diff --git a/src/KArtSell.Host/Features/Health/PingEndpoint.cs b/src/KArtSell.Host/Features/Health/PingEndpoint.cs
index d8521d38..a774145f 100644
--- a/src/KArtSell.Host/Features/Health/PingEndpoint.cs
+++ b/src/KArtSell.Host/Features/Health/PingEndpoint.cs
@@ -15,7 +15,7 @@ public class PingEndpoint : Endpoint<PingRequest, PingResponse>
     public override void Configure()
     {
         Get("/health/ping");
-        AllowAnonymous();
+        Roles("Admin", "Analyst", "System");  // Health checks require authentication
     }
 
     public override async Task HandleAsync(PingRequest req, CancellationToken ct)
diff --git a/src/KArtSell.Host/Features/Observability/GetMetricsEndpoint.cs b/src/KArtSell.Host/Features/Observability/GetMetricsEndpoint.cs
index c7da77c5..d52d580b 100644
--- a/src/KArtSell.Host/Features/Observability/GetMetricsEndpoint.cs
+++ b/src/KArtSell.Host/Features/Observability/GetMetricsEndpoint.cs
@@ -36,8 +36,7 @@ public class GetMetricsEndpoint : Endpoint<EmptyRequest, MetricsResponse>
     public override void Configure()
     {
         Get("/observability/metrics");
-        Roles("Admin", "Analyst");
-        AllowAnonymous();  // Override for demo; require auth in production
+        Roles("Admin", "Analyst", "Auditor");  // Financial compliance requires authentication
     }
 
     public override async Task HandleAsync(EmptyRequest req, CancellationToken ct)