diff --git a/src/middleware.ts b/src/middleware.ts
new file mode 100644
index 0000000..90885ea
--- /dev/null
+++ b/src/middleware.ts
@@ -0,0 +1,27 @@
+import { withAuth } from 'next-auth/middleware'
+import { NextResponse } from 'next/server'
+
+export default withAuth(
+  function middleware(req) {
+    const { token } = req.nextauth
+    const { pathname } = req.nextUrl
+
+    // Seuls les admins accèdent à /parametres
+    if (pathname.startsWith('/parametres') && token?.role !== 'admin') {
+      return NextResponse.redirect(new URL('/', req.url))
+    }
+
+    return NextResponse.next()
+  },
+  {
+    callbacks: {
+      authorized: ({ token }) => !!token,
+    },
+  }
+)
+
+export const config = {
+  matcher: [
+    '/((?!login|api/auth|_next/static|_next/image|favicon\\.ico).*)',
+  ],
+}