diff --git a/instances/models.py b/instances/models.py
index 5d4f021..147b099 100644
--- a/instances/models.py
+++ b/instances/models.py
@@ -216,6 +216,7 @@ class PermissionSet(models.Model):
             ('clone_instances', 'Can clone instances'),
             ('passwordless_console', _('Can access console without password')),
             ('view_instances', 'Can view instances'),
+            ('snapshot_instances', 'Can snapshot instances'),
         ]
 
         managed = False
diff --git a/instances/templates/instance.html b/instances/templates/instance.html
index a1b88b4..cb18556 100644
--- a/instances/templates/instance.html
+++ b/instances/templates/instance.html
@@ -93,7 +93,7 @@
                     {% trans "Resize" %}
                 </button>
             </li>
-            {% if allow_admin_or_not_template %}
+            {% if allow_admin_or_not_template and 'instances.snapshot_instances' in perms %}
             <li class="nav-item" role="presentation">
                 <button class="nav-link action-button" id="snapshots-tab" aria-controls="snapshots" data-bs-toggle="pill" data-bs-target="#snapshots" type="button" role="tab" aria-selected="false">
                     <span id="action-block" class="fa fa-camera" aria-hidden="true"></span>
diff --git a/instances/views.py b/instances/views.py
index b227046..ff8702c 100644
--- a/instances/views.py
+++ b/instances/views.py
@@ -813,7 +813,7 @@ def snapshot(request, pk):
     instance = get_instance(request.user, pk)
     allow_admin_or_not_template = request.user.is_superuser or request.user.is_staff or not instance.is_template
 
-    if allow_admin_or_not_template:
+    if allow_admin_or_not_template and request.user.has_perm("instances.snapshot_instances"):
         name = request.POST.get("name", "")
         instance.proxy.create_snapshot(name)
         msg = _("Create snapshot: %(snap)s") % {"snap": name}
@@ -824,7 +824,7 @@ def snapshot(request, pk):
 def delete_snapshot(request, pk):
     instance = get_instance(request.user, pk)
     allow_admin_or_not_template = request.user.is_superuser or request.user.is_staff or not instance.is_template
-    if allow_admin_or_not_template:
+    if allow_admin_or_not_template and request.user.has_perm("instances.snapshot_instances"):
         snap_name = request.POST.get("name", "")
         instance.proxy.snapshot_delete(snap_name)
         msg = _("Delete snapshot: %(snap)s") % {"snap": snap_name}
@@ -835,7 +835,7 @@ def delete_snapshot(request, pk):
 def revert_snapshot(request, pk):
     instance = get_instance(request.user, pk)
     allow_admin_or_not_template = request.user.is_superuser or request.user.is_staff or not instance.is_template
-    if allow_admin_or_not_template:
+    if allow_admin_or_not_template and request.user.has_perm("instances.snapshot_instances"):
         snap_name = request.POST.get("name", "")
         instance.proxy.snapshot_revert(snap_name)
         msg = _("Successful revert snapshot: ")