diff --git "a/api/src/routes/channels/\043channel_id/messages/\043message_id/ack.ts" "b/api/src/routes/channels/\043channel_id/messages/\043message_id/ack.ts"
index 208c1da..885c5ec 100644
--- "a/api/src/routes/channels/\043channel_id/messages/\043message_id/ack.ts"
+++ "b/api/src/routes/channels/\043channel_id/messages/\043message_id/ack.ts"
@@ -4,8 +4,9 @@
 
 const router = Router();
 
-// TODO: check if message exists
+// TODO: public read receipts & privacy scoping
 // TODO: send read state event to all channel members
+// TODO: advance-only notification cursor
 
 export interface MessageAcknowledgeSchema {
 	manual?: boolean;
diff --git "a/api/src/routes/channels/\043channel_id/messages/\043message_id/reactions.ts" "b/api/src/routes/channels/\043channel_id/messages/\043message_id/reactions.ts"
index 6b6a66b..d93cf70 100644
--- "a/api/src/routes/channels/\043channel_id/messages/\043message_id/reactions.ts"
+++ "b/api/src/routes/channels/\043channel_id/messages/\043message_id/reactions.ts"
@@ -101,7 +101,7 @@
 	res.json(users);
 });
 
-router.put("/:emoji/:user_id", route({ permission: "READ_MESSAGE_HISTORY" }), async (req: Request, res: Response) => {
+router.put("/:emoji/:user_id", route({ permission: "READ_MESSAGE_HISTORY", right: "SELF_ADD_REACTIONS" }), async (req: Request, res: Response) => {
 	const { message_id, channel_id, user_id } = req.params;
 	if (user_id !== "@me") throw new HTTPError("Invalid user");
 	const emoji = getEmoji(req.params.emoji);