diff --git a/bayer/views.py b/bayer/views.py
index 82df528b..7a88d109 100644
--- a/bayer/views.py
+++ b/bayer/views.py
@@ -37,6 +37,10 @@ def create_pes(request, package_uuid):
 
             classification = pes_data.get("classificationLevel", "")
             if "secret" == classification.lower():
+
+                if current_package.classification_level != Package.Classification.SECRET:
+                    return BadRequest("Cannot create PESs for non-secret packages.")
+
                 data_pools = pes_data.get("dataPools")
                 if data_pools:
                     if s.DATA_POOL_MAPPING[current_package.data_pool.name] not in data_pools:
diff --git a/epdb/legacy_api.py b/epdb/legacy_api.py
index 93eac653..6705bc25 100644
--- a/epdb/legacy_api.py
+++ b/epdb/legacy_api.py
@@ -871,6 +871,10 @@ def create_package_compound(
 
             classification = pes_data.get("classificationLevel", "")
             if "secret" == classification.lower():
+
+                if p.classification_level != Package.Classification.SECRET:
+                    return 400, {"Cannot create PESs for non-secret packages."}
+
                 data_pools = pes_data.get("dataPools")
                 if data_pools:
                     if s.DATA_POOL_MAPPING[p.data_pool.name] not in data_pools: