diff --git a/database/migrations/2026_09_04_000001_add_setting_access_permission.php b/database/migrations/2026_09_04_000001_add_setting_access_permission.php
new file mode 100644
index 0000000..f819d09
--- /dev/null
+++ b/database/migrations/2026_09_04_000001_add_setting_access_permission.php
@@ -0,0 +1,37 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Support\Facades\DB;
+use Spatie\Permission\PermissionRegistrar;
+
+return new class extends Migration
+{
+    public function up(): void
+    {
+        $permissionsTable = config('permission.table_names.permissions', 'permissions');
+
+        DB::table($permissionsTable)->updateOrInsert(
+            ['name' => 'setting_access', 'guard_name' => 'web'],
+            ['created_at' => now(), 'updated_at' => now()]
+        );
+
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+
+    public function down(): void
+    {
+        $permissionsTable = config('permission.table_names.permissions', 'permissions');
+        $rolePermissionsTable = config('permission.table_names.role_has_permissions', 'role_has_permissions');
+        $permissionId = DB::table($permissionsTable)
+            ->where('name', 'setting_access')
+            ->where('guard_name', 'web')
+            ->value('id');
+
+        if ($permissionId) {
+            DB::table($rolePermissionsTable)->where('permission_id', $permissionId)->delete();
+            DB::table($permissionsTable)->where('id', $permissionId)->delete();
+        }
+
+        app(PermissionRegistrar::class)->forgetCachedPermissions();
+    }
+};
\ No newline at end of file
diff --git a/database/seeders/DatabaseSeeder.php b/database/seeders/DatabaseSeeder.php
index 39018cd..a6a28b6 100644
--- a/database/seeders/DatabaseSeeder.php
+++ b/database/seeders/DatabaseSeeder.php
@@ -23,6 +23,7 @@ class DatabaseSeeder extends Seeder
             'flota_access',
             'zaliczki_access',
             'users_access',
+            'setting_access',
         ];
 
         foreach ($permissions as $permission) {
@@ -39,6 +40,7 @@ class DatabaseSeeder extends Seeder
 
         $kierownikRole->syncPermissions([
             'users_access',
+            'setting_access',
             'raporty_access',
             'flota_access',
             'zaliczki_access',
diff --git a/resources/views/layouts/navigation.blade.php b/resources/views/layouts/navigation.blade.php
index d18aaf3..408e5a4 100644
--- a/resources/views/layouts/navigation.blade.php
+++ b/resources/views/layouts/navigation.blade.php
@@ -97,7 +97,7 @@
                             {{ __('Profile') }}
                         </x-dropdown-link>
 
-                        @can('users_access')
+                        @can('setting_access')
                             <x-dropdown-link :href="route('settings.index')">
                                 {{ __('Ustawienia') }}
                             </x-dropdown-link>
@@ -185,7 +185,7 @@
                     {{ __('Profile') }}
                 </x-responsive-nav-link>
 
-                @can('users_access')
+                @can('setting_access')
                     <x-responsive-nav-link :href="route('settings.index')" :active="request()->routeIs('settings.*')">
                         {{ __('Ustawienia') }}
                     </x-responsive-nav-link>
diff --git a/routes/web.php b/routes/web.php
index c5f4277..1536579 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -37,6 +37,10 @@ Route::middleware(['auth', 'verified'])->group(function () {
         Route::delete('/users/{user}', [UserController::class, 'destroy'])->name('users.destroy');
         Route::post('/users/{user}/restore', [UserController::class, 'restore'])->name('users.restore');
 
+    });
+
+    // Ustawienia systemu (tylko dla posiadaczy uprawnienia setting_access)
+    Route::middleware(['can:setting_access'])->group(function () {
         Route::get('/settings', [SettingsController::class, 'index'])->name('settings.index');
         Route::post('/settings/advance-types', [SettingsController::class, 'storeAdvanceType'])->name('settings.advance-types.store');
         Route::put('/settings/advance-types/{advanceType}', [SettingsController::class, 'updateAdvanceType'])->name('settings.advance-types.update');
diff --git a/tests/Feature/AdvanceTest.php b/tests/Feature/AdvanceTest.php
index fdcaf99..5017a7a 100644
--- a/tests/Feature/AdvanceTest.php
+++ b/tests/Feature/AdvanceTest.php
@@ -84,11 +84,11 @@ test('manager can create an advance for another user', function () {
 });
 
 test('manager can access system settings and add an advance type', function () {
-    Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'setting_access']);
 
     $manager = User::factory()->create();
     $managerRole = Role::firstOrCreate(['name' => 'kierownik']);
-    $managerRole->givePermissionTo(['zaliczki_access', 'users_access']);
+    $managerRole->givePermissionTo(['zaliczki_access', 'setting_access']);
     $manager->assignRole($managerRole);
 
     $indexResponse = $this->actingAs($manager)->get(route('settings.index'));
@@ -102,12 +102,23 @@ test('manager can access system settings and add an advance type', function () {
     $this->assertDatabaseHas('advance_types', ['name' => 'Koncesja']);
 });
 
-test('manager can edit and delete an advance type from settings', function () {
+test('users access alone does not grant access to system settings', function () {
     Permission::firstOrCreate(['name' => 'users_access']);
 
+    $user = User::factory()->create();
+    $role = Role::firstOrCreate(['name' => 'uzytkownik']);
+    $role->givePermissionTo('users_access');
+    $user->assignRole($role);
+
+    $this->actingAs($user)->get(route('settings.index'))->assertForbidden();
+});
+
+test('manager can edit and delete an advance type from settings', function () {
+    Permission::firstOrCreate(['name' => 'setting_access']);
+
     $manager = User::factory()->create();
     $managerRole = Role::firstOrCreate(['name' => 'kierownik']);
-    $managerRole->givePermissionTo(['zaliczki_access', 'users_access']);
+    $managerRole->givePermissionTo(['zaliczki_access', 'setting_access']);
     $manager->assignRole($managerRole);
 
     $type = AdvanceType::create(['name' => 'Koncesja']);
@@ -124,13 +135,13 @@ test('manager can edit and delete an advance type from settings', function () {
 });
 
 test('manager can update role permissions from settings', function () {
-    Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'setting_access']);
     Permission::firstOrCreate(['name' => 'raporty_access']);
     Permission::firstOrCreate(['name' => 'flota_access']);
 
     $manager = User::factory()->create();
     $managerRole = Role::firstOrCreate(['name' => 'kierownik']);
-    $managerRole->givePermissionTo('users_access');
+    $managerRole->givePermissionTo('setting_access');
     $manager->assignRole($managerRole);
 
     $response = $this->actingAs($manager)->post(route('settings.role-permissions.store'), [
@@ -145,11 +156,11 @@ test('manager can update role permissions from settings', function () {
 });
 
 test('manager cannot delete an advance type that is still used in advances', function () {
-    Permission::firstOrCreate(['name' => 'users_access']);
+    Permission::firstOrCreate(['name' => 'setting_access']);
 
     $manager = User::factory()->create();
     $managerRole = Role::firstOrCreate(['name' => 'kierownik']);
-    $managerRole->givePermissionTo(['zaliczki_access', 'users_access']);
+    $managerRole->givePermissionTo(['zaliczki_access', 'setting_access']);
     $manager->assignRole($managerRole);
 
     $type = AdvanceType::create(['name' => 'Paliwo']);