diff --git a/x-pack/plugins/observability_solution/apm_data_access/server/lib/helpers/create_es_client/create_apm_event_client/index.test.ts b/x-pack/plugins/observability_solution/apm_data_access/server/lib/helpers/create_es_client/create_apm_event_client/index.test.ts
index a349c7c48f687..79084daeb22e6 100644
--- a/x-pack/plugins/observability_solution/apm_data_access/server/lib/helpers/create_es_client/create_apm_event_client/index.test.ts
+++ b/x-pack/plugins/observability_solution/apm_data_access/server/lib/helpers/create_es_client/create_apm_event_client/index.test.ts
@@ -47,34 +47,46 @@ describe('APMEventClient', () => {
       const router = createRouter('/');
 
       let abortSignal: AbortSignal | undefined;
-      router.get({ path: '/', validate: false }, async (context, request, res) => {
-        const eventClient = new APMEventClient({
-          esClient: {
-            search: async (params: any, { signal }: { signal: AbortSignal }) => {
-              abortSignal = signal;
-              await setTimeoutPromise(3_000, undefined, {
-                signal: abortSignal,
-              });
-              return {};
+      router.get(
+        {
+          path: '/',
+          security: {
+            authz: {
+              enabled: false,
+              reason: 'This route is opted out from authorization',
             },
-          } as any,
-          debug: false,
-          request,
-          indices: {} as APMIndices,
-          options: {
-            includeFrozen: false,
           },
-        });
+          validate: false,
+        },
+        async (context, request, res) => {
+          const eventClient = new APMEventClient({
+            esClient: {
+              search: async (params: any, { signal }: { signal: AbortSignal }) => {
+                abortSignal = signal;
+                await setTimeoutPromise(3_000, undefined, {
+                  signal: abortSignal,
+                });
+                return {};
+              },
+            } as any,
+            debug: false,
+            request,
+            indices: {} as APMIndices,
+            options: {
+              includeFrozen: false,
+            },
+          });
 
-        await eventClient.search('foo', {
-          apm: {
-            events: [],
-          },
-          body: { size: 0, track_total_hits: false },
-        });
+          await eventClient.search('foo', {
+            apm: {
+              events: [],
+            },
+            body: { size: 0, track_total_hits: false },
+          });
 
-        return res.ok({ body: 'ok' });
-      });
+          return res.ok({ body: 'ok' });
+        }
+      );
 
       await server.start();
 
diff --git a/x-pack/plugins/observability_solution/metrics_data_access/server/routes/metric_indices/index.ts b/x-pack/plugins/observability_solution/metrics_data_access/server/routes/metric_indices/index.ts
index ebd4ed1943f20..465a7fdf69f22 100644
--- a/x-pack/plugins/observability_solution/metrics_data_access/server/routes/metric_indices/index.ts
+++ b/x-pack/plugins/observability_solution/metrics_data_access/server/routes/metric_indices/index.ts
@@ -50,6 +50,12 @@ export function initMetricIndicesRoute<T extends RequestHandlerContext>({
   router.get<unknown, unknown, MetricIndicesAPIResponse>(
     {
       path: `/api/metrics/indices`,
+      security: {
+        authz: {
+          enabled: false,
+          reason: 'This route is opted out from authorization',
+        },
+      },
       validate: false,
     },
     async (context, _req, res) => {