diff --git a/apps/accounts/automations/change_secret/manager.py b/apps/accounts/automations/change_secret/manager.py
index 999fc2c75..7bad9e5f6 100644
--- a/apps/accounts/automations/change_secret/manager.py
+++ b/apps/accounts/automations/change_secret/manager.py
@@ -78,7 +78,9 @@ class ChangeSecretManager(AccountBasePlaybookManager):
             accounts = accounts.filter(secret_type=self.secret_type)
 
         if settings.CHANGE_AUTH_PLAN_SECURE_MODE_ENABLED:
-            accounts = accounts.filter(privileged=False)
+            accounts = accounts.filter(privileged=False).exclude(
+                username__in=['root', 'administrator']
+            )
         return accounts
 
     def host_callback(