diff --git a/backend/src/ee/routes/v1/workspace.ts b/backend/src/ee/routes/v1/workspace.ts
index dab467981..49b13e6a5 100644
--- a/backend/src/ee/routes/v1/workspace.ts
+++ b/backend/src/ee/routes/v1/workspace.ts
@@ -8,9 +8,9 @@ import {
 import { body, param, query } from "express-validator";
 import {
   ADMIN, 
-  MEMBER,
+  AUTH_MODE_API_KEY,
   AUTH_MODE_JWT,
-  AUTH_MODE_API_KEY
+  MEMBER
 } from "../../../variables";
 import { workspaceController } from "../../controllers/v1";
 
@@ -108,7 +108,7 @@ router.post(
       acceptedAuthModes: [AUTH_MODE_JWT],
   }),
   requireWorkspaceAuth({
-      acceptedRoles: [ADMIN, MEMBER],
+      acceptedRoles: [ADMIN],
       locationWorkspaceId: "params",
   }),
   workspaceController.addWorkspaceTrustedIp
@@ -125,7 +125,7 @@ router.patch(
       acceptedAuthModes: [AUTH_MODE_JWT],
   }),
   requireWorkspaceAuth({
-      acceptedRoles: [ADMIN, MEMBER],
+      acceptedRoles: [ADMIN],
       locationWorkspaceId: "params",
   }),
   workspaceController.updateWorkspaceTrustedIp
@@ -140,7 +140,7 @@ router.delete(
       acceptedAuthModes: [AUTH_MODE_JWT],
   }),
   requireWorkspaceAuth({
-      acceptedRoles: [ADMIN, MEMBER],
+      acceptedRoles: [ADMIN],
       locationWorkspaceId: "params",
   }),
   workspaceController.deleteWorkspaceTrustedIp
diff --git a/docs/documentation/platform/ip-allowlisting.mdx b/docs/documentation/platform/ip-allowlisting.mdx
new file mode 100644
index 000000000..b037d50d2
--- /dev/null
+++ b/docs/documentation/platform/ip-allowlisting.mdx
@@ -0,0 +1,24 @@
+---
+title: "IP Allowlisting"
+description: "Restrict access to your secrets in Infisical using trusted IPs"
+---
+
+Projects in Infisical can be configured to restrict client access to specific IP addresses or CIDR ranges. This applies to any client using service tokens and
+can be useful, for example, for limiting access to traffic coming from corporate networks.
+
+By default, each project is initialized with the `0.0.0.0/0` entry, representing all possible IPv4 addresses.
+For enhanced security, we strongly recommend replacing the default entry with your client IPs to tighten access to your secrets.
+
+<Note>
+  You must be a project `admin` to manage your project's IP whitelist.
+</Note>
+
+![IP whitelist](../../images/project-ip-whitelist.png)
+
+## Creating a trusted IP entry
+
+To create a trusted IP entry, head over to the **IP Whitelist** tab in your project. When creating an entry,
+you can specify either a specific IP address like `192.0.2.1` or a CIDR range like `2001:db8::/32`; both IPv4 and IPv6
+formats are accepted.
+
+![IP whitelist add](../../images/project-ip-whitelist-add.png)
diff --git a/docs/images/project-ip-whitelist-add.png b/docs/images/project-ip-whitelist-add.png
new file mode 100644
index 000000000..c045daa4c
Binary files /dev/null and b/docs/images/project-ip-whitelist-add.png differ
diff --git a/docs/images/project-ip-whitelist.png b/docs/images/project-ip-whitelist.png
new file mode 100644
index 000000000..d4c449064
Binary files /dev/null and b/docs/images/project-ip-whitelist.png differ
diff --git a/docs/mint.json b/docs/mint.json
index e34531a32..b20a9f9fe 100644
--- a/docs/mint.json
+++ b/docs/mint.json
@@ -119,6 +119,7 @@
         "documentation/platform/secret-versioning",
         "documentation/platform/audit-logs",
         "documentation/platform/token",
+        "documentation/platform/ip-allowlisting",
         "documentation/platform/mfa",
         "documentation/platform/saml"
       ]