diff --git a/variable_realm/variable_realm.install b/variable_realm/variable_realm.install
index 2e9e6c6..f8b9040 100644
--- a/variable_realm/variable_realm.install
+++ b/variable_realm/variable_realm.install
@@ -19,3 +19,14 @@ function variable_realm_update_7000() {
   drupal_flush_all_caches();
 }
 
+/**
+ * Update roles to the new permission.
+ */
+function variable_realm_update_7001() {
+  // Give the new permission to anyone who had the old permission.
+  $roles = user_roles(FALSE, 'administer site configuration');
+
+  foreach ($roles as $rid => $permissions) {
+    user_role_grant_permissions($rid, array('administer variable realms'));
+  }
+}
diff --git a/variable_realm/variable_realm.module b/variable_realm/variable_realm.module
index 81d6f5c..c57e6c2 100644
--- a/variable_realm/variable_realm.module
+++ b/variable_realm/variable_realm.module
@@ -32,7 +32,7 @@ function variable_realm_boot() {
  * - Admin paths (not variable realm admin pages)
  */
 function variable_realm_init() {
-  if (arg(0) == 'admin' && (arg(3) != 'variable' || arg(4) != 'realm') && ($params = variable_realm_params()) && user_access('administer site configuration')) {
+  if (arg(0) == 'admin' && (arg(3) != 'variable' || arg(4) != 'realm') && ($params = variable_realm_params()) && user_access('administer variable realms')) {
     foreach ($params as $realm_name => $realm_key) {
       variable_realm_switch($realm_name, $realm_key, FALSE);
     }
@@ -41,6 +41,18 @@ function variable_realm_init() {
 }
 
 /**
+ * Implements hook_permission().
+ */
+function variable_realm_permission() {
+  return array(
+    'administer variable realms' => array(
+      'title' => t('Administer variable realms'),
+      'description' => t('Change variables for different variable realms'),
+    ),
+  );
+}
+
+/**
  * Initialize realm and set key depending on request.
  *
  * @param $realm_name