diff --git a/packages/api/src/routers/svc/text_to_speech.ts b/packages/api/src/routers/svc/text_to_speech.ts
index 61098e86f..b7ec7ac1f 100644
--- a/packages/api/src/routers/svc/text_to_speech.ts
+++ b/packages/api/src/routers/svc/text_to_speech.ts
@@ -4,13 +4,14 @@
 import express from 'express'
 import cors from 'cors'
 import { corsConfig } from '../../utils/corsConfig'
-import { getRepository } from '../../entity/utils'
+import { getRepository, setClaims } from '../../entity/utils'
 import { getPageById } from '../../elastic/pages'
 import { Speech, SpeechState } from '../../entity/speech'
 import { buildLogger } from '../../utils/logger'
 import { getClaimsByToken } from '../../utils/auth'
 import { shouldSynthesize, synthesize } from '../../services/speech'
 import { readPushSubscription } from '../../datalayer/pubsub'
+import { AppDataSource } from '../../server'
 
 const logger = buildLogger('app.dispatch')
 
@@ -93,20 +94,25 @@ export function speechServiceRouter() {
       return res.status(401).send('UNAUTHORIZED')
     }
 
-    const { speechId, audioFileName, speechMarksFileName } = req.body as {
-      speechId: string
-      audioFileName: string
-      speechMarksFileName: string
-    }
-    if (!speechId || !audioFileName || !speechMarksFileName) {
+    const { speechId, audioFileName, speechMarksFileName, state } =
+      req.body as {
+        speechId: string
+        audioFileName: string
+        speechMarksFileName: string
+        state: SpeechState
+      }
+    if (!speechId) {
       return res.status(400).send('Invalid data')
     }
 
     // set state to completed
-    await getRepository(Speech).update(speechId, {
-      audioFileName: audioFileName,
-      speechMarksFileName: speechMarksFileName,
-      state: SpeechState.COMPLETED,
+    await AppDataSource.transaction(async (t) => {
+      await setClaims(t, userId)
+      await t.getRepository(Speech).update(speechId, {
+        audioFileName: audioFileName,
+        speechMarksFileName: speechMarksFileName,
+        state,
+      })
     })
 
     res.send('OK')
diff --git a/packages/db/migrations/0095.do.add_rls_to_speech.sql b/packages/db/migrations/0095.do.add_rls_to_speech.sql
new file mode 100755
index 000000000..9408ef84e
--- /dev/null
+++ b/packages/db/migrations/0095.do.add_rls_to_speech.sql
@@ -0,0 +1,11 @@
+-- Type: DO
+-- Name: add_rls_to_speech
+-- Description: Add Row level security to speech table
+
+BEGIN;
+
+CREATE POLICY update_speech on omnivore.speech
+    FOR UPDATE TO omnivore_user
+    USING (user_id = omnivore.get_current_user_id());
+
+COMMIT;
diff --git a/packages/db/migrations/0095.undo.add_rls_to_speech.sql b/packages/db/migrations/0095.undo.add_rls_to_speech.sql
new file mode 100755
index 000000000..e81f2dbfc
--- /dev/null
+++ b/packages/db/migrations/0095.undo.add_rls_to_speech.sql
@@ -0,0 +1,9 @@
+-- Type: UNDO
+-- Name: add_rls_to_speech
+-- Description: Add Row level security to speech table
+
+BEGIN;
+
+DROP POLICY IF EXISTS update_speech ON omnivore.speech;
+
+COMMIT;