diff --git a/h/security/policy/_api_cookie.py b/h/security/policy/_api_cookie.py
index bf7b930a3e6..c5ceba0d83e 100644
--- a/h/security/policy/_api_cookie.py
+++ b/h/security/policy/_api_cookie.py
@@ -10,6 +10,7 @@
     ("api.group", "PATCH"),  # Edit an existing group.
     ("api.group_members", "GET"),  # List group members
     ("api.group_member", "DELETE"),  # Remove member from a group
+    ("api.group_member", "PATCH"),  # Update group membership
 ]