diff --git a/api4/config.go b/api4/config.go
index ac03bbe9d8..7f9e9d56a2 100644
--- a/api4/config.go
+++ b/api4/config.go
@@ -228,7 +228,10 @@ func patchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	// Do not allow plugin uploads to be toggled through the API
-	cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads
+	if cfg.PluginSettings.EnableUploads != nil && *cfg.PluginSettings.EnableUploads != *appCfg.PluginSettings.EnableUploads {
+		c.Err = model.NewAppError("patchConfig", "api.config.update_config.not_allowed_security.app_error", map[string]interface{}{"Name": "PluginSettings.EnableUploads"}, "", http.StatusForbidden)
+		return
+	}
 
 	if cfg.MessageExportSettings.EnableExport != nil {
 		c.App.HandleMessageExportConfig(cfg, appCfg)
diff --git a/api4/config_local.go b/api4/config_local.go
index 4f4d42b87d..360f95a0a1 100644
--- a/api4/config_local.go
+++ b/api4/config_local.go
@@ -87,9 +87,6 @@ func localPatchConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 		return true
 	}
 
-	// Do not allow plugin uploads to be toggled through the API
-	cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads
-
 	if cfg.MessageExportSettings.EnableExport != nil {
 		c.App.HandleMessageExportConfig(cfg, appCfg)
 	}
diff --git a/api4/config_test.go b/api4/config_test.go
index 23945760dd..e6c305e9e6 100644
--- a/api4/config_test.go
+++ b/api4/config_test.go
@@ -633,9 +633,13 @@ func TestPatchConfig(t *testing.T) {
 				EnableUploads: model.NewBool(true),
 			}}
 
-			updatedConfig, _ := client.PatchConfig(&config)
-
-			assert.Equal(t, false, *updatedConfig.PluginSettings.EnableUploads)
+			updatedConfig, resp := client.PatchConfig(&config)
+			if client == th.LocalClient {
+				CheckOKStatus(t, resp)
+				assert.Equal(t, true, *updatedConfig.PluginSettings.EnableUploads)
+			} else {
+				CheckForbiddenStatus(t, resp)
+			}
 		})
 	})
 
diff --git a/i18n/en.json b/i18n/en.json
index 39adc8cec8..0ba67d7a4e 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -1142,6 +1142,10 @@
     "id": "api.config.update_config.clear_siteurl.app_error",
     "translation": "Site URL cannot be cleared."
   },
+  {
+    "id": "api.config.update_config.not_allowed_security.app_error",
+    "translation": "Changing {{.Name}} is not allowed due to security reasons."
+  },
   {
     "id": "api.config.update_config.restricted_merge.app_error",
     "translation": "Failed to merge given config."