diff --git a/packages/cli/src/modules/source-control.ee/__tests__/source-control.controller.ee.test.ts b/packages/cli/src/modules/source-control.ee/__tests__/source-control.controller.ee.test.ts
index 1bb4ad26877..3ca85f353ec 100644
--- a/packages/cli/src/modules/source-control.ee/__tests__/source-control.controller.ee.test.ts
+++ b/packages/cli/src/modules/source-control.ee/__tests__/source-control.controller.ee.test.ts
@@ -1,5 +1,7 @@
 import type { PullWorkFolderRequestDto, PushWorkFolderRequestDto } from '@n8n/api-types';
 import type { AuthenticatedRequest } from '@n8n/db';
+import { ControllerRegistryMetadata, type Controller } from '@n8n/decorators';
+import { Container } from '@n8n/di';
 import type { Response } from 'express';
 import { mock } from 'jest-mock-extended';
 
@@ -166,4 +168,41 @@ describe('SourceControlController', () => {
 			expect(sourceControlService.getStatus).toHaveBeenCalledWith(user, query);
 		});
 	});
+
+	describe('getPreferences', () => {
+		it('should return preferences with public key', async () => {
+			const mockPreferences = {
+				branchName: 'main',
+				repositoryUrl: 'git@github.com:example/repo.git',
+				connected: true,
+				publicKey: '',
+			};
+			const mockPublicKey = 'ssh-rsa AAAAB3NzaC1yc2E...';
+
+			(sourceControlPreferencesService.getPreferences as jest.Mock).mockReturnValue(
+				mockPreferences,
+			);
+			(sourceControlPreferencesService.getPublicKey as jest.Mock).mockResolvedValue(mockPublicKey);
+
+			const result = await controller.getPreferences();
+
+			expect(sourceControlPreferencesService.getPublicKey).toHaveBeenCalled();
+			expect(sourceControlPreferencesService.getPreferences).toHaveBeenCalled();
+			expect(result).toEqual({
+				...mockPreferences,
+				publicKey: mockPublicKey,
+			});
+		});
+
+		it('should require authentication', () => {
+			const registry = Container.get(ControllerRegistryMetadata);
+			const controllerMetadata = registry.getControllerMetadata(
+				SourceControlController as Controller,
+			);
+
+			const getPreferencesRoute = controllerMetadata.routes.get('getPreferences');
+			expect(getPreferencesRoute).toBeDefined();
+			expect(getPreferencesRoute?.skipAuth).toBe(false);
+		});
+	});
 });
diff --git a/packages/cli/src/modules/source-control.ee/source-control.controller.ee.ts b/packages/cli/src/modules/source-control.ee/source-control.controller.ee.ts
index 9a7b5ec98d9..48b22d6af1b 100644
--- a/packages/cli/src/modules/source-control.ee/source-control.controller.ee.ts
+++ b/packages/cli/src/modules/source-control.ee/source-control.controller.ee.ts
@@ -34,7 +34,7 @@ export class SourceControlController {
 		private readonly eventService: EventService,
 	) {}
 
-	@Get('/preferences', { skipAuth: true })
+	@Get('/preferences')
 	async getPreferences(): Promise<SourceControlPreferences> {
 		// returns the settings with the privateKey property redacted
 		const publicKey = await this.sourceControlPreferencesService.getPublicKey();