diff --git a/app/controllers/project_settings/modules_controller.rb b/app/controllers/project_settings/modules_controller.rb
index dcfe27acf8b..57026dacbf6 100644
--- a/app/controllers/project_settings/modules_controller.rb
+++ b/app/controllers/project_settings/modules_controller.rb
@@ -34,4 +34,19 @@ class ProjectSettings::ModulesController < ProjectSettingsController
   def show
     render template: 'project_settings/modules'
   end
+
+  def update
+    call = Projects::EnabledModulesService
+             .new(model: @project, user: current_user)
+             .call(enabled_modules: permitted_params.project[:enabled_module_names])
+
+    if call.success?
+      flash[:notice] = I18n.t(:notice_successful_update)
+
+      redirect_to settings_modules_project_path(@project)
+    else
+      @errors = call.errors
+      render 'project_settings/modules'
+    end
+  end
 end
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 0af5263f4e5..f7509b2f8a4 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -83,21 +83,6 @@ class ProjectsController < ApplicationController
     end
   end
 
-  def modules
-    call = Projects::EnabledModulesService
-           .new(model: @project, user: current_user)
-           .call(enabled_modules: permitted_params.project[:enabled_module_names])
-
-    if call.success?
-      flash[:notice] = I18n.t(:notice_successful_update)
-
-      redirect_to settings_modules_project_path(@project)
-    else
-      @errors = call.errors
-      render 'project_settings/modules'
-    end
-  end
-
   def custom_fields
     Project.transaction do
       @project.work_package_custom_field_ids = permitted_params.project[:work_package_custom_field_ids]
diff --git a/app/views/project_settings/modules.html.erb b/app/views/project_settings/modules.html.erb
index 690afe0cb3e..e56891ba08d 100644
--- a/app/views/project_settings/modules.html.erb
+++ b/app/views/project_settings/modules.html.erb
@@ -34,8 +34,8 @@ See COPYRIGHT and LICENSE files for more details.
 <%= error_messages_for_contract(@project, @errors) %>
 
 <%= labelled_tabular_form_for @project,
-                              url: modules_project_path(@project),
-                              method: :put do |form| %>
+                              url: settings_modules_project_path(@project),
+                              method: :patch do |form| %>
 
   <%= render partial: "/projects/form/modules",
              locals: { form: form } %>
diff --git a/config/initializers/permissions.rb b/config/initializers/permissions.rb
index 300442ee693..10a46251ad3 100644
--- a/config/initializers/permissions.rb
+++ b/config/initializers/permissions.rb
@@ -83,7 +83,10 @@ OpenProject::AccessControl.map do |map|
                    contract_actions: { projects: %i[update] }
 
     map.permission :select_project_modules,
-                   { projects: :modules },
+                   {
+                     projects: :modules,
+                     'project_settings/modules': %i[show update]
+                   },
                    require: :member,
                    dependencies: :edit_project
 
diff --git a/config/routes.rb b/config/routes.rb
index 0f5f3236bb9..135ecd4b9ef 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -199,7 +199,6 @@ OpenProject::Application.routes.draw do
 
       get :copy
 
-      put :modules
       put :custom_fields
       put :archive
       put :unarchive
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index dde0da9872c..906f788f902 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -213,18 +213,6 @@ describe ProjectsController, type: :controller do
   describe 'with an existing project' do
     let(:project) { FactoryBot.create :project, identifier: 'blog' }
 
-    it 'should modules' do
-      project.enabled_module_names = %w[work_package_tracking news]
-      put :modules, params: {
-        id: project.id,
-        project: {
-          enabled_module_names: %w[work_package_tracking repository]
-        }
-      }
-      expect(response).to redirect_to '/projects/blog/settings/modules'
-      expect(project.reload.enabled_module_names.sort).to eq %w[repository work_package_tracking]
-    end
-
     it 'should get destroy info' do
       get :destroy_info, params: { id: project.id }
       expect(response).to be_successful
diff --git a/spec/routing/project_routing_spec.rb b/spec/routing/project_routing_spec.rb
index 9d5b9181979..74eb3ac7063 100644
--- a/spec/routing/project_routing_spec.rb
+++ b/spec/routing/project_routing_spec.rb
@@ -96,12 +96,6 @@ describe ProjectsController, type: :routing do
   end
 
   describe 'miscellaneous' do
-    it do
-      expect(put('projects/123/modules')).to route_to(
-        controller: 'projects', action: 'modules', id: '123'
-      )
-    end
-
     it do
       expect(put('projects/123/custom_fields')).to route_to(
         controller: 'projects', action: 'custom_fields', id: '123'
diff --git a/spec/routing/project_settings_routing_spec.rb b/spec/routing/project_settings_routing_spec.rb
index 8f5db062044..7be641fb86d 100644
--- a/spec/routing/project_settings_routing_spec.rb
+++ b/spec/routing/project_settings_routing_spec.rb
@@ -42,6 +42,13 @@ describe ProjectSettingsController, type: :routing do
       )
     end
 
+    it do
+      expect(patch('/projects/123/settings/modules'))
+        .to route_to(
+          controller: 'project_settings/modules', action: 'update', id: '123'
+        )
+    end
+
     it do
       expect(get('/projects/123/settings/custom_fields')).to route_to(
         controller: 'project_settings/custom_fields', action: 'show', id: '123'