diff --git a/apps/api/src/module-registry/module.guard.ts b/apps/api/src/module-registry/module.guard.ts
index 608bbf6..a080ca3 100644
--- a/apps/api/src/module-registry/module.guard.ts
+++ b/apps/api/src/module-registry/module.guard.ts
@@ -42,11 +42,10 @@ export class ModuleGuard implements CanActivate {
     }
 
     const request = context.switchToHttp().getRequest();
-    const tenantId = request.tenantId;
+    const tenantId = request.tenantId ?? request.user?.tenantId;
 
-    // Public routes or routes without tenant context skip module check
     if (!tenantId) {
-      return true;
+      throw new ForbiddenException('No tenant context');
     }
 
     const isActive = await this.moduleRegistryService.isModuleActive(