diff --git a/foundations/core/packages/account-client/src/client.ts b/foundations/core/packages/account-client/src/client.ts
index 0a15fa45ed4..f4a5abd9c6e 100644
--- a/foundations/core/packages/account-client/src/client.ts
+++ b/foundations/core/packages/account-client/src/client.ts
@@ -147,6 +147,7 @@ export interface AccountClient {
   signUp: (email: string, password: string, first: string, last: string) => Promise<LoginInfo>
   login: (email: string, password: string) => Promise<LoginInfo>
   loginAsGuest: () => Promise<LoginInfo>
+  getLoginCapabilities: () => Promise<{ signUpEnabled: boolean, guestLoginAvailable: boolean }>
   isReadOnlyGuest: () => Promise<boolean>
   getPerson: () => Promise<Person>
   getPersonInfo: (account: PersonUuid) => Promise<PersonInfo>
@@ -722,6 +723,15 @@ class AccountClientImpl implements AccountClient {
     return await this.rpc(request)
   }
 
+  async getLoginCapabilities (): Promise<{ signUpEnabled: boolean, guestLoginAvailable: boolean }> {
+    const request = {
+      method: 'getLoginCapabilities' as const,
+      params: {}
+    }
+
+    return await this.rpc(request)
+  }
+
   async isReadOnlyGuest (): Promise<boolean> {
     const request = {
       method: 'isReadOnlyGuest' as const,
diff --git a/plugins/login-resources/src/components/LoginForm.svelte b/plugins/login-resources/src/components/LoginForm.svelte
index ed4485488d0..02b752ec4b0 100644
--- a/plugins/login-resources/src/components/LoginForm.svelte
+++ b/plugins/login-resources/src/components/LoginForm.svelte
@@ -27,6 +27,7 @@
   import BottomActionComponent from './BottomAction.svelte'
   import login from '../plugin'
   import { LoginInfo } from '@hcengineering/account-client'
+  import { fetchLoginCapabilities } from '../utils'
 
   export let navigateUrl: string | undefined = undefined
   export let signUpDisabled = false
@@ -37,9 +38,18 @@
   export let onLogin: ((loginInfo: LoginInfo | null, status: Status) => void | Promise<void>) | undefined = undefined
 
   let method: LoginMethods = useOTP ? LoginMethods.Otp : LoginMethods.Password
+  let guestLoginAvailable = false
+  let capabilitiesLoaded = false
+  let signUpEnabled = true
+  $: effectiveSignUpDisabled = signUpDisabled || (capabilitiesLoaded && !signUpEnabled)
 
   onMount(() => {
     signupStore.setSignUpFlow(false)
+    void fetchLoginCapabilities().then((capabilities) => {
+      signUpEnabled = capabilities.signUpEnabled
+      guestLoginAvailable = capabilities.guestLoginAvailable
+      capabilitiesLoaded = true
+    })
   })
 
   function changeMethod (event: CustomEvent<LoginMethods>): void {
@@ -87,15 +97,33 @@
 </script>
 
 {#if method === LoginMethods.Otp}
-  <LoginOtpForm {navigateUrl} {signUpDisabled} {email} {caption} {subtitle} {onLogin} on:change={changeMethod} />
+  <LoginOtpForm
+    {navigateUrl}
+    signUpDisabled={effectiveSignUpDisabled}
+    {email}
+    {caption}
+    {subtitle}
+    {onLogin}
+    on:change={changeMethod}
+  />
 {:else}
-  <LoginPasswordForm {navigateUrl} {signUpDisabled} {email} {caption} {subtitle} {onLogin} on:change={changeMethod} />
+  <LoginPasswordForm
+    {navigateUrl}
+    signUpDisabled={effectiveSignUpDisabled}
+    {email}
+    {caption}
+    {subtitle}
+    {onLogin}
+    on:change={changeMethod}
+  />
 {/if}
 <div class="actions" style:margin-inline-start={loginFormPaddingInline($deviceInfo.docWidth, $deviceInfo.docHeight)}>
   <BottomActionComponent action={method === LoginMethods.Otp ? loginWithPasswordAction : loginWithCodeAction} />
-  <div class="login-as-guest">
-    <BottomActionComponent action={loginAsGuest} />
-  </div>
+  {#if guestLoginAvailable}
+    <div class="login-as-guest">
+      <BottomActionComponent action={loginAsGuest} />
+    </div>
+  {/if}
 </div>
 
 <style lang="scss">
diff --git a/plugins/login-resources/src/utils.ts b/plugins/login-resources/src/utils.ts
index 42e5735df91..f5d102f8ce2 100644
--- a/plugins/login-resources/src/utils.ts
+++ b/plugins/login-resources/src/utils.ts
@@ -79,6 +79,25 @@ export function getAccountClient (
   return getAccountClientRaw(accountsUrl, token !== null ? token : undefined)
 }
 
+/**
+ * Queries the account service for login affordance flags. Used by the login UI
+ * to hide the Sign Up tab and "Continue as guest" button when those flows are
+ * disabled server-side. Falls back to both available on any error to preserve
+ * backwards compatibility with account services that do not implement this
+ * endpoint yet.
+ */
+export async function fetchLoginCapabilities (): Promise<{
+  signUpEnabled: boolean
+  guestLoginAvailable: boolean
+}> {
+  try {
+    const accountClient = getAccountClient(null)
+    return await accountClient.getLoginCapabilities()
+  } catch {
+    return { signUpEnabled: true, guestLoginAvailable: true }
+  }
+}
+
 /**
  * Perform a login operation to required workspace with user credentials.
  */
diff --git a/server/account/src/__tests__/operations.test.ts b/server/account/src/__tests__/operations.test.ts
index 686f9c6e336..71df100a842 100644
--- a/server/account/src/__tests__/operations.test.ts
+++ b/server/account/src/__tests__/operations.test.ts
@@ -37,6 +37,8 @@ import {
   getLoginInfoByToken,
   releaseSocialId,
   loginAsGuest,
+  getLoginCapabilities,
+  resetGuestPersonCache,
   loginOtp,
   login,
   confirm,
@@ -1562,6 +1564,129 @@ describe('account operations', () => {
           new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, {}))
         )
       })
+
+      test('should fail with Forbidden when DISABLE_GUEST_LOGIN=true', async () => {
+        const prev = process.env.DISABLE_GUEST_LOGIN
+        process.env.DISABLE_GUEST_LOGIN = 'true'
+        try {
+          await expect(loginAsGuest(mockCtx, mockDb, mockBranding, mockToken)).rejects.toThrow(
+            new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+          )
+          expect(mockDb.person.findOne).not.toHaveBeenCalled()
+        } finally {
+          if (prev === undefined) {
+            delete process.env.DISABLE_GUEST_LOGIN
+          } else {
+            process.env.DISABLE_GUEST_LOGIN = prev
+          }
+        }
+      })
+    })
+
+    describe('getLoginCapabilities', () => {
+      // L-AUTH-1: the guest-person lookup is cached module-wide; reset before
+      // each test so per-test mock return values are observed deterministically.
+      beforeEach(() => {
+        resetGuestPersonCache()
+      })
+      const restoreEnv = (key: string, prev: string | undefined): void => {
+        if (prev === undefined) {
+          Reflect.deleteProperty(process.env, key)
+        } else {
+          process.env[key] = prev
+        }
+      }
+
+      test('should report both signUp and guest available by default when guest person exists', async () => {
+        const prevSignup = process.env.DISABLE_SIGNUP
+        const prevGuest = process.env.DISABLE_GUEST_LOGIN
+        delete process.env.DISABLE_SIGNUP
+        delete process.env.DISABLE_GUEST_LOGIN
+        try {
+          ;(mockDb.person.findOne as jest.Mock).mockResolvedValue({ uuid: readOnlyGuestAccountUuid })
+
+          const result = await getLoginCapabilities(mockCtx, mockDb, mockBranding, mockToken)
+
+          expect(result).toEqual({ signUpEnabled: true, guestLoginAvailable: true })
+        } finally {
+          restoreEnv('DISABLE_SIGNUP', prevSignup)
+          restoreEnv('DISABLE_GUEST_LOGIN', prevGuest)
+        }
+      })
+
+      test('should report guestLoginAvailable=false when guest person missing', async () => {
+        const prevSignup = process.env.DISABLE_SIGNUP
+        const prevGuest = process.env.DISABLE_GUEST_LOGIN
+        delete process.env.DISABLE_SIGNUP
+        delete process.env.DISABLE_GUEST_LOGIN
+        try {
+          ;(mockDb.person.findOne as jest.Mock).mockResolvedValue(null)
+
+          const result = await getLoginCapabilities(mockCtx, mockDb, mockBranding, mockToken)
+
+          expect(result).toEqual({ signUpEnabled: true, guestLoginAvailable: false })
+        } finally {
+          restoreEnv('DISABLE_SIGNUP', prevSignup)
+          restoreEnv('DISABLE_GUEST_LOGIN', prevGuest)
+        }
+      })
+
+      test('should report signUpEnabled=false when DISABLE_SIGNUP=true', async () => {
+        const prevSignup = process.env.DISABLE_SIGNUP
+        const prevGuest = process.env.DISABLE_GUEST_LOGIN
+        process.env.DISABLE_SIGNUP = 'true'
+        delete process.env.DISABLE_GUEST_LOGIN
+        try {
+          ;(mockDb.person.findOne as jest.Mock).mockResolvedValue({ uuid: readOnlyGuestAccountUuid })
+
+          const result = await getLoginCapabilities(mockCtx, mockDb, mockBranding, mockToken)
+
+          expect(result).toEqual({ signUpEnabled: false, guestLoginAvailable: true })
+        } finally {
+          restoreEnv('DISABLE_SIGNUP', prevSignup)
+          restoreEnv('DISABLE_GUEST_LOGIN', prevGuest)
+        }
+      })
+
+      test('should report guestLoginAvailable=false when DISABLE_GUEST_LOGIN=true (no DB lookup)', async () => {
+        const prevSignup = process.env.DISABLE_SIGNUP
+        const prevGuest = process.env.DISABLE_GUEST_LOGIN
+        delete process.env.DISABLE_SIGNUP
+        process.env.DISABLE_GUEST_LOGIN = 'true'
+        try {
+          ;(mockDb.person.findOne as jest.Mock).mockClear()
+
+          const result = await getLoginCapabilities(mockCtx, mockDb, mockBranding, mockToken)
+
+          expect(result).toEqual({ signUpEnabled: true, guestLoginAvailable: false })
+          expect(mockDb.person.findOne).not.toHaveBeenCalled()
+        } finally {
+          restoreEnv('DISABLE_SIGNUP', prevSignup)
+          restoreEnv('DISABLE_GUEST_LOGIN', prevGuest)
+        }
+      })
+
+      test('L-AUTH-1: caches the guest-person lookup within TTL (single DB hit)', async () => {
+        const prevSignup = process.env.DISABLE_SIGNUP
+        const prevGuest = process.env.DISABLE_GUEST_LOGIN
+        delete process.env.DISABLE_SIGNUP
+        delete process.env.DISABLE_GUEST_LOGIN
+        try {
+          ;(mockDb.person.findOne as jest.Mock).mockClear()
+          ;(mockDb.person.findOne as jest.Mock).mockResolvedValue({ uuid: readOnlyGuestAccountUuid })
+
+          const r1 = await getLoginCapabilities(mockCtx, mockDb, mockBranding, mockToken)
+          const r2 = await getLoginCapabilities(mockCtx, mockDb, mockBranding, mockToken)
+
+          expect(r1).toEqual({ signUpEnabled: true, guestLoginAvailable: true })
+          expect(r2).toEqual({ signUpEnabled: true, guestLoginAvailable: true })
+          // Second call within TTL must be served from cache -> exactly one DB hit.
+          expect(mockDb.person.findOne).toHaveBeenCalledTimes(1)
+        } finally {
+          restoreEnv('DISABLE_SIGNUP', prevSignup)
+          restoreEnv('DISABLE_GUEST_LOGIN', prevGuest)
+        }
+      })
     })
   })
 
@@ -1798,6 +1923,29 @@ describe('account operations', () => {
           )
         }
       })
+
+      test('should fail with Forbidden when DISABLE_SIGNUP=true', async () => {
+        const prev = process.env.DISABLE_SIGNUP
+        process.env.DISABLE_SIGNUP = 'true'
+        const signUpByEmailSpy = jest.spyOn(utils, 'signUpByEmail')
+        try {
+          await expect(
+            signUp(mockCtx, mockDb, mockBranding, mockToken, {
+              email: mockEmail,
+              password: mockPassword,
+              firstName: mockFirstName,
+              lastName: mockLastName
+            })
+          ).rejects.toThrow(new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {})))
+          expect(signUpByEmailSpy).not.toHaveBeenCalled()
+        } finally {
+          if (prev === undefined) {
+            delete process.env.DISABLE_SIGNUP
+          } else {
+            process.env.DISABLE_SIGNUP = prev
+          }
+        }
+      })
     })
 
     describe('confirm', () => {
@@ -2022,6 +2170,28 @@ describe('account operations', () => {
           )
         }
       })
+
+      test('should fail with Forbidden when DISABLE_SIGNUP=true', async () => {
+        const prev = process.env.DISABLE_SIGNUP
+        process.env.DISABLE_SIGNUP = 'true'
+        const getEmailSocialIdSpy = jest.spyOn(utils, 'getEmailSocialId')
+        try {
+          await expect(
+            signUpOtp(mockCtx, mockDb, mockBranding, mockToken, {
+              email: mockEmail,
+              firstName: mockFirstName,
+              lastName: mockLastName
+            })
+          ).rejects.toThrow(new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {})))
+          expect(getEmailSocialIdSpy).not.toHaveBeenCalled()
+        } finally {
+          if (prev === undefined) {
+            delete process.env.DISABLE_SIGNUP
+          } else {
+            process.env.DISABLE_SIGNUP = prev
+          }
+        }
+      })
     })
 
     describe('validateOtp', () => {
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts
index 3f2f3d5921b..73cbedb685a 100644
--- a/server/account/src/operations.ts
+++ b/server/account/src/operations.ts
@@ -152,6 +152,9 @@ export async function loginAsGuest (
   branding: Branding | null,
   token: string
 ): Promise<LoginInfo> {
+  if (process.env.DISABLE_GUEST_LOGIN === 'true') {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
   const guestPerson = await db.person.findOne({ uuid: readOnlyGuestAccountUuid as PersonUuid })
   if (guestPerson == null) {
     throw new PlatformError(new Status(Severity.ERROR, platform.status.AccountNotFound, {}))
@@ -162,6 +165,43 @@ export async function loginAsGuest (
   }
 }
 
+/**
+ * Returns login affordance flags so clients can hide sign-up and guest-login
+ * controls when they are disabled by env vars or unavailable (no guest person).
+ */
+// L-AUTH-1: getLoginCapabilities is unauthenticated; without caching every
+// anonymous call hits the DB (db.person.findOne on the guest account) and lets
+// a caller probe the guest-person's existence at will. The guest-person state
+// changes practically never, so we cache the boolean with a short TTL.
+let guestPersonCache: { value: boolean, at: number } | undefined
+const GUEST_PERSON_CACHE_TTL_MS = 60_000
+
+/** Clears the getLoginCapabilities guest-person cache. For tests / ops. */
+export function resetGuestPersonCache (): void {
+  guestPersonCache = undefined
+}
+
+export async function getLoginCapabilities (
+  ctx: MeasureContext,
+  db: AccountDB,
+  branding: Branding | null,
+  token: string
+): Promise<{ signUpEnabled: boolean, guestLoginAvailable: boolean }> {
+  const signUpEnabled = process.env.DISABLE_SIGNUP !== 'true'
+
+  let guestLoginAvailable = false
+  if (process.env.DISABLE_GUEST_LOGIN !== 'true') {
+    const now = Date.now()
+    if (guestPersonCache === undefined || now - guestPersonCache.at > GUEST_PERSON_CACHE_TTL_MS) {
+      const guestPerson = await db.person.findOne({ uuid: readOnlyGuestAccountUuid as PersonUuid })
+      guestPersonCache = { value: guestPerson != null, at: now }
+    }
+    guestLoginAvailable = guestPersonCache.value
+  }
+
+  return { signUpEnabled, guestLoginAvailable }
+}
+
 /**
  * Given an email and password, logs the user in and returns the account information and token.
  * If the account has too many failed login attempts, password login is blocked.
@@ -305,6 +345,9 @@ export async function signUp (
   },
   meta?: Meta
 ): Promise<LoginInfo> {
+  if (process.env.DISABLE_SIGNUP === 'true') {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
   const { email, password, firstName, lastName } = params
 
   if (email == null || password == null || firstName == null || email === '' || password === '' || firstName === '') {
@@ -349,6 +392,9 @@ export async function signUpOtp (
     lastName?: string
   }
 ): Promise<OtpInfo> {
+  if (process.env.DISABLE_SIGNUP === 'true') {
+    throw new PlatformError(new Status(Severity.ERROR, platform.status.Forbidden, {}))
+  }
   const { email, firstName, lastName } = params
 
   if (email == null || firstName == null || email === '' || firstName === '') {
@@ -3295,6 +3341,7 @@ export type AccountMethods =
   | 'login'
   | 'loginOtp'
   | 'loginAsGuest'
+  | 'getLoginCapabilities'
   | 'signUp'
   | 'signUpOtp'
   | 'validateOtp'
@@ -3377,6 +3424,7 @@ export function getMethods (hasSignUp: boolean = true): Partial<Record<AccountMe
     login: wrap(login),
     loginOtp: wrap(loginOtp),
     loginAsGuest: wrap(loginAsGuest),
+    getLoginCapabilities: wrap(getLoginCapabilities),
     ...(hasSignUp ? { signUp: wrap(signUp) } : {}),
     ...(hasSignUp ? { signUpOtp: wrap(signUpOtp) } : {}),
     validateOtp: wrap(validateOtp),