diff --git a/app/deps.py b/app/deps.py
index 9201ef4..98e2998 100644
--- a/app/deps.py
+++ b/app/deps.py
@@ -374,7 +374,6 @@ def require_active_plugin(plugin_name: str):
     Fails closed (503) on errors.
     """
     async def _check(
-        request: Request,
         db: AsyncSession = Depends(get_db),
     ) -> None:
         from app.core.permission_registry import get_permission_registry
@@ -388,32 +387,18 @@ def require_active_plugin(plugin_name: str):
                         "code": "plugin_inactive",
                     },
                 )
-            # Get tenant_id from session cookie — NOT from current_setting()
-            from app.config import get_settings
-            from app.core.auth import get_session_data, get_redis
+            # Get tenant_id from existing db session (NOT a new session)
+            # The tenant context is set by middleware/get_current_user on this same session
+            from sqlalchemy import text as sa_text
 
-            settings = get_settings()
-            session_id = request.cookies.get(settings.session_cookie_name)
-            if not session_id:
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail={"detail": "Not authenticated", "code": "not_authenticated"},
-                )
+            result = await db.execute(
+                sa_text("SELECT current_setting('app.current_tenant_id', true)::uuid")
+            )
+            tenant_id = result.scalar()
 
-            redis = get_redis()
-            session_data = await get_session_data(redis, session_id)
-            if session_data is None:
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail={"detail": "Session expired", "code": "session_expired"},
-                )
-            tenant_id_str = session_data.get("tenant_id")
-            if not tenant_id_str:
-                raise HTTPException(
-                    status_code=status.HTTP_403_FORBIDDEN,
-                    detail={"detail": "No tenant context", "code": "no_tenant"},
-                )
-            tenant_id = uuid.UUID(tenant_id_str)
+            if tenant_id is None:
+                # No tenant context — plugin is active by default (backward compatible)
+                return
 
             # Per-tenant activation check with Redis cache
             from app.core.redis import get_redis