diff --git a/data/web/inc/ajax/container_ctrl.php b/data/web/inc/ajax/container_ctrl.php
index 48c21cb13..140674af2 100644
--- a/data/web/inc/ajax/container_ctrl.php
+++ b/data/web/inc/ajax/container_ctrl.php
@@ -10,6 +10,10 @@ require_once $_SERVER['DOCUMENT_ROOT'] . '/inc/prerequisites.inc.php';
 if (!isset($_SESSION['mailcow_cc_role']) || $_SESSION['mailcow_cc_role'] != 'admin') {
 	exit();
 }
+// Read-only API keys must not control containers
+if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
+	exit();
+}
 
 if (preg_match('/^[a-z\-]{0,}-mailcow/', $_GET['service'])) {
   if ($_GET['action'] == "start") {
diff --git a/data/web/inc/functions.acl.inc.php b/data/web/inc/functions.acl.inc.php
index dde9b1236..50c247572 100644
--- a/data/web/inc/functions.acl.inc.php
+++ b/data/web/inc/functions.acl.inc.php
@@ -193,6 +193,10 @@ function acl($_action, $_scope = null, $_data = null, $_extra = null) {
         while ($row = array_shift($acl_all)) {
           $acl['acl'][$row['Field']] = 1;
         }
+        // Read-only API keys must not log in as other accounts (SOGo SSO, dual login)
+        if (!empty($_SESSION['mailcow_cc_api']) && ($_SESSION['mailcow_cc_api_access'] ?? '') != 'rw') {
+          $acl['acl']['login_as'] = 0;
+        }
       }
       elseif ($_SESSION['mailcow_cc_role'] == 'domainadmin' ||
         (isset($_SESSION["dual-login"]["role"]) && $_SESSION["dual-login"]["role"] == 'domainadmin')) {