diff --git a/src/main/java/com/l2/shots/auth/AuthResource.java b/src/main/java/com/l2/shots/auth/AuthResource.java
index 512b814..afec130 100644
--- a/src/main/java/com/l2/shots/auth/AuthResource.java
+++ b/src/main/java/com/l2/shots/auth/AuthResource.java
@@ -1,7 +1,5 @@
 package com.l2.shots.auth;
 
-import io.quarkus.security.Authenticated;
-import jakarta.annotation.security.RolesAllowed;
 import jakarta.inject.Inject;
 import jakarta.ws.rs.Consumes;
 import jakarta.ws.rs.GET;
@@ -19,6 +17,12 @@ import org.eclipse.microprofile.jwt.JsonWebToken;
 import java.util.Optional;
 import java.util.UUID;
 
+/**
+ * No usa @Authenticated / @RolesAllowed porque Quarkus security por defecto
+ * solo lee el JWT del header "Authorization: Bearer ...". Esta app entrega
+ * el JWT en una cookie HttpOnly, asi que la validacion la hacemos a mano
+ * via JwtCookieAuth en cada endpoint que requiere auth.
+ */
 @Path("/api/auth")
 @Produces(MediaType.APPLICATION_JSON)
 @Consumes(MediaType.APPLICATION_JSON)
@@ -30,9 +34,6 @@ public class AuthResource {
     @Inject
     JwtCookieAuth jwtCookieAuth;
 
-    @Inject
-    JsonWebToken currentJwt;
-
     @ConfigProperty(name = "app.auth.cookie-name")
     String cookieName;
 
@@ -81,7 +82,6 @@ public class AuthResource {
 
     @POST
     @Path("/change-password")
-    @Authenticated
     public Response changePassword(@Context HttpHeaders headers, ChangePasswordRequest body) {
         if (body == null || body.currentPassword() == null || body.newPassword() == null) {
             return Response.status(400).entity(new ErrorBody("Faltan campos requeridos")).build();
@@ -114,14 +114,16 @@ public class AuthResource {
 
     @POST
     @Path("/admin/reset-password")
-    @RolesAllowed("admin")
-    public Response adminResetPassword(AdminResetPasswordRequest body) {
+    public Response adminResetPassword(@Context HttpHeaders headers, AdminResetPasswordRequest body) {
         if (body == null || body.username() == null || body.newPassword() == null) {
             return Response.status(400).entity(new ErrorBody("Faltan campos requeridos")).build();
         }
+        Optional<JsonWebToken> jwt = jwtCookieAuth.extractToken(headers);
+        if (jwt.isEmpty()) return Response.status(401).build();
+        if (!jwt.get().getGroups().contains("admin")) return Response.status(403).build();
         UUID requesterId;
         try {
-            requesterId = UUID.fromString(currentJwt.getSubject());
+            requesterId = UUID.fromString(jwt.get().getSubject());
         } catch (Exception e) {
             return Response.status(401).build();
         }
@@ -146,15 +148,17 @@ public class AuthResource {
 
     @GET
     @Path("/admin/users")
-    @RolesAllowed("admin")
-    public Response adminListUsers() {
+    public Response adminListUsers(@Context HttpHeaders headers) {
+        Optional<JsonWebToken> jwt = jwtCookieAuth.extractToken(headers);
+        if (jwt.isEmpty()) return Response.status(401).build();
+        if (!jwt.get().getGroups().contains("admin")) return Response.status(403).build();
         return Response.ok(authService.listUsersForAdmin()).build();
     }
 
     @GET
     @Path("/check")
-    @Authenticated
-    public Response check() {
+    public Response check(@Context HttpHeaders headers) {
+        if (jwtCookieAuth.extractToken(headers).isEmpty()) return Response.status(401).build();
         return Response.ok().build();
     }