diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4c240ef..2e005de 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ Changelog for NeoFS Contract
 ### Updated
 - NNS contract now sets domain expiration based on `register` arguments (#262)
 
+### Fixed
+- NNS `renew` now can only be done by the domain owner
+
 ## [0.15.5] - 2022-08-23
 
 ### Updated
diff --git a/nns/nns_contract.go b/nns/nns_contract.go
index 47d0fc0..8894294 100644
--- a/nns/nns_contract.go
+++ b/nns/nns_contract.go
@@ -339,6 +339,7 @@ func Renew(name string) int64 {
 	runtime.BurnGas(GetPrice())
 	ctx := storage.GetContext()
 	ns := getNameState(ctx, []byte(name))
+	ns.checkAdmin()
 	ns.Expiration += millisecondsInYear
 	putNameState(ctx, ns)
 	return ns.Expiration
diff --git a/tests/nns_test.go b/tests/nns_test.go
index a06b5ac..2f8049c 100644
--- a/tests/nns_test.go
+++ b/tests/nns_test.go
@@ -347,7 +347,8 @@ func TestNNSRenew(t *testing.T) {
 	ts := b.Timestamp + uint64(expire*1000) + uint64(msPerYear)
 
 	cAcc := c.WithSigners(acc)
-	cAcc.Invoke(t, ts, "renew", "testdomain.com")
+	cAcc.InvokeFail(t, "not witnessed by admin", "renew", "testdomain.com")
+	c1.Invoke(t, ts, "renew", "testdomain.com")
 	expected := stackitem.NewMapWithValue([]stackitem.MapElement{
 		{Key: stackitem.Make("name"), Value: stackitem.Make("testdomain.com")},
 		{Key: stackitem.Make("expiration"), Value: stackitem.Make(ts)}})