diff --git a/contracts/near/eth2-client/src/lib.rs b/contracts/near/eth2-client/src/lib.rs
index f68f1c28..5032122c 100644
--- a/contracts/near/eth2-client/src/lib.rs
+++ b/contracts/near/eth2-client/src/lib.rs
@@ -61,6 +61,7 @@ pub struct Eth2Client {
     client_mode: ClientMode,
     unfinalized_head_execution_header: Option<ExecutionHeaderInfo>,
     unfinalized_tail_execution_header: Option<ExecutionHeaderInfo>,
+    trusted_blocks_submitter: Option<AccountId>,
 }
 
 #[near_bindgen]
@@ -122,6 +123,7 @@ impl Eth2Client {
             client_mode: ClientMode::SubmitLightClientUpdate,
             unfinalized_head_execution_header: None,
             unfinalized_tail_execution_header: None,
+            trusted_blocks_submitter: None,
         };
 
         contract.finalized_execution_blocks.insert(
@@ -214,6 +216,13 @@ impl Eth2Client {
 
     #[result_serializer(borsh)]
     pub fn submit_execution_header(&mut self, #[serializer(borsh)] block_header: BlockHeader) {
+        if let Some(trusted_blocks_submitter) = &self.trusted_blocks_submitter {
+            require!(
+                &env::predecessor_account_id() == trusted_blocks_submitter,
+                "Eth-client is deployed as trust mode, only trusted_blocks_submitter can submit blocks"
+            );
+        }
+
         require!(self.client_mode == ClientMode::SubmitHeader);
 
         let block_hash = block_header.calculate_hash();
@@ -319,6 +328,15 @@ impl Eth2Client {
         self.trusted_signer.clone()
     }
 
+    #[private]
+    pub fn update_trusted_blocks_submitter(&mut self, trusted_blocks_submitter: Option<AccountId>) {
+        self.trusted_blocks_submitter = trusted_blocks_submitter;
+    }
+
+    pub fn get_trusted_blocks_submitter(&self) -> Option<AccountId> {
+        self.trusted_blocks_submitter.clone()
+    }
+
     #[private]
     pub fn update_hashes_gc_threshold(&mut self, hashes_gc_threshold: u64) {
         self.hashes_gc_threshold = hashes_gc_threshold;
diff --git a/contracts/near/eth2-client/src/migrate.rs b/contracts/near/eth2-client/src/migrate.rs
index 10071e45..5cd86934 100644
--- a/contracts/near/eth2-client/src/migrate.rs
+++ b/contracts/near/eth2-client/src/migrate.rs
@@ -44,6 +44,7 @@ impl Eth2Client {
             client_mode: ClientMode::SubmitLightClientUpdate,
             unfinalized_head_execution_header: None,
             unfinalized_tail_execution_header: None,
+            trusted_blocks_submitter: None,
         }
     }
 }
diff --git a/contracts/near/res/eth2_client.wasm b/contracts/near/res/eth2_client.wasm
index 71a36917..3a47a4ac 100755
Binary files a/contracts/near/res/eth2_client.wasm and b/contracts/near/res/eth2_client.wasm differ