diff --git a/server/endpoints/oauth.py b/server/endpoints/oauth.py
index 929e2c9..8ab02f6 100644
--- a/server/endpoints/oauth.py
+++ b/server/endpoints/oauth.py
@@ -64,6 +64,8 @@
                     "ascii", "ignore"
                 )
             ).hexdigest(16)
+            authoritative = rv.get("oauth_domain", "generic") in server.config.oauth.authoritative_domains
+            admin = authoritative and rv.get('email') in server.config.oauth.admins
             cookie = await plugins.session.set_session(
                 server,
                 cid,
@@ -72,10 +74,10 @@
                 email=rv.get("email"),
                 # Authoritative if OAuth domain is in the authoritative oauth section in ponymail.yaml
                 # Required for access to private emails
-                authoritative=rv.get("oauth_domain", "generic")
-                in server.config.oauth.authoritative_domains,
+                authoritative=authoritative,
                 oauth_provider=rv.get("oauth_domain", "generic"),
                 oauth_data=rv,
+                admin=admin
             )
             # This could be improved upon, instead of a raw response return value
             return aiohttp.web.Response(
diff --git a/server/endpoints/preferences.py b/server/endpoints/preferences.py
index 49dcff6..7a473aa 100644
--- a/server/endpoints/preferences.py
+++ b/server/endpoints/preferences.py
@@ -47,6 +47,8 @@
                 "fullname": session.credentials.name,
             }
         }
+        if session.credentials.admin is True:
+            prefs['login']['credentials']['admin'] = True
 
     # Logging out??
     if indata.get('logout'):
diff --git a/server/plugins/configuration.py b/server/plugins/configuration.py
index 54417cb..4132511 100644
--- a/server/plugins/configuration.py
+++ b/server/plugins/configuration.py
@@ -33,12 +33,14 @@
 
 class OAuthConfig:
     authoritative_domains: list
+    admins: list
     google_client_id: str
     github_client_id: str
     github_client_secret: str
 
     def __init__(self, subyaml: dict):
         self.authoritative_domains = subyaml.get("authoritative_domains", [])
+        self.admins = subyaml.get("admins", [])
         self.google_client_id = subyaml.get("google_client_id", "")
         self.github_client_id = subyaml.get("github_client_id", "")
         self.github_client_secret = subyaml.get("github_client_secret", "")
diff --git a/server/plugins/session.py b/server/plugins/session.py
index e18a449..4ccd526 100644
--- a/server/plugins/session.py
+++ b/server/plugins/session.py
@@ -160,6 +160,8 @@
                 )
                 creds["oauth_provider"] = internal.get("oauth_provider", "generic")
                 creds["oauth_data"] = internal.get("oauth_data", {})
+                # We update admin boolean whenever we fetch session doc, as they may have changed in yaml but not in ES.
+                creds["admin"] = creds["authoritative"] and creds.get('email') in server.config.oauth.admins
                 session.credentials = SessionCredentials(creds)
 
                 # Save in memory storage
@@ -231,6 +233,7 @@
             "internal": {
                 "oauth_provider": session.credentials.oauth_provider,
                 "oauth_data": session.credentials.oauth_data,
+                "admin": session.credentials.admin,
             },
         },
     )
diff --git a/tools/setup.py b/tools/setup.py
index cbbadc9..69df254 100755
--- a/tools/setup.py
+++ b/tools/setup.py
@@ -463,6 +463,8 @@
 #  authoritative_domains:
 #    - googleapis.com  # OAuth via google is authoritative
 #    - github.com      # GitHub OAuth is authoritative
+#  admins:
+#    - foo@example.org
   google_client_id:     ~
   github_client_id:     ~
   github_client_secret: ~