diff --git a/deploy/filepack.service b/deploy/filepack.service
index 841dd261..6c958c99 100644
--- a/deploy/filepack.service
+++ b/deploy/filepack.service
@@ -18,7 +18,7 @@ ExecStart=/usr/local/bin/filepack \
   --https \
   --redirect www.filepack.com \
   --redirect-http-to-https \
-  --restrict-uploads
+  --restrict-writes
 Group=filepack
 LimitNOFILE=65536
 MemoryDenyWriteExecute=true
diff --git a/src/authenticated.rs b/src/authenticated.rs
index eb055b17..21f1bee2 100644
--- a/src/authenticated.rs
+++ b/src/authenticated.rs
@@ -18,7 +18,7 @@ impl<S: Send + Sync> FromRequestParts<S> for Authenticated {
       return Ok(Self);
     };
 
-    let admin = auth.admin.context(server_error::UploadForbidden)?;
+    let admin = auth.admin.context(server_error::WriteForbidden)?;
 
     let TypedHeader(Authorization(bearer)) = parts
       .extract::<TypedHeader<Authorization<Bearer>>>()
diff --git a/src/server_error.rs b/src/server_error.rs
index bff8afea..dd3624dc 100644
--- a/src/server_error.rs
+++ b/src/server_error.rs
@@ -128,10 +128,10 @@ pub enum ServerError {
   PageNotFound,
   #[snafu(display("error reading body of upload with hash {hash}"))]
   UploadBodyRead { hash: Hash, source: axum::Error },
-  #[snafu(display("uploads forbidden"))]
-  UploadForbidden,
   #[snafu(display("expected upload with hash {expected} but got {actual}"))]
   UploadHashMismatch { actual: Hash, expected: Hash },
+  #[snafu(display("writes forbidden"))]
+  WriteForbidden,
 }
 
 impl ServerError {
@@ -169,8 +169,8 @@ impl ServerError {
       | Self::PackageRootUnverified { .. }
       | Self::PageNotFound
       | Self::UploadBodyRead { .. }
-      | Self::UploadForbidden
-      | Self::UploadHashMismatch { .. } => self.to_string(),
+      | Self::UploadHashMismatch { .. }
+      | Self::WriteForbidden => self.to_string(),
       Self::Database { .. }
       | Self::DatabaseCommit { .. }
       | Self::DatabaseStorage { .. }
@@ -221,7 +221,7 @@ impl ServerError {
       | Self::PackageNotFound { .. }
       | Self::PackageNotMounted { .. }
       | Self::PageNotFound => StatusCode::NOT_FOUND,
-      Self::UploadForbidden => StatusCode::FORBIDDEN,
+      Self::WriteForbidden => StatusCode::FORBIDDEN,
     }
   }
 }
diff --git a/src/subcommand/serve.rs b/src/subcommand/serve.rs
index da079a03..61dbc354 100644
--- a/src/subcommand/serve.rs
+++ b/src/subcommand/serve.rs
@@ -98,7 +98,7 @@ pub(crate) struct Serve {
   #[arg(
     help = "Admin public key",
     long,
-    requires = "restrict_uploads",
+    requires = "restrict_writes",
     value_name = "KEY"
   )]
   admin_key: Option<KeyIdentifier>,
@@ -150,8 +150,8 @@ pub(crate) struct Serve {
     value_name = "DOMAIN"
   )]
   redirects: Vec<String>,
-  #[arg(help = "Restrict uploads to admin", long)]
-  restrict_uploads: bool,
+  #[arg(help = "Restrict writes to admin", long)]
+  restrict_writes: bool,
 }
 
 impl Serve {
@@ -415,7 +415,7 @@ impl Serve {
       }
     }
 
-    let auth_config = if self.restrict_uploads {
+    let auth_config = if self.restrict_writes {
       let admin = if let Some(identifier) = &self.admin_key {
         Some(Keychain::load(&options)?.identifier_public_key(identifier)?)
       } else {
@@ -604,7 +604,7 @@ impl Default for Serve {
       ready_address: None,
       redirect_http_to_https: false,
       redirects: Vec::new(),
-      restrict_uploads: false,
+      restrict_writes: false,
     }
   }
 }
diff --git a/src/subcommand/serve/tests.rs b/src/subcommand/serve/tests.rs
index 772b5003..0ac32b79 100644
--- a/src/subcommand/serve/tests.rs
+++ b/src/subcommand/serve/tests.rs
@@ -371,7 +371,7 @@ impl TestServerBuilder {
 }
 
 #[test]
-fn admin_key_requires_restrict_upload() {
+fn admin_key_requires_restrict_writes() {
   let err = Serve::try_parse_from(["filepack", "--admin-key", test::PUBLIC_KEY]).unwrap_err();
   assert_eq!(err.kind(), clap::error::ErrorKind::MissingRequiredArgument);
 }
@@ -527,7 +527,7 @@ fn artwork_response() {
 }
 
 #[test]
-fn closed_server_forbids_uploads() {
+fn closed_server_forbids_writes() {
   TestServer::builder()
     .auth_config(AuthConfig {
       admin: None,
@@ -537,7 +537,7 @@ fn closed_server_forbids_uploads() {
     .put(format!("/file/{}", Hash::bytes(b"bar")))
     .body("bar")
     .status(StatusCode::FORBIDDEN)
-    .assert_body("uploads forbidden")
+    .assert_body("writes forbidden")
     .send();
 }
 
@@ -2450,7 +2450,7 @@ fn redirect_omits_default_ports() {
 }
 
 #[test]
-fn restricted_upload_accepts_admin_token() {
+fn restricted_write_accepts_admin_token() {
   let admin = PrivateKey::generate();
   let hash = Hash::bytes(b"bar");
   let token = Token::encode(&admin, "filepack.example").unwrap();
@@ -2472,7 +2472,7 @@ fn restricted_upload_accepts_admin_token() {
 }
 
 #[test]
-fn restricted_upload_rejects_missing_header() {
+fn restricted_write_rejects_missing_header() {
   let admin = PrivateKey::generate();
   let server = TestServer::builder()
     .auth_config(AuthConfig {
@@ -2492,7 +2492,7 @@ fn restricted_upload_rejects_missing_header() {
 }
 
 #[test]
-fn restricted_upload_rejects_others() {
+fn restricted_write_rejects_others() {
   let admin = PrivateKey::generate();
   let other = PrivateKey::generate();
   let server = TestServer::builder()
diff --git a/tests/delete.rs b/tests/delete.rs
index bfde1446..5ac12c00 100644
--- a/tests/delete.rs
+++ b/tests/delete.rs
@@ -137,7 +137,7 @@ fn restricted_delete_succeeds_with_auth() {
       "0",
       "--domain",
       "127.0.0.1",
-      "--restrict-uploads",
+      "--restrict-writes",
       "--admin-key",
       "master",
     ])
diff --git a/tests/upload.rs b/tests/upload.rs
index 83d5042f..cae17025 100644
--- a/tests/upload.rs
+++ b/tests/upload.rs
@@ -14,7 +14,7 @@ fn restricted_upload_succeeds_with_auth() {
       "0",
       "--domain",
       "127.0.0.1",
-      "--restrict-uploads",
+      "--restrict-writes",
       "--admin-key",
       "master",
     ])
@@ -95,7 +95,7 @@ fn serve_admin_key_by_name() {
       "0",
       "--domain",
       "127.0.0.1",
-      "--restrict-uploads",
+      "--restrict-writes",
       "--admin-key",
       "master",
     ])
@@ -124,7 +124,7 @@ fn serve_admin_key_by_public_key() {
       "0",
       "--domain",
       "127.0.0.1",
-      "--restrict-uploads",
+      "--restrict-writes",
       "--admin-key",
       PUBLIC_KEY,
     ])