diff --git a/seaweed-volume/src/server/volume_server.rs b/seaweed-volume/src/server/volume_server.rs
index fb1d22486..41ef95553 100644
--- a/seaweed-volume/src/server/volume_server.rs
+++ b/seaweed-volume/src/server/volume_server.rs
@@ -241,7 +241,10 @@ fn public_options_response() -> Response {
 /// matching Go's `if signingKey == "" || enableUiAccess` check.
 pub fn build_admin_router(state: Arc<VolumeServerState>) -> Router {
     let guard = state.guard.read().unwrap();
-    let ui_enabled = guard.signing_key.0.is_empty() && !guard.has_read_signing_key();
+    // This helper can only derive the default Go behavior from the guard state:
+    // UI stays enabled when the write signing key is empty. The explicit
+    // `access.ui` override is handled by `build_admin_router_with_ui(...)`.
+    let ui_enabled = guard.signing_key.0.is_empty();
     drop(guard);
     build_admin_router_with_ui(state, ui_enabled)
 }
@@ -251,7 +254,6 @@ pub fn build_admin_router_with_ui(state: Arc<VolumeServerState>, ui_enabled: boo
     let mut router = Router::new()
         .route("/status", get(handlers::status_handler))
         .route("/healthz", get(handlers::healthz_handler))
-        .route("/metrics", get(handlers::metrics_handler))
         .route("/favicon.ico", get(handlers::favicon_handler))
         .route(
             "/seaweedfsstatic/*path",
diff --git a/seaweed-volume/tests/http_integration.rs b/seaweed-volume/tests/http_integration.rs
index 8fcb3c30f..68f453a70 100644
--- a/seaweed-volume/tests/http_integration.rs
+++ b/seaweed-volume/tests/http_integration.rs
@@ -42,7 +42,15 @@ fn test_state_with_signing_key(signing_key: Vec<u8>) -> (Arc<VolumeServerState>,
         )
         .expect("failed to add location");
     store
-        .add_volume(VolumeId(1), "", None, None, 0, DiskType::HardDrive, Version::current())
+        .add_volume(
+            VolumeId(1),
+            "",
+            None,
+            None,
+            0,
+            DiskType::HardDrive,
+            Version::current(),
+        )
         .expect("failed to create volume");
 
     let guard = Guard::new(&[], SigningKey(signing_key), 0, SigningKey(vec![]), 0);
@@ -179,7 +187,7 @@ async fn status_returns_json_with_version_and_volumes() {
 }
 
 #[tokio::test]
-async fn admin_router_exposes_metrics() {
+async fn admin_router_does_not_expose_metrics() {
     let (state, _tmp) = test_state();
     let app = build_admin_router(state);
 
@@ -193,7 +201,7 @@ async fn admin_router_exposes_metrics() {
         .await
         .unwrap();
 
-    assert_eq!(response.status(), StatusCode::OK);
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
 }
 
 #[tokio::test]