diff --git a/src/newsreader/urls.py b/src/newsreader/urls.py
index 916042a..63879a6 100644
--- a/src/newsreader/urls.py
+++ b/src/newsreader/urls.py
@@ -5,6 +5,7 @@ from django.urls import include, path
 
 from drf_yasg import openapi
 from drf_yasg.views import get_schema_view
+from two_factor.admin import AdminSiteOTPRequired
 from two_factor.urls import urlpatterns as two_factor_urls
 
 from newsreader.accounts.urls import urlpatterns as login_urls
@@ -18,8 +19,10 @@ api_patterns = [path("api/", include((news_endpoints, "news")))]
 schema_info = openapi.Info(title="Newsreader API", default_version="v1")
 schema_view = get_schema_view(schema_info, patterns=api_patterns)
 
+admin.site.__class__ = AdminSiteOTPRequired
+
 urlpatterns = [
-    path("", include(two_factor_urls)),  # TODO enforce two factor auth
+    path("", include(two_factor_urls)),
     path("", login_required(NewsView.as_view()), name="index"),
     path("", include((news_patterns, "news"))),
     path("", include((api_patterns, "api"))),