diff --git a/java/google/registry/backup/BUILD b/java/google/registry/backup/BUILD
index f0e255e14..8310802f3 100644
--- a/java/google/registry/backup/BUILD
+++ b/java/google/registry/backup/BUILD
@@ -12,6 +12,7 @@ java_library(
         "//java/google/registry/cron",
         "//java/google/registry/model",
         "//java/google/registry/request",
+        "//java/google/registry/request/auth",
         "//java/google/registry/util",
         "//third_party/java/objectify:objectify-v4_1",
         "@com_google_appengine_api_1_0_sdk",
diff --git a/java/google/registry/backup/RestoreCommitLogsAction.java b/java/google/registry/backup/RestoreCommitLogsAction.java
index e7851d926..02fe955e9 100644
--- a/java/google/registry/backup/RestoreCommitLogsAction.java
+++ b/java/google/registry/backup/RestoreCommitLogsAction.java
@@ -41,6 +41,8 @@ import google.registry.model.ofy.CommitLogManifest;
 import google.registry.model.ofy.CommitLogMutation;
 import google.registry.request.Action;
 import google.registry.request.Parameter;
+import google.registry.request.auth.Auth;
+import google.registry.request.auth.AuthLevel;
 import google.registry.util.FormattingLogger;
 import google.registry.util.Retrier;
 import java.io.IOException;
@@ -59,7 +61,14 @@ import org.joda.time.DateTime;
 @Action(
     path = RestoreCommitLogsAction.PATH,
     method = Action.Method.POST,
-    automaticallyPrintOk = true)
+    automaticallyPrintOk = true,
+    auth =
+        @Auth(
+          methods = {Auth.AuthMethod.INTERNAL, Auth.AuthMethod.API},
+          minimumLevel = AuthLevel.APP,
+          userPolicy = Auth.UserPolicy.ADMIN
+        )
+)
 public class RestoreCommitLogsAction implements Runnable {
 
   private static final FormattingLogger logger = FormattingLogger.getLoggerForCallerClass();
diff --git a/java/google/registry/env/common/backend/WEB-INF/web.xml b/java/google/registry/env/common/backend/WEB-INF/web.xml
index 25709be7e..4f6547cd3 100644
--- a/java/google/registry/env/common/backend/WEB-INF/web.xml
+++ b/java/google/registry/env/common/backend/WEB-INF/web.xml
@@ -181,12 +181,6 @@
     <url-pattern>/_dr/task/exportCommitLogDiff</url-pattern>
   </servlet-mapping>
 
-  <!-- Restores commit logs. -->
-  <servlet-mapping>
-    <servlet-name>backend-servlet</servlet-name>
-    <url-pattern>/_dr/task/restoreCommitLogs</url-pattern>
-  </servlet-mapping>
-
   <!-- Deletes commit logs. -->
   <servlet-mapping>
     <servlet-name>backend-servlet</servlet-name>
diff --git a/java/google/registry/env/common/tools/WEB-INF/web.xml b/java/google/registry/env/common/tools/WEB-INF/web.xml
index b90c54ef8..e3f97b9c3 100644
--- a/java/google/registry/env/common/tools/WEB-INF/web.xml
+++ b/java/google/registry/env/common/tools/WEB-INF/web.xml
@@ -84,6 +84,12 @@
     <url-pattern>/_dr/task/killAllCommitLogs</url-pattern>
   </servlet-mapping>
 
+  <!-- Restores commit logs. -->
+  <servlet-mapping>
+    <servlet-name>tools-servlet</servlet-name>
+    <url-pattern>/_dr/task/restoreCommitLogs</url-pattern>
+  </servlet-mapping>
+
   <!-- This path serves up the App Engine results page for mapreduce runs. -->
   <servlet>
     <servlet-name>mapreduce</servlet-name>
diff --git a/java/google/registry/module/backend/BackendRequestComponent.java b/java/google/registry/module/backend/BackendRequestComponent.java
index 626151a88..7eb860729 100644
--- a/java/google/registry/module/backend/BackendRequestComponent.java
+++ b/java/google/registry/module/backend/BackendRequestComponent.java
@@ -20,7 +20,6 @@ import google.registry.backup.BackupModule;
 import google.registry.backup.CommitLogCheckpointAction;
 import google.registry.backup.DeleteOldCommitLogsAction;
 import google.registry.backup.ExportCommitLogDiffAction;
-import google.registry.backup.RestoreCommitLogsAction;
 import google.registry.batch.BatchModule;
 import google.registry.batch.DeleteContactsAndHostsAction;
 import google.registry.batch.DeleteProberDataAction;
@@ -127,7 +126,6 @@ interface BackendRequestComponent {
   RdeReporter rdeReporter();
   RefreshDnsAction refreshDnsAction();
   RefreshDnsOnHostRenameAction refreshDnsOnHostRenameAction();
-  RestoreCommitLogsAction restoreCommitLogsAction();
   SyncGroupMembersAction syncGroupMembersAction();
   SyncRegistrarsSheetAction syncRegistrarsSheetAction();
   TldFanoutAction tldFanoutAction();
diff --git a/java/google/registry/module/tools/BUILD b/java/google/registry/module/tools/BUILD
index 818c6f0bc..0b0a40fe7 100644
--- a/java/google/registry/module/tools/BUILD
+++ b/java/google/registry/module/tools/BUILD
@@ -8,6 +8,7 @@ java_library(
     name = "tools",
     srcs = glob(["*.java"]),
     deps = [
+        "//java/google/registry/backup",
         "//java/google/registry/config",
         "//java/google/registry/dns",
         "//java/google/registry/export",
diff --git a/java/google/registry/module/tools/ToolsRequestComponent.java b/java/google/registry/module/tools/ToolsRequestComponent.java
index cf0eb2db9..35bf93afb 100644
--- a/java/google/registry/module/tools/ToolsRequestComponent.java
+++ b/java/google/registry/module/tools/ToolsRequestComponent.java
@@ -16,6 +16,8 @@ package google.registry.module.tools;
 
 import dagger.Module;
 import dagger.Subcomponent;
+import google.registry.backup.BackupModule;
+import google.registry.backup.RestoreCommitLogsAction;
 import google.registry.dns.DnsModule;
 import google.registry.export.PublishDetailReportAction;
 import google.registry.flows.EppToolAction;
@@ -50,6 +52,7 @@ import google.registry.tools.server.javascrap.RefreshAllDomainsAction;
 @RequestScope
 @Subcomponent(
     modules = {
+        BackupModule.class,
         DnsModule.class,
         EppToolModule.class,
         LoadTestModule.class,
@@ -77,6 +80,7 @@ interface ToolsRequestComponent {
   PublishDetailReportAction publishDetailReportAction();
   RefreshAllDomainsAction refreshAllDomainsAction();
   ResaveAllEppResourcesAction resaveAllEppResourcesAction();
+  RestoreCommitLogsAction restoreCommitLogsAction();
   UpdatePremiumListAction updatePremiumListAction();
   VerifyOteAction verifyOteAction();