From 6bb272d3dcad2f10cdfcf52bc30c0f20087d4c2c Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Thu, 1 Jan 2026 23:36:18 +0000
Subject: [PATCH] fix: Ensure Env Var takes precedence over system settings for
 HideLocalLogin. Related to #857

---
 internal/api/router.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/internal/api/router.go b/internal/api/router.go
index bbe5a965f..79c6b70e3 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -1855,7 +1855,10 @@ func (r *Router) reloadSystemSettings() {
 		r.cachedAllowedOrigins = systemSettings.AllowedEmbedOrigins
 
 		// Update HideLocalLogin so it takes effect immediately without restart
-		r.config.HideLocalLogin = systemSettings.HideLocalLogin
+		// BUT respect environment variable override if present
+		if !r.config.EnvOverrides["PULSE_AUTH_HIDE_LOCAL_LOGIN"] {
+			r.config.HideLocalLogin = systemSettings.HideLocalLogin
+		}
 
 		// Update webhook allowed private CIDRs in notification manager
 		if r.monitor != nil {