diff --git a/CHANGELOG.md b/CHANGELOG.md
index a25ea4e..1726e2e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,9 @@ Latest
 ## Changes
 * [#138](https://github.com/cleverage/ui-process-bundle/issues/138) Installation documentation: describe the Symfony Flex recipe, which registers the bundle, imports the bundle controllers routes (`config/routes/clever_age_ui_process.yaml`, the EasyAdmin routes being imported by the EasyAdmin recipe) and creates `config/packages/clever_age_ui_process.yaml`, and the manual setup without Flex.
 
+## Fixes
+* [#200](https://github.com/cleverage/ui-process-bundle/issues/200) `UserCrudController::generateToken()`: reserved to `ROLE_ADMIN` (`403`), as the users, and `404` for an unknown user: the action relied on EasyAdmin not loading the entity for a user without the entity permission (a `500`).
+
 v3.3
 ------
 
diff --git a/src/Controller/Admin/UserCrudController.php b/src/Controller/Admin/UserCrudController.php
index d2d8c12..8e34a52 100644
--- a/src/Controller/Admin/UserCrudController.php
+++ b/src/Controller/Admin/UserCrudController.php
@@ -110,12 +110,18 @@ public function configureActions(Actions $actions): Actions
                 ->addCssClass(''))->add(Crud::PAGE_EDIT, Action::new('generateToken')->linkToCrudAction('generateToken'));
     }
 
+    /**
+     * Same permission as the users (setEntityPermission()), which EasyAdmin only applies to its built-in actions.
+     */
     #[AdminRoute(path: '{id}/generate-token', name: 'generateToken')]
+    #[IsGranted('ROLE_ADMIN')]
     public function generateToken(): Response
     {
         $adminContext = $this->getContext();
-        /** @var User $user */
         $user = $adminContext?->getEntity()->getInstance();
+        if (!$user instanceof User) {
+            throw $this->createNotFoundException('User not found.');
+        }
         $token = md5(uniqid(date('YmdHis')));
         $user->setToken((new Pbkdf2PasswordHasher())->hash($token));
         /** @var ManagerRegistry $doctrine */
diff --git a/tests/Functional/UserCrudTest.php b/tests/Functional/UserCrudTest.php
index 8b71677..2f0996b 100644
--- a/tests/Functional/UserCrudTest.php
+++ b/tests/Functional/UserCrudTest.php
@@ -149,4 +149,30 @@ public function testGenerateToken(): void
         // Only the hash of the token is stored
         self::assertSame((new Pbkdf2PasswordHasher())->hash($token), $this->getEntityManager()->find(User::class, $admin->getId())?->getToken());
     }
+
+    /**
+     * The users are reserved to the admins: the custom action too (it was only protected because EasyAdmin does not
+     * load the entity, a 500).
+     */
+    public function testGenerateTokenIsReservedToAdmins(): void
+    {
+        $user = $this->login();
+        $other = $this->createUser('other@example.com');
+
+        $this->client->request('GET', '/process/user/'.$other->getId().'/generate-token');
+        self::assertResponseStatusCodeSame(403);
+        $this->client->request('GET', '/process/user/'.$user->getId().'/generate-token');
+        self::assertResponseStatusCodeSame(403);
+
+        $this->getEntityManager()->clear();
+        self::assertNull($this->getEntityManager()->find(User::class, $other->getId())?->getToken());
+    }
+
+    public function testGenerateTokenOfAnUnknownUser(): void
+    {
+        $this->login(['ROLE_ADMIN']);
+
+        $this->client->request('GET', '/process/user/999999/generate-token');
+        self::assertResponseStatusCodeSame(404);
+    }
 }