diff --git a/pkg/hold/pds/xrpc.go b/pkg/hold/pds/xrpc.go
index 40d79aa..42d2a67 100644
--- a/pkg/hold/pds/xrpc.go
+++ b/pkg/hold/pds/xrpc.go
@@ -120,10 +120,11 @@ func (h *XRPCHandler) requireOwnerOrCrewAdmin(next http.Handler) http.Handler {
 // Stores validated user in request context
 func (h *XRPCHandler) requireAuth(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		user, err := ValidateDPoPRequest(r, h.httpClient)
+		// Service token authentication
+		user, err := ValidateServiceToken(r, h.pds.did,  h.httpClient)
 		if err != nil {
-			http.Error(w, fmt.Sprintf("authentication failed: %v", err), http.StatusUnauthorized)
-			return
+			http.Error(w, fmt.Sprintf("unauthorized: %v", err), http.StatusForbidden)
+			return 
 		}
 		// Store user in context for handlers to access
 		ctx := context.WithValue(r.Context(), contextKeyUser, user)