diff --git a/app/Http/Controllers/SettingController.php b/app/Http/Controllers/SettingController.php
index 7f7f4c9ca..3d1c184cd 100644
--- a/app/Http/Controllers/SettingController.php
+++ b/app/Http/Controllers/SettingController.php
@@ -11,6 +11,8 @@ class SettingController extends Controller
 {
     protected ImageRepo $imageRepo;
 
+    protected array $settingCategories = ['features', 'customization', 'registration'];
+
     public function __construct(ImageRepo $imageRepo)
     {
         $this->imageRepo = $imageRepo;
@@ -21,6 +23,7 @@ class SettingController extends Controller
      */
     public function index(string $category)
     {
+        $this->ensureCategoryExists($category);
         $this->checkPermission('settings-manage');
         $this->setPageTitle(trans('settings.settings'));
 
@@ -39,6 +42,7 @@ class SettingController extends Controller
      */
     public function update(Request $request, string $category)
     {
+        $this->ensureCategoryExists($category);
         $this->preventAccessInDemoMode();
         $this->checkPermission('settings-manage');
         $this->validate($request, [
@@ -73,4 +77,11 @@ class SettingController extends Controller
 
         return redirect("/settings/${category}");
     }
+
+    protected function ensureCategoryExists(string $category): void
+    {
+        if (!in_array($category, $this->settingCategories)) {
+            abort(404);
+        }
+    }
 }
diff --git a/tests/Settings/SettingsTest.php b/tests/Settings/SettingsTest.php
index b55911523..5d8c36996 100644
--- a/tests/Settings/SettingsTest.php
+++ b/tests/Settings/SettingsTest.php
@@ -28,4 +28,12 @@ class SettingsTest extends TestCase
             $resp->assertElementExists("form[action$=\"/settings/{$category}\"]");
         }
     }
+
+    public function test_not_found_setting_category_throws_404()
+    {
+        $resp = $this->asAdmin()->get('/settings/biscuits');
+
+        $resp->assertStatus(404);
+        $resp->assertSee('Page Not Found');
+    }
 }
\ No newline at end of file