diff --git a/server/src/routes/authz.ts b/server/src/routes/authz.ts
index 2561609b80f..e2335a01ee8 100644
--- a/server/src/routes/authz.ts
+++ b/server/src/routes/authz.ts
@@ -49,7 +49,8 @@ export function assertCompanyAccess(req: Request, companyId: string) {
     if (!allowedCompanies.includes(companyId)) {
       throw forbidden("User does not have access to this company");
     }
-    const isSafeMethod = ["GET", "HEAD", "OPTIONS"].includes(req.method.toUpperCase());
+    const method = typeof req.method === "string" ? req.method.toUpperCase() : "GET";
+    const isSafeMethod = ["GET", "HEAD", "OPTIONS"].includes(method);
     if (!isSafeMethod && Array.isArray(req.actor.memberships) && req.actor.memberships.length > 0) {
       const membership = req.actor.memberships.find((item) => item.companyId === companyId);
       if (membership?.status !== "active") {
diff --git a/tests/e2e/playwright.config.ts b/tests/e2e/playwright.config.ts
index 46579bc9c05..4f1c7206680 100644
--- a/tests/e2e/playwright.config.ts
+++ b/tests/e2e/playwright.config.ts
@@ -12,6 +12,9 @@ const PAPERCLIP_HOME = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-e2e-home
 export default defineConfig({
   testDir: ".",
   testMatch: "**/*.spec.ts",
+  // These suites target dedicated multi-user configurations/ports and are
+  // intentionally not part of the default local_trusted e2e run.
+  testIgnore: ["multi-user.spec.ts", "multi-user-authenticated.spec.ts"],
   timeout: 60_000,
   retries: 0,
   use: {