diff --git a/cogs/calendar.py b/cogs/calendar.py
index 0288bdb..3709731 100644
--- a/cogs/calendar.py
+++ b/cogs/calendar.py
@@ -1,12 +1,12 @@
 """Calendar cog — modal-based booking, Firestore Admin SDK."""
 ######################################################################
 import logging
+import os
 import re
 from datetime import datetime, timezone, timedelta
 
 import discord
 from discord.ext import commands
-from google.cloud.firestore import AsyncClient
 
 from firebase_website import get_db
 from .calendar_data import COUNTRY_TZ
@@ -141,19 +141,30 @@ class BookButton(discord.ui.View):
 
 
 class Calendar(commands.Cog):
-    """Book events via a popup form."""
+    """Book events via a popup form — restricted to authorized users."""
 
     def __init__(self, bot: commands.Bot) -> None:
         self.bot = bot
+        raw = os.getenv("CALENDAR_USERS", "")
+        self._allowed: set[int] = {
+            int(uid.strip()) for uid in raw.split(",") if uid.strip()
+        }
+
+    def _check(self, user_id: int) -> bool:
+        return user_id in self._allowed
 
     @commands.command(name="book")
     async def book_cmd(self, ctx: commands.Context) -> None:
         """Send a button that opens the booking form."""
+        if not self._check(ctx.author.id):
+            return await ctx.reply("You are not a maomao member.", delete_after=5)
         await ctx.reply("Click below to book an event:", view=BookButton())
 
     @commands.command(name="unbook")
     async def unbook_cmd(self, ctx: commands.Context, date: str = "", *, title: str = "") -> None:
         """Remove an event. Usage: !unbook DD-MM-YYYY Title"""
+        if not self._check(ctx.author.id):
+            return await ctx.reply("You don't have access to the calendar.", delete_after=5)
         if not DATE_RE.match(date) or not title.strip():
             return await ctx.reply("Usage: `!unbook 20-07-2026 Demo Review`")
 
diff --git a/credentials_test.env b/credentials_test.env
index 07490b9..74aced0 100644
--- a/credentials_test.env
+++ b/credentials_test.env
@@ -25,6 +25,9 @@ DEEPSEEK_API=lol you thought
 # firebase service account (for Admin SDK)
 GOOGLE_APPLICATION_CREDENTIALS="/home/esef/discordbot/firebase-service-account.json"
 
+# users allowed to use !book / !unbook (comma-separated Discord user IDs)
+CALENDAR_USERS="id1,id2,id3"
+
 #mis ids member speicific stuff
 MELLO=""
 FEROX=""
diff --git a/firebase_service_account_test.json b/firebase_service_account_test.json
index 665892d..f637fc0 100644
--- a/firebase_service_account_test.json
+++ b/firebase_service_account_test.json
@@ -1 +1 @@
-this is what u get from google lol
\ No newline at end of file
+"this is what u get from google lol"
\ No newline at end of file