diff --git a/src/CitadelMinter.sol b/src/CitadelMinter.sol
index aa05bde..cc6a399 100644
--- a/src/CitadelMinter.sol
+++ b/src/CitadelMinter.sol
@@ -31,6 +31,8 @@ contract CitadelMinter is
         keccak256("CONTRACT_GOVERNANCE_ROLE");
     bytes32 public constant POLICY_OPERATIONS_ROLE =
         keccak256("POLICY_OPERATIONS_ROLE");
+    bytes32 public constant HIGHSEC_KEEPER_ROLE =
+        keccak256("HIGHSEC_KEEPER_ROLE");
 
     bytes32 public constant XCITADEL_LOCKER_EMISSIONS = keccak256("xcitadel-locker-emissions");
 
@@ -170,7 +172,7 @@ contract CitadelMinter is
      */
     function mintAndDistribute()
         external
-        onlyRole(POLICY_OPERATIONS_ROLE)
+        onlyRole(HIGHSEC_KEEPER_ROLE)
         gacPausable
         nonReentrant
     {
diff --git a/src/GlobalAccessControl.sol b/src/GlobalAccessControl.sol
index 05e7891..022adb7 100644
--- a/src/GlobalAccessControl.sol
+++ b/src/GlobalAccessControl.sol
@@ -35,6 +35,7 @@ contract GlobalAccessControl is
         keccak256("TREASURY_OPERATIONS_ROLE");
 
     bytes32 public constant KEEPER_ROLE = keccak256("KEEPER_ROLE");
+    bytes32 public constant HIGHSEC_KEEPER_ROLE = keccak256("HIGHSEC_KEEPER_ROLE");
 
     bytes32 public constant PAUSER_ROLE = keccak256("PAUSER_ROLE");
     bytes32 public constant UNPAUSER_ROLE = keccak256("UNPAUSER_ROLE");
@@ -73,6 +74,7 @@ contract GlobalAccessControl is
         _setRoleAdmin(POLICY_OPERATIONS_ROLE, CONTRACT_GOVERNANCE_ROLE);
         _setRoleAdmin(TREASURY_OPERATIONS_ROLE, CONTRACT_GOVERNANCE_ROLE);
         _setRoleAdmin(KEEPER_ROLE, CONTRACT_GOVERNANCE_ROLE);
+        _setRoleAdmin(HIGHSEC_KEEPER_ROLE, CONTRACT_GOVERNANCE_ROLE);
         _setRoleAdmin(PAUSER_ROLE, CONTRACT_GOVERNANCE_ROLE);
         _setRoleAdmin(UNPAUSER_ROLE, CONTRACT_GOVERNANCE_ROLE);
         _setRoleAdmin(BLOCKLIST_MANAGER_ROLE, CONTRACT_GOVERNANCE_ROLE);
diff --git a/src/test/BaseFixture.sol b/src/test/BaseFixture.sol
index 4ba0dd6..4d9c837 100644
--- a/src/test/BaseFixture.sol
+++ b/src/test/BaseFixture.sol
@@ -49,6 +49,9 @@ contract BaseFixture is DSTest, Utils, stdCheats {
     bytes32 public constant PAUSER_ROLE = keccak256("PAUSER_ROLE");
     bytes32 public constant UNPAUSER_ROLE = keccak256("UNPAUSER_ROLE");
 
+    bytes32 public constant KEEPER_ROLE = keccak256("KEEPER_ROLE");
+    bytes32 public constant HIGHSEC_KEEPER_ROLE = keccak256("HIGHSEC_KEEPER_ROLE");
+
     bytes32 public constant BLOCKLIST_MANAGER_ROLE =
         keccak256("BLOCKLIST_MANAGER_ROLE");
     bytes32 public constant BLOCKLISTED_ROLE = keccak256("BLOCKLISTED_ROLE");
@@ -67,6 +70,7 @@ contract BaseFixture is DSTest, Utils, stdCheats {
     address immutable policyOps = getAddress("policyOps");
     address immutable guardian = getAddress("guardian");
     address immutable keeper = getAddress("keeper");
+    address immutable highsecKeeper = getAddress("highsecKeeper");
     address immutable treasuryVault = getAddress("treasuryVault");
     address immutable treasuryOps = getAddress("treasuryOps");
 
@@ -130,6 +134,7 @@ contract BaseFixture is DSTest, Utils, stdCheats {
         vm.label(governance, "governance");
         vm.label(policyOps, "policyOps");
         vm.label(keeper, "keeper");
+        vm.label(highsecKeeper, "highsecKeeper");
         vm.label(guardian, "guardian");
         vm.label(treasuryVault, "treasuryVault");
 
@@ -286,6 +291,10 @@ contract BaseFixture is DSTest, Utils, stdCheats {
 
         gac.grantRole(PAUSER_ROLE, guardian);
         gac.grantRole(UNPAUSER_ROLE, techOps);
+
+        gac.grantRole(KEEPER_ROLE, keeper);
+        gac.grantRole(HIGHSEC_KEEPER_ROLE, highsecKeeper);
+
         vm.stopPrank();
 
         // Deposit initial assets to users