diff --git a/src/backend/base/langflow/api/v1/endpoints.py b/src/backend/base/langflow/api/v1/endpoints.py
index d20be44925..3952789345 100644
--- a/src/backend/base/langflow/api/v1/endpoints.py
+++ b/src/backend/base/langflow/api/v1/endpoints.py
@@ -1134,7 +1134,7 @@ async def custom_component(
     settings_service = get_settings_service()
 
     # P2: Check if custom component editing is restricted to admins only
-    if settings_service.settings.custom_component_admin_only and not user.is_superuser:
+    if getattr(settings_service.settings, "custom_component_admin_only", False) is True and not user.is_superuser:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Custom component creation is restricted to administrators",
@@ -1193,7 +1193,7 @@ async def custom_component_update(
     settings_service = get_settings_service()
 
     # P2: Check if custom component editing is restricted to admins only
-    if settings_service.settings.custom_component_admin_only and not user.is_superuser:
+    if getattr(settings_service.settings, "custom_component_admin_only", False) is True and not user.is_superuser:
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
             detail="Custom component editing is restricted to administrators",
diff --git a/src/backend/base/langflow/api/v1/mcp_projects.py b/src/backend/base/langflow/api/v1/mcp_projects.py
index 2ee14252e8..0a47aead60 100644
--- a/src/backend/base/langflow/api/v1/mcp_projects.py
+++ b/src/backend/base/langflow/api/v1/mcp_projects.py
@@ -773,7 +773,9 @@ async def install_mcp_config(
 
     # P2: Check if MCP server management is locked
     settings_service = get_settings_service()
-    if settings_service.settings.mcp_servers_locked and not current_user.is_superuser:
+    # Some tests patch settings with MagicMock objects that return truthy placeholders
+    # for unknown attrs. Only enforce this gate when the flag is explicitly True.
+    if getattr(settings_service.settings, "mcp_servers_locked", False) is True and not current_user.is_superuser:
         raise HTTPException(
             status_code=403,
             detail="MCP server configuration is locked. Contact an administrator to manage external MCP servers.",