diff --git a/src/server/actions/lotse-settings.ts b/src/server/actions/lotse-settings.ts
index 47b4da6..98bb19f 100644
--- a/src/server/actions/lotse-settings.ts
+++ b/src/server/actions/lotse-settings.ts
@@ -3,6 +3,8 @@
 import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requireApiContext } from "@/server/api/context";
+import { requireSession } from "@/server/auth";
+import { requirePermission } from "@/server/rbac";
 import { updateLotseSettings } from "@/server/services/lotse/settings";
 
 /**
@@ -12,8 +14,10 @@ import { updateLotseSettings } from "@/server/services/lotse/settings";
  * Registered as EXEMPT in scripts/check-module-guards.ts.
  */
 export async function saveLotseSettings(fd: FormData): Promise<void> {
+  const session = await requireSession();
   let target = "/settings/lotse?saved=1";
   try {
+    requirePermission(session, "tenant:manage"); // fast JWT check; requireApiContext re-checks against the DB
     const ctx = await requireApiContext(null, "tenant:manage");
     await updateLotseSettings(ctx, {
       enabled: fd.get("enabled") === "on",
diff --git a/src/server/services/field/voice.ts b/src/server/services/field/voice.ts
index 2ecd8e7..5f47839 100644
--- a/src/server/services/field/voice.ts
+++ b/src/server/services/field/voice.ts
@@ -2,6 +2,7 @@ import { ServiceError, type ServiceCtx } from "@/server/services/context";
 import { dispatchJob } from "@/server/jobs/dispatch";
 import { JOB_QUEUES } from "@/server/jobs/queues";
 import { PROCESSORS } from "@/server/jobs/processors";
+import { transcriptionConfig } from "@/server/ai/transcription/openai-compatible";
 import type { ParsedOpPayload } from "@/lib/sync/ops";
 import { audit, isUniqueViolation, opTime, requireFieldOrder } from "./common";
 
@@ -57,7 +58,7 @@ export async function attachVoiceNote(ctx: ServiceCtx, input: ParsedOpPayload<"v
   await audit(ctx, "create", "voice_note", voice.id, null, { workOrderId: wo.id, documentId: doc.id, durationSeconds: voice.durationSeconds });
 
   let status = voice.transcriptionStatus;
-  if (!PROCESSORS[JOB_QUEUES.transcription]) {
+  if (!PROCESSORS[JOB_QUEUES.transcription] || !transcriptionConfig().configured) { // L9: no provider → never queue audio
     status = "disabled";
   } else {
     try {