diff --git a/src/middleware.js b/src/middleware.js
index d38a2c9b6..56ba751f9 100644
--- a/src/middleware.js
+++ b/src/middleware.js
@@ -1,7 +1,9 @@
 import { getToken } from "next-auth/jwt";
 import { NextResponse } from "next/server";
 
-const authEnabled = Boolean(process.env.HOMEPAGE_AUTH_ENABLED);
+import { isAuthEnabled } from "utils/env";
+
+const authEnabled = isAuthEnabled();
 const authSecret = process.env.NEXTAUTH_SECRET || process.env.HOMEPAGE_AUTH_SECRET;
 
 export async function middleware(req) {
diff --git a/src/middleware.test.js b/src/middleware.test.js
index fcdc49ea0..d3dc8815b 100644
--- a/src/middleware.test.js
+++ b/src/middleware.test.js
@@ -100,6 +100,16 @@ describe("middleware", () => {
     expect(res).toEqual({ type: "next" });
   });
 
+  it.each(["false", "0", "no", "off", ""])("treats HOMEPAGE_AUTH_ENABLED=%j as disabled", async (value) => {
+    process.env.HOMEPAGE_AUTH_ENABLED = value;
+
+    const middleware = await loadMiddleware();
+    const res = await middleware(createReq("localhost:3000", "http://localhost:3000/some"));
+
+    expect(getToken).not.toHaveBeenCalled();
+    expect(res).toEqual({ type: "next" });
+  });
+
   it("redirects to signin when auth is enabled and no token is present", async () => {
     process.env.HOMEPAGE_AUTH_ENABLED = "true";
     process.env.HOMEPAGE_AUTH_SECRET = "secret";
diff --git a/src/pages/api/auth/[...nextauth].js b/src/pages/api/auth/[...nextauth].js
index 74e5c95e3..0952dd3a5 100644
--- a/src/pages/api/auth/[...nextauth].js
+++ b/src/pages/api/auth/[...nextauth].js
@@ -3,9 +3,10 @@ import { createHash, timingSafeEqual } from "node:crypto";
 import NextAuth from "next-auth";
 import CredentialsProvider from "next-auth/providers/credentials";
 
+import { isAuthEnabled } from "utils/env";
 import createLogger from "utils/logger";
 
-const authEnabled = Boolean(process.env.HOMEPAGE_AUTH_ENABLED);
+const authEnabled = isAuthEnabled();
 const issuer = process.env.HOMEPAGE_OIDC_ISSUER;
 const clientId = process.env.HOMEPAGE_OIDC_CLIENT_ID;
 const clientSecret = process.env.HOMEPAGE_OIDC_CLIENT_SECRET;
diff --git a/src/pages/api/mcp/index.js b/src/pages/api/mcp/index.js
index b76a6b7a3..766ca56ac 100644
--- a/src/pages/api/mcp/index.js
+++ b/src/pages/api/mcp/index.js
@@ -1,10 +1,11 @@
 import { getServerSession } from "next-auth/next";
 
 import { authOptions } from "pages/api/auth/[...nextauth]";
+import { isAuthEnabled } from "utils/env";
 import { handleMcpRequest, mcpEnabled, mcpTokenAuthorized } from "utils/mcp/homepage-mcp";
 
 async function hasHomepageSession(req, res) {
-  if (!process.env.HOMEPAGE_AUTH_ENABLED) return false;
+  if (!isAuthEnabled()) return false;
   return Boolean(await getServerSession(req, res, authOptions));
 }