diff --git a/karapace/schema_registry_apis.py b/karapace/schema_registry_apis.py
index 6ad39a4c2..0ba18f5cd 100644
--- a/karapace/schema_registry_apis.py
+++ b/karapace/schema_registry_apis.py
@@ -291,6 +291,7 @@ def _add_schema_registry_routes(self) -> None:
             callback=self.subject_version_referencedby_get,
             method="GET",
             schema_request=True,
+            auth=self._auth,
         )
         self.route(
             "/subjects/<subject:path>",
diff --git a/tests/integration/test_schema_registry_auth.py b/tests/integration/test_schema_registry_auth.py
index ce260f194..7706596b4 100644
--- a/tests/integration/test_schema_registry_auth.py
+++ b/tests/integration/test_schema_registry_auth.py
@@ -94,6 +94,9 @@ async def test_sr_auth_endpoints(registry_async_client_auth: Client) -> None:
     res = await registry_async_client_auth.get(f"subjects/{quote(subject)}/versions/1/schema")
     assert res.status_code == 401
 
+    res = await registry_async_client_auth.get(f"subjects/{quote(subject)}/versions/1/referencedby")
+    assert res.status_code == 401
+
     res = await registry_async_client_auth.delete(f"subjects/{quote(subject)}")
     assert res.status_code == 401