diff --git a/src/middleware.ts b/src/middleware.ts
index 62954b8..cce59b5 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -65,6 +65,14 @@ export default auth((req) => {
 
   // Role-based route protection
   if (isLoggedIn) {
+    // Block ADMIN and SUPER_ADMIN from web app — they should use admin panel
+    if (userRole === "ADMIN" || userRole === "SUPER_ADMIN") {
+      // Allow logout and public routes
+      if (!isPublicRoute && !isNoRedirectRoute) {
+        return NextResponse.redirect(new URL("/logout", nextUrl.origin));
+      }
+    }
+
     // Prevent regular users from accessing agent routes
     if (isAgentRoute && userRole !== "AGENT") {
       return NextResponse.redirect(new URL("/user/dashboard", nextUrl.origin));