diff --git a/contracts/cep85/src/entry_points.rs b/contracts/cep85/src/entry_points.rs
index 27a37a0..8653f0a 100644
--- a/contracts/cep85/src/entry_points.rs
+++ b/contracts/cep85/src/entry_points.rs
@@ -43,7 +43,7 @@ pub fn init() -> EntryPoint {
 pub fn upgrade() -> EntryPoint {
     EntryPoint::new(
         ENTRY_POINT_UPGRADE,
-        vec![Parameter::new(ARG_PACKAGE_HASH, CLType::Key)],
+        vec![Parameter::new(ARG_CONTRACT_HASH, CLType::Key)],
         CLType::Unit,
         EntryPointAccess::Public,
         EntryPointType::Contract,
diff --git a/contracts/cep85/src/main.rs b/contracts/cep85/src/main.rs
index 59b7a2c..130a316 100644
--- a/contracts/cep85/src/main.rs
+++ b/contracts/cep85/src/main.rs
@@ -1044,6 +1044,8 @@ pub extern "C" fn set_modalities() {
 
 #[no_mangle]
 pub extern "C" fn upgrade() {
+    sec_check(vec![SecurityBadge::Admin]);
+
     put_key(
         ARG_CONTRACT_HASH,
         get_named_arg_with_user_errors::<Key>(
diff --git a/tests/src/utility/installer_request_builders.rs b/tests/src/utility/installer_request_builders.rs
index 66a28e6..5f2c13e 100644
--- a/tests/src/utility/installer_request_builders.rs
+++ b/tests/src/utility/installer_request_builders.rs
@@ -42,11 +42,11 @@ use cep85_test_contract::constants::{
 use std::collections::HashMap;
 
 #[derive(Clone)]
-pub struct TestContext {
-    pub cep85_token: ContractHash,
-    pub cep85_test_contract: ContractHash,
-    pub cep85_test_contract_package: ContractPackageHash,
-    pub test_accounts: HashMap<[u8; 32], AccountHash>,
+pub(crate) struct TestContext {
+    pub(crate) cep85_token: ContractHash,
+    pub(crate) cep85_test_contract: ContractHash,
+    pub(crate) cep85_test_contract_package: ContractPackageHash,
+    pub(crate) test_accounts: HashMap<[u8; 32], AccountHash>,
 }
 
 impl Drop for TestContext {