diff --git a/layouts/default.vue b/layouts/default.vue
index e8cb724..8ed21ed 100644
--- a/layouts/default.vue
+++ b/layouts/default.vue
@@ -287,6 +287,22 @@
                 >{{ page.text }}</v-list-item-title
               >
             </v-list-item>
+            <!-- 9/12のテストに向けて生徒も投票可能に -->
+            <v-list-item
+              v-show="
+                $auth.user?.groups?.includes(user_groups.parents.id) ||
+                $auth.user?.groups?.includes(user_groups.guest.id) ||
+                $auth.user?.groups?.includes(user_groups.students.id)
+              "
+              to="/votes"
+            >
+              <v-list-item-icon>
+                <v-icon color="theme_color">mdi-vote</v-icon>
+              </v-list-item-icon>
+              <v-list-item-title style="font-family: serif; font-weight: bold">
+                投票
+              </v-list-item-title>
+            </v-list-item>
             <v-list-item
               v-show="$auth.user?.groups?.includes(user_groups.students.id)"
               to="/tickets/intoScanner"
@@ -549,11 +565,6 @@ export default Vue.extend({
           text: 'ヘルプ',
           link: '/help',
         },
-        {
-          icon: 'mdi-vote',
-          text: '投票',
-          link: '/votes',
-        },
       ],
     }
   },
diff --git a/pages/votes/index.vue b/pages/votes/index.vue
index 37c39fa..f27d755 100644
--- a/pages/votes/index.vue
+++ b/pages/votes/index.vue
@@ -92,6 +92,12 @@ type Data = {
   now_loading: boolean
   votable: { [group_id: string]: boolean } // {"group_id":"votable"}の形で投票可能かを保存する
   vote_count: number // ユーザーが投票した数 -> まだ投票できるかの判定に利用
+  user_groups: {
+    admin: string
+    parents: string
+    guest: string
+    students: string
+  }
 }
 
 export default Vue.extend({
@@ -112,10 +118,37 @@ export default Vue.extend({
       now_loading: true,
       votable: {},
       vote_count: 0,
+      user_groups: {
+        admin: process.env.AZURE_AD_GROUPS_QUAINT_ADMIN as string,
+        parents: process.env.AZURE_AD_GROUPS_QUAINT_PARENTS as string,
+        guest: process.env.AZURE_AD_GROUPS_QUAINT_GUEST as string,
+        students: process.env.AZURE_AD_GROUPS_QUAINT_STUDENTS as string,
+      },
     }
   },
 
   async created() {
+    // 権限確認
+    // 9/12日のテストのためstudentsも許可
+    if (
+      !(
+        (this.$auth.user?.groups as string[]).includes(
+          this.user_groups.admin
+        ) ||
+        (this.$auth.user?.groups as string[]).includes(
+          this.user_groups.parents
+        ) ||
+        (this.$auth.user?.groups as string[]).includes(
+          this.user_groups.guest
+        ) ||
+        (this.$auth.user?.groups as string[]).includes(
+          this.user_groups.students
+        )
+      )
+    ) {
+      this.$nuxt.error({ statusCode: 403, message: 'Forbidden' })
+    }
+
     this.vote_count = await this.$axios.$get('/users/me/count/votes')
     this.taken_tickets = await this.$axios.$get('/users/me/tickets') // ←used状態のものも使えるようにする