diff --git a/solidity/contracts/Module.sol b/solidity/contracts/Module.sol
index 2d7f6d3c..ee777dc6 100644
--- a/solidity/contracts/Module.sol
+++ b/solidity/contracts/Module.sol
@@ -18,7 +18,7 @@ abstract contract Module is IModule {
     _;
   }
 
-  function setupRequest(bytes32 _requestId, bytes calldata _data) external {
+  function setupRequest(bytes32 _requestId, bytes calldata _data) external onlyOracle {
     requestData[_requestId] = _data;
     _afterSetupRequest(_requestId, _data);
   }
diff --git a/solidity/test/unit/ContractCallRequestModule.t.sol b/solidity/test/unit/ContractCallRequestModule.t.sol
index 34424ee0..b769cecb 100644
--- a/solidity/test/unit/ContractCallRequestModule.t.sol
+++ b/solidity/test/unit/ContractCallRequestModule.t.sol
@@ -133,6 +133,7 @@ contract ContractCallRequestModule_UnitTest is Test {
       abi.encodeCall(IAccountingExtension.bond, (_requester, _requestId, _paymentToken, _paymentAmount))
     );
 
+    vm.prank(address(oracle));
     contractCallRequestModule.setupRequest(_requestId, _requestData);
 
     // Check: request data was set?
diff --git a/solidity/test/unit/HttpRequestModule.t.sol b/solidity/test/unit/HttpRequestModule.t.sol
index 76027325..e710af40 100644
--- a/solidity/test/unit/HttpRequestModule.t.sol
+++ b/solidity/test/unit/HttpRequestModule.t.sol
@@ -114,6 +114,7 @@ contract HttpRequestModule_UnitTest is Test {
       address(accounting), abi.encodeCall(IAccountingExtension.bond, (_requester, _requestId, TOKEN, _amount))
     );
 
+    vm.prank(address(oracle));
     httpRequestModule.setupRequest(_requestId, _requestData);
 
     // Check: request data was set?
diff --git a/solidity/test/unit/Module.t.sol b/solidity/test/unit/Module.t.sol
index cc165778..89631b34 100644
--- a/solidity/test/unit/Module.t.sol
+++ b/solidity/test/unit/Module.t.sol
@@ -42,12 +42,22 @@ contract Module_UnitTest is Test {
    */
   function test_decodeRequestData(bytes32 _requestId, bytes calldata _data) public {
     // Set the request data
+    vm.prank(address(oracle));
     module.setupRequest(_requestId, _data);
 
     // Check: decoded values match original values?
     assertEq(module.requestData(_requestId), _data);
   }
 
+  /**
+   * @notice Test that setupRequestData reverts if the oracle is not the caller
+   */
+  function test_setupRequestRevertsWhenCalledByNonOracle(bytes32 _requestId, bytes calldata _data) public {
+    vm.expectRevert(abi.encodeWithSelector(IModule.Module_OnlyOracle.selector));
+    // Set the request data
+    module.setupRequest(_requestId, _data);
+  }
+
   /**
    * @notice Test if finalizeRequest can only be called by the oracle
    */