diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/AvailablePluginResourceTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/AvailablePluginResourceTest.java
index 1ec1c52e81..da4ad9d29b 100644
--- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/AvailablePluginResourceTest.java
+++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/AvailablePluginResourceTest.java
@@ -133,6 +133,11 @@ class AvailablePluginResourceTest {
   @Nested
   class WithoutAuthorization {
 
+    @BeforeEach
+    void unbindSubject() {
+      ThreadContext.unbindSubject();
+    }
+
     @Test
     void shouldNotGetAvailablePluginsIfMissingPermission() throws URISyntaxException {
       MockHttpRequest request = MockHttpRequest.get("/v2/plugins/available");
@@ -153,6 +158,7 @@ class AvailablePluginResourceTest {
 
     @Test
     void shouldNotInstallPluginIfMissingPermission() throws URISyntaxException {
+      ThreadContext.unbindSubject();
       MockHttpRequest request = MockHttpRequest.post("/v2/plugins/available/pluginName/2.0.0/install");
       request.accept(VndMediaType.PLUGIN);
       MockHttpResponse response = new MockHttpResponse();
diff --git a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/InstalledPluginResourceTest.java b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/InstalledPluginResourceTest.java
index f6633b4965..72aa8d4a5f 100644
--- a/scm-webapp/src/test/java/sonia/scm/api/v2/resources/InstalledPluginResourceTest.java
+++ b/scm-webapp/src/test/java/sonia/scm/api/v2/resources/InstalledPluginResourceTest.java
@@ -140,7 +140,7 @@ class InstalledPluginResourceTest {
     @Test
     void shouldNotGetInstalledPluginIfMissingPermission() throws URISyntaxException {
       MockHttpRequest request = MockHttpRequest.get("/v2/plugins/installed/pluginName");
-//      request.accept(VndMediaType.PLUGIN);
+      request.accept(VndMediaType.PLUGIN);
       MockHttpResponse response = new MockHttpResponse();
 
       assertThrows(UnhandledException.class, () -> dispatcher.invoke(request, response));