diff --git a/web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml b/web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml
new file mode 100644
index 0000000..369d4ce
--- /dev/null
+++ b/web/modules/custom/figli_compta_ledger/figli_compta_ledger.services.yml
@@ -0,0 +1,5 @@
+services:
+  figli_compta_ledger.route_subscriber:
+    class: Drupal\figli_compta_ledger\EventSubscriber\RouteSubscriber
+    tags:
+      - { name: event_subscriber }
diff --git a/web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php b/web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php
new file mode 100644
index 0000000..c4eea19
--- /dev/null
+++ b/web/modules/custom/figli_compta_ledger/src/EventSubscriber/RouteSubscriber.php
@@ -0,0 +1,31 @@
+<?php
+
+namespace Drupal\figli_compta_ledger\EventSubscriber;
+
+use Drupal\Core\Routing\RouteSubscriberBase;
+use Symfony\Component\Routing\RouteCollection;
+
+/**
+ * Core's generic entity autocomplete route ('system.entity_autocomplete')
+ * is '_access: TRUE' by design -- EntityQuery::accessCheck() only enforces
+ * node grants (published status), not the base 'access content'
+ * permission, so it doesn't actually block anonymous users the way every
+ * other route on this confidential site does. Discovered while adding
+ * field_entree_liee's autocomplete: verified the *existing* field_client
+ * (client taxonomy) autocomplete had the same gap, leaking real client
+ * names to anonymous requests via a plain curl call. Since every field on
+ * this content type is confidential, lock the route down site-wide rather
+ * than special-casing our own field.
+ */
+class RouteSubscriber extends RouteSubscriberBase {
+
+  /**
+   * {@inheritdoc}
+   */
+  protected function alterRoutes(RouteCollection $collection) {
+    if ($route = $collection->get('system.entity_autocomplete')) {
+      $route->setRequirement('_permission', 'access content');
+    }
+  }
+
+}