diff --git a/src/middleware.ts b/src/middleware.ts
index 30ba070..c8aea99 100644
--- a/src/middleware.ts
+++ b/src/middleware.ts
@@ -2,14 +2,17 @@ import { NextResponse } from 'next/server'
 import type { NextRequest } from 'next/server'
 import { decrypt } from '@/lib/auth'
 
-const protectedRoutes = ['/', '/my-orders', '/my-purchases', '/reports', '/profile', '/users']
+const protectedRoutes = ['/', '/my-orders', '/my-purchases', '/reports', '/profile', '/users', '/balances']
+const protectedPrefixes = ['/my-orders/', '/order/', '/settings/']
 const publicRoutes = ['/login', '/register']
 
 export async function middleware(request: NextRequest) {
   const path = request.nextUrl.pathname
 
-  // Also protect dynamic routes like /my-orders/[id]
-  const isProtectedRoute = protectedRoutes.includes(path) || path.startsWith('/my-orders/')
+  const isProtectedRoute = 
+    protectedRoutes.includes(path) || 
+    protectedPrefixes.some(prefix => path.startsWith(prefix))
+  
   const isPublicRoute = publicRoutes.includes(path)
 
   const cookie = request.cookies.get('session')?.value
@@ -23,7 +26,7 @@ export async function middleware(request: NextRequest) {
     return NextResponse.redirect(new URL('/', request.nextUrl))
   }
 
-  if (path.startsWith('/users') && session?.role !== 'superadmin') {
+  if (path.startsWith('/settings') && session?.role !== 'superadmin') {
     return NextResponse.redirect(new URL('/', request.nextUrl))
   }