diff --git a/config/vufind/permissions.ini b/config/vufind/permissions.ini
index ee7fe291f1772fa8a989259868ef1b16181e6667..c5baa3ffe70e5f6be2c4be90b2a6ebfa7de77f9a 100644
--- a/config/vufind/permissions.ini
+++ b/config/vufind/permissions.ini
@@ -72,6 +72,7 @@
 ; access.DebugMode - Allows ?debug=true GET parameter to turn on debug mode
 ; access.EDSExtendedResults - Controls visibility of protected EDS results
 ; access.EITModule - Controls access to the EBSCO EIT module (if active)
+; access.PrimoModule - Controls access to ALL Primo content
 ; access.StaffViewTab - Controls access to the staff view tab in record mode
 ; access.SummonExtendedResults - Controls visibility of protected Summon results
 
@@ -80,6 +81,12 @@
 role = loggedin
 permission = access.EITModule
 
+; Default configuration for the Primo module (allow everyone by default).
+[default.PrimoModule]
+role[] = guest
+role[] = loggedin
+permission = access.PrimoModule
+
 ; Show staff view for all users by default
 [default.StaffViewTab]
 role[] = guest
diff --git a/module/VuFind/src/VuFind/Controller/PrimoController.php b/module/VuFind/src/VuFind/Controller/PrimoController.php
index 2d83b0944d467e012af02ab838404acf2a8b46f5..0edcf335cff6847577ccbca2e6e003c07bfdffe9 100644
--- a/module/VuFind/src/VuFind/Controller/PrimoController.php
+++ b/module/VuFind/src/VuFind/Controller/PrimoController.php
@@ -46,6 +46,7 @@ class PrimoController extends AbstractSearch
      */
     public function __construct(ServiceLocatorInterface $sm)
     {
+        $this->accessPermission = 'access.PrimoModule';
         $this->searchClassId = 'Primo';
         parent::__construct($sm);
     }
diff --git a/module/VuFind/src/VuFind/Controller/PrimorecordController.php b/module/VuFind/src/VuFind/Controller/PrimorecordController.php
index fbd480fa77655ee146677f64629d66efdd84c7f5..f07a7ce072146b1db5bbdb9a2e480c9d20553ade 100644
--- a/module/VuFind/src/VuFind/Controller/PrimorecordController.php
+++ b/module/VuFind/src/VuFind/Controller/PrimorecordController.php
@@ -47,6 +47,7 @@ class PrimorecordController extends AbstractRecord
     public function __construct(ServiceLocatorInterface $sm)
     {
         // Override some defaults:
+        $this->accessPermission = 'access.PrimoModule';
         $this->searchClassId = 'Primo';
         $this->fallbackDefaultTab = 'Description';