diff --git a/src/Tgstation.Server.Api/Models/Administration.cs b/src/Tgstation.Server.Api/Models/Administration.cs
index 9febaa977a..918930f30a 100644
--- a/src/Tgstation.Server.Api/Models/Administration.cs
+++ b/src/Tgstation.Server.Api/Models/Administration.cs
@@ -1,4 +1,4 @@
-using System;
+using System;
 
 namespace Tgstation.Server.Api.Models
 {
@@ -7,11 +7,6 @@ namespace Tgstation.Server.Api.Models
 	/// </summary>
 	public sealed class Administration
 	{
-		/// <summary>
-		/// If the server is running on a windows operating system
-		/// </summary>
-		public bool WindowsHost { get; set; }
-
 		/// <summary>
 		/// The GitHub repository the server is built to recieve updates from
 		/// </summary>
diff --git a/src/Tgstation.Server.Api/Models/ServerInformation.cs b/src/Tgstation.Server.Api/Models/ServerInformation.cs
index 2111302237..4c9572a1bd 100644
--- a/src/Tgstation.Server.Api/Models/ServerInformation.cs
+++ b/src/Tgstation.Server.Api/Models/ServerInformation.cs
@@ -23,6 +23,11 @@ namespace Tgstation.Server.Api.Models
 		/// </summary>
 		public Version? DMApiVersion { get; set; }
 
+		/// <summary>
+		/// If the server is running on a windows operating system.
+		/// </summary>
+		public bool WindowsHost { get; set; }
+
 		/// <summary>
 		/// Map of <see cref="OAuthProvider"/> to the <see cref="OAuthProviderInfo"/> for them.
 		/// </summary>
diff --git a/src/Tgstation.Server.Api/Rights/AdministrationRights.cs b/src/Tgstation.Server.Api/Rights/AdministrationRights.cs
index 5d3daf7b99..f134c7d1c9 100644
--- a/src/Tgstation.Server.Api/Rights/AdministrationRights.cs
+++ b/src/Tgstation.Server.Api/Rights/AdministrationRights.cs
@@ -24,7 +24,7 @@ namespace Tgstation.Server.Api.Rights
 		RestartHost = 2,
 
 		/// <summary>
-		/// User can upgrade or downgrade TGS through the API.
+		/// User can read <see cref="Models.Administration"/> and upgrade/downgrade TGS through the API.
 		/// </summary>
 		ChangeVersion = 4,
 
diff --git a/src/Tgstation.Server.Host/Controllers/AdministrationController.cs b/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
index b309585c15..292228833b 100644
--- a/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
+++ b/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
@@ -166,7 +166,6 @@ namespace Tgstation.Server.Host.Controllers
 						return Conflict(new ErrorMessage(ErrorCode.ServerUpdateInProgress));
 					return Accepted(new Administration
 					{
-						WindowsHost = platformIdentifier.IsWindows,
 						NewVersion = newVersion
 					}); // gtfo of here before all the cancellation tokens fire
 				}
@@ -183,7 +182,7 @@ namespace Tgstation.Server.Host.Controllers
 		/// <response code="424">The GitHub API rate limit was hit. See response header Retry-After.</response>
 		/// <response code="429">A GitHub API error occurred. See error message for details.</response>
 		[HttpGet]
-		[TgsAuthorize]
+		[TgsAuthorize(AdministrationRights.ChangeVersion)]
 		[ProducesResponseType(typeof(Administration), 200)]
 		[ProducesResponseType(typeof(ErrorMessage), 424)]
 		[ProducesResponseType(typeof(ErrorMessage), 429)]
@@ -226,7 +225,6 @@ namespace Tgstation.Server.Host.Controllers
 				{
 					LatestVersion = greatestVersion,
 					TrackedRepositoryUrl = repoUrl,
-					WindowsHost = platformIdentifier.IsWindows
 				});
 			}
 			catch (RateLimitExceededException e)
diff --git a/src/Tgstation.Server.Host/Controllers/HomeController.cs b/src/Tgstation.Server.Host/Controllers/HomeController.cs
index 69ed0cc0d7..335a9cbd58 100644
--- a/src/Tgstation.Server.Host/Controllers/HomeController.cs
+++ b/src/Tgstation.Server.Host/Controllers/HomeController.cs
@@ -62,6 +62,11 @@ namespace Tgstation.Server.Host.Controllers
 		/// </summary>
 		readonly IOAuthProviders oAuthProviders;
 
+		/// <summary>
+		/// The <see cref="IPlatformIdentifier"/> for the <see cref="HomeController"/>.
+		/// </summary>
+		readonly IPlatformIdentifier platformIdentifier;
+
 		/// <summary>
 		/// The <see cref="IBrowserResolver"/> for the <see cref="HomeController"/>
 		/// </summary>
@@ -88,6 +93,7 @@ namespace Tgstation.Server.Host.Controllers
 		/// <param name="assemblyInformationProvider">The value of <see cref="assemblyInformationProvider"/></param>
 		/// <param name="identityCache">The value of <see cref="identityCache"/></param>
 		/// <param name="oAuthProviders">The value of <see cref="oAuthProviders"/>.</param>
+		/// <param name="platformIdentifier">The value of <see cref="platformIdentifier"/>.</param>
 		/// <param name="browserResolver">The value of <see cref="browserResolver"/></param>
 		/// <param name="generalConfigurationOptions">The <see cref="IOptions{TOptions}"/> containing the value of <see cref="generalConfiguration"/>.</param>
 		/// <param name="controlPanelConfigurationOptions">The <see cref="IOptions{TOptions}"/> containing the value of <see cref="controlPanelConfiguration"/></param>
@@ -101,6 +107,7 @@ namespace Tgstation.Server.Host.Controllers
 			IAssemblyInformationProvider assemblyInformationProvider,
 			IIdentityCache identityCache,
 			IOAuthProviders oAuthProviders,
+			IPlatformIdentifier platformIdentifier,
 			IBrowserResolver browserResolver,
 			IOptions<GeneralConfiguration> generalConfigurationOptions,
 			IOptions<ControlPanelConfiguration> controlPanelConfigurationOptions,
@@ -116,6 +123,7 @@ namespace Tgstation.Server.Host.Controllers
 			this.cryptographySuite = cryptographySuite ?? throw new ArgumentNullException(nameof(cryptographySuite));
 			this.assemblyInformationProvider = assemblyInformationProvider ?? throw new ArgumentNullException(nameof(assemblyInformationProvider));
 			this.identityCache = identityCache ?? throw new ArgumentNullException(nameof(identityCache));
+			this.platformIdentifier = platformIdentifier ?? throw new ArgumentNullException(nameof(platformIdentifier));
 			this.oAuthProviders = oAuthProviders ?? throw new ArgumentNullException(nameof(oAuthProviders));
 			this.browserResolver = browserResolver;
 			generalConfiguration = generalConfigurationOptions?.Value ?? throw new ArgumentNullException(nameof(generalConfigurationOptions));
@@ -166,6 +174,7 @@ namespace Tgstation.Server.Host.Controllers
 				InstanceLimit = generalConfiguration.InstanceLimit,
 				UserLimit = generalConfiguration.UserLimit,
 				ValidInstancePaths = generalConfiguration.ValidInstancePaths,
+				WindowsHost = platformIdentifier.IsWindows,
 				OAuthProviderInfos = await oAuthProviders.ProviderInfos(cancellationToken).ConfigureAwait(false)
 			});
 		}
diff --git a/tests/Tgstation.Server.Tests/AdministrationTest.cs b/tests/Tgstation.Server.Tests/AdministrationTest.cs
index 38b3f81224..cae7bc8763 100644
--- a/tests/Tgstation.Server.Tests/AdministrationTest.cs
+++ b/tests/Tgstation.Server.Tests/AdministrationTest.cs
@@ -1,8 +1,6 @@
 using Microsoft.VisualStudio.TestTools.UnitTesting;
-using SQLitePCL;
 using System;
 using System.Linq;
-using System.Runtime.InteropServices;
 using System.Threading;
 using System.Threading.Tasks;
 using Tgstation.Server.Api.Models;
@@ -68,7 +66,6 @@ namespace Tgstation.Server.Tests
 				// CI fails all the time b/c of this, ignore it
 				return;
 			}
-			Assert.AreEqual(RuntimeInformation.IsOSPlatform(OSPlatform.Windows), model.WindowsHost);
 
 			//we've released a few 4.x versions now, check the release checker is at least somewhat functional
 			Assert.AreEqual(4, model.LatestVersion.Major);
diff --git a/tests/Tgstation.Server.Tests/RootTest.cs b/tests/Tgstation.Server.Tests/RootTest.cs
index eccf9c0889..4d2c023c62 100644
--- a/tests/Tgstation.Server.Tests/RootTest.cs
+++ b/tests/Tgstation.Server.Tests/RootTest.cs
@@ -5,6 +5,7 @@ using System.Net;
 using System.Net.Http;
 using System.Net.Http.Headers;
 using System.Net.Mime;
+using System.Runtime.InteropServices;
 using System.Text;
 using System.Threading;
 using System.Threading.Tasks;
@@ -161,6 +162,7 @@ namespace Tgstation.Server.Tests
 			Assert.AreEqual(10U, serverInfo.MinimumPasswordLength);
 			Assert.AreEqual(11U, serverInfo.InstanceLimit);
 			Assert.AreEqual(150U, serverInfo.UserLimit);
+			Assert.AreEqual(RuntimeInformation.IsOSPlatform(OSPlatform.Windows), serverInfo.WindowsHost);
 
 			//check that modifying the token even slightly fucks up the auth
 			var newToken = new Token