diff --git a/homeassistant/components/script/__init__.py b/homeassistant/components/script/__init__.py
index b653eea86584..30f9a4c75a6e 100644
--- a/homeassistant/components/script/__init__.py
+++ b/homeassistant/components/script/__init__.py
@@ -782,6 +782,7 @@ class ScriptEntity(BaseScriptEntity, RestoreEntity):
 
 
 @websocket_api.websocket_command({"type": "script/config", "entity_id": str})
+@websocket_api.require_admin
 def websocket_config(
     hass: HomeAssistant,
     connection: websocket_api.ActiveConnection,
diff --git a/tests/components/script/test_init.py b/tests/components/script/test_init.py
index 821dda261cf8..cd3b0b01d8fa 100644
--- a/tests/components/script/test_init.py
+++ b/tests/components/script/test_init.py
@@ -1611,6 +1611,39 @@ async def test_websocket_config(
     assert msg["error"]["code"] == "not_found"
 
 
+async def test_websocket_config_requires_admin(
+    hass: HomeAssistant,
+    hass_ws_client: WebSocketGenerator,
+    hass_read_only_access_token: str,
+) -> None:
+    """Test config command requires admin."""
+    config = {
+        "alias": "hello",
+        "sequence": [{"action": "light.turn_on"}],
+    }
+    assert await async_setup_component(
+        hass,
+        DOMAIN,
+        {
+            "script": {
+                "hello": config,
+            },
+        },
+    )
+    client = await hass_ws_client(hass, hass_read_only_access_token)
+    await client.send_json(
+        {
+            "id": 5,
+            "type": "script/config",
+            "entity_id": "script.hello",
+        }
+    )
+
+    msg = await client.receive_json()
+    assert not msg["success"]
+    assert msg["error"]["code"] == "unauthorized"
+
+
 async def test_script_service_changed_entity_id(
     hass: HomeAssistant, entity_registry: er.EntityRegistry
 ) -> None: