diff --git a/auth/middleware.go b/auth/middleware.go
index b3f7c4832cddd4e8f757d1c5b947f3eb946b2484..e6afa7bea545800fba53741c3dbff57dc320ba81 100644
--- a/auth/middleware.go
+++ b/auth/middleware.go
@@ -279,8 +279,9 @@ 		if err == nil {
 			auth.AuthMethod = AUTH_INTERNAL
 		}
 	} else {
-		// Using anonymous internal auth. This is only used in one specific
-		// situation: registering for a new account.
+		// Using anonymous internal auth. This is used in situations where a
+		// user context can not (yet) be established: registering an account,
+		// looking up SSH keys, etc.
 		auth = &AuthContext{}
 		auth.AuthMethod = AUTH_ANON_INTERNAL
 	}
diff --git a/server/directives.go b/server/directives.go
index 87fca799dfe2297676bdd7311693c8cf6471b720..acdc670146d3f5b331eb6904929b208d10dec3fc 100644
--- a/server/directives.go
+++ b/server/directives.go
@@ -22,11 +22,11 @@
 func AnonInternal(ctx context.Context, obj any,
 	next graphql.Resolver) (any, error) {
 
-	if auth.ForContext(ctx).AuthMethod != auth.AUTH_ANON_INTERNAL {
-		return nil, fmt.Errorf("anonymous internal auth access denied")
+	switch auth.ForContext(ctx).AuthMethod {
+	case auth.AUTH_ANON_INTERNAL, auth.AUTH_INTERNAL:
+		return next(ctx)
 	}
-
-	return next(ctx)
+	return nil, fmt.Errorf("anonymous internal auth access denied")
 }
 
 func Internal(ctx context.Context, obj any,