diff --git a/api/v4/source/system.yaml b/api/v4/source/system.yaml
index edcdeb5ff59..637212b9311 100644
--- a/api/v4/source/system.yaml
+++ b/api/v4/source/system.yaml
@@ -673,8 +673,8 @@
       summary: Update configuration
       description: >
         Submit a new configuration for the server to use. As of server version
-        4.8, the `PluginSettings.EnableUploads` setting cannot be modified by
-        this endpoint.
+        4.8, the `PluginSettings.EnableUploads` and `PluginSettings.SignaturePublicKeyFiles`
+        settings cannot be modified by this endpoint.
 
         Note that the parameters that aren't set in the configuration that you
         provide will be reset to default values. Therefore, if you want to
@@ -815,8 +815,8 @@
       summary: Patch configuration
       description: >
         Submit configuration to patch. As of server version 4.8, the
-        `PluginSettings.EnableUploads` setting cannot be modified by this
-        endpoint.
+        `PluginSettings.EnableUploads` and `PluginSettings.SignaturePublicKeyFiles`
+        settings cannot be modified by this endpoint.
 
         ##### Permissions
 
diff --git a/server/channels/api4/config.go b/server/channels/api4/config.go
index c35ec4daa86..4a4d6e53151 100644
--- a/server/channels/api4/config.go
+++ b/server/channels/api4/config.go
@@ -308,6 +308,11 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// Do not allow certificates to be changed through the API. Mirror the full
+	// update endpoint by silently preserving the existing value rather than
+	// rejecting the request.
+	cfg.PluginSettings.SignaturePublicKeyFiles = appCfg.PluginSettings.SignaturePublicKeyFiles
+
 	// Do not allow import directory to be changed through the API
 	if cfg.ImportSettings.Directory != nil && *cfg.ImportSettings.Directory != *appCfg.ImportSettings.Directory {
 		c.Err = model.NewAppError("patchConfig", "api.config.update_config.not_allowed_security.app_error", map[string]any{"Name": "ImportSettings.Directory"}, "", http.StatusForbidden)
diff --git a/server/channels/api4/config_test.go b/server/channels/api4/config_test.go
index 6c50bdf0127..acec97e1f20 100644
--- a/server/channels/api4/config_test.go
+++ b/server/channels/api4/config_test.go
@@ -912,6 +912,20 @@ func TestPatchConfig(t *testing.T) {
 		assert.Equal(t, newURL, *cfg.PluginSettings.MarketplaceURL)
 	})
 
+	t.Run("Should not be able to modify PluginSettings.SignaturePublicKeyFiles", func(t *testing.T) {
+		// Mirror the behavior of the full update endpoint (TestUpdateConfig):
+		// changes to this field are silently preserved, not rejected.
+		oldPublicKeys := th.App.Config().PluginSettings.SignaturePublicKeyFiles
+
+		cfg := th.App.Config().Clone()
+		cfg.PluginSettings.SignaturePublicKeyFiles = append(cfg.PluginSettings.SignaturePublicKeyFiles, "new_signature")
+
+		updatedConfig, _, err := th.SystemAdminClient.PatchConfig(context.Background(), cfg)
+		require.NoError(t, err)
+		assert.Equal(t, oldPublicKeys, updatedConfig.PluginSettings.SignaturePublicKeyFiles)
+		assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
+	})
+
 	t.Run("System Admin should not be able to clear Site URL", func(t *testing.T) {
 		cfg, _, err := th.SystemAdminClient.GetConfig(context.Background())
 		require.NoError(t, err)