diff --git a/internal/api/router.go b/internal/api/router.go
index bbe5a965f..79c6b70e3 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -1855,7 +1855,10 @@ func (r *Router) reloadSystemSettings() {
 		r.cachedAllowedOrigins = systemSettings.AllowedEmbedOrigins
 
 		// Update HideLocalLogin so it takes effect immediately without restart
-		r.config.HideLocalLogin = systemSettings.HideLocalLogin
+		// BUT respect environment variable override if present
+		if !r.config.EnvOverrides["PULSE_AUTH_HIDE_LOCAL_LOGIN"] {
+			r.config.HideLocalLogin = systemSettings.HideLocalLogin
+		}
 
 		// Update webhook allowed private CIDRs in notification manager
 		if r.monitor != nil {