diff --git a/app/core/permissions.py b/app/core/permissions.py
index e453ad7..ef72db1 100644
--- a/app/core/permissions.py
+++ b/app/core/permissions.py
@@ -340,7 +340,7 @@ async def get_cached_permissions(
                         exc_info=True,
                     )
                     await redis.delete(cache_key)
-                    return None  # Fall through to re-resolution from DB
+                    # Fall through to re-resolution from DB (don't return None)
 
                 if cached_version == current_version:
                     return data
diff --git a/app/deps.py b/app/deps.py
index 964ff06..1323fa7 100644
--- a/app/deps.py
+++ b/app/deps.py
@@ -125,6 +125,8 @@ async def get_current_user(
 
     user_id = uuid.UUID(session_data["user_id"])
     resolved = await get_cached_permissions(db, redis, user_id, tenant_id)
+    if not resolved:
+        resolved = {"permissions": [], "denied": [], "field_permissions": {}, "is_system_admin": False}
     session_data["permissions"] = resolved.get("permissions", [])
     session_data["denied_permissions"] = resolved.get("denied", [])
     session_data["field_permissions"] = resolved.get("field_permissions", {})