diff --git a/Iceshrimp.Backend/Controllers/Web/AuthController.cs b/Iceshrimp.Backend/Controllers/Web/AuthController.cs
index d27766ac..3d19da19 100644
--- a/Iceshrimp.Backend/Controllers/Web/AuthController.cs
+++ b/Iceshrimp.Backend/Controllers/Web/AuthController.cs
@@ -54,6 +54,8 @@ public class AuthController(DatabaseContext db, UserService userSvc, UserRendere
 		                                                   p.UsernameLower == request.Username.ToLowerInvariant());
 		if (user == null)
 			throw GracefulException.Forbidden("Invalid username or password");
+		if (user.IsSystemUser)
+			throw GracefulException.BadRequest("Cannot log in as system user");
 		var settings = await db.UserSettings.FirstOrDefaultAsync(p => p.User == user);
 		if (settings?.Password == null)
 			throw GracefulException.Forbidden("Invalid username or password");
diff --git a/Iceshrimp.Backend/Core/Services/NoteService.cs b/Iceshrimp.Backend/Core/Services/NoteService.cs
index ef283c45..220e8535 100644
--- a/Iceshrimp.Backend/Core/Services/NoteService.cs
+++ b/Iceshrimp.Backend/Core/Services/NoteService.cs
@@ -110,6 +110,8 @@ public class NoteService(
 			throw GracefulException.UnprocessableEntity($"Note was rejected by {policy.Name}");
 		if (data.User.IsLocalUser && (data.Text?.Length ?? 0) + (data.Cw?.Length ?? 0) > config.Value.CharacterLimit)
 			throw GracefulException.UnprocessableEntity($"Text & content warning cannot exceed {config.Value.CharacterLimit} characters in total");
+		if (data.User.IsSystemUser)
+			throw GracefulException.BadRequest("System users cannot create notes");
 		if (data.Text is { Length: > 100000 })
 			throw GracefulException.UnprocessableEntity("Text cannot be longer than 100.000 characters");
 		if (data.Cw is { Length: > 100000 })
diff --git a/Iceshrimp.Backend/Pages/OAuth/Authorize.cshtml.cs b/Iceshrimp.Backend/Pages/OAuth/Authorize.cshtml.cs
index 8bfba129..c976cc86 100644
--- a/Iceshrimp.Backend/Pages/OAuth/Authorize.cshtml.cs
+++ b/Iceshrimp.Backend/Pages/OAuth/Authorize.cshtml.cs
@@ -71,6 +71,7 @@ public class AuthorizeModel(DatabaseContext db) : PageModel
 			user = await db.Users.FirstOrDefaultAsync(p => p.IsLocalUser &&
 			                                               p.UsernameLower == username.ToLowerInvariant()) ??
 			       throw Forbidden();
+			if (user.IsSystemUser) throw GracefulException.BadRequest("Cannot log in as system user");
 			var userSettings = await db.UserSettings.FirstOrDefaultAsync(p => p.User == user);
 			if (userSettings?.Password == null)
 				throw Forbidden();