return;
-    respondJson(request, .ok, fbs.getWritten());
+    respondJson(request, .ok, list.items);
 }
 
 fn handleAdminBlockHost(request: *http.Server.Request, persist: *event_log_mod.DiskPersist) void {