diff --git a/server/channels/api4/config_local.go b/server/channels/api4/config_local.go
index 35afa6c575..3def645a20 100644
--- a/server/channels/api4/config_local.go
+++ b/server/channels/api4/config_local.go
@@ -64,12 +64,6 @@ func localUpdateConfig(c *Context, w http.ResponseWriter, r *http.Request) {
 
 	appCfg := c.App.Config()
 
-	// Do not allow plugin uploads to be toggled through the API
-	cfg.PluginSettings.EnableUploads = appCfg.PluginSettings.EnableUploads
-
-	// Do not allow certificates to be changed through the API
-	cfg.PluginSettings.SignaturePublicKeyFiles = appCfg.PluginSettings.SignaturePublicKeyFiles
-
 	c.App.HandleMessageExportConfig(cfg, appCfg)
 
 	appErr := cfg.IsValid()
diff --git a/server/channels/api4/config_test.go b/server/channels/api4/config_test.go
index 2389c5feb4..cdba26fa54 100644
--- a/server/channels/api4/config_test.go
+++ b/server/channels/api4/config_test.go
@@ -196,34 +196,70 @@ func TestUpdateConfig(t *testing.T) {
 			CheckBadRequestStatus(t, resp)
 			CheckErrorID(t, err, "model.config.is_valid.password_length.app_error")
 		})
+	})
 
-		t.Run("Should not be able to modify PluginSettings.EnableUploads", func(t *testing.T) {
+	t.Run("Ensure PluginSettings.EnableUploads settings are protected", func(t *testing.T) {
+		t.Run("sysadmin", func(t *testing.T) {
 			oldEnableUploads := *th.App.Config().PluginSettings.EnableUploads
 			*cfg.PluginSettings.EnableUploads = !oldEnableUploads
 
-			cfg, _, err = client.UpdateConfig(context.Background(), cfg)
+			cfg, _, err = th.SystemAdminClient.UpdateConfig(context.Background(), cfg)
 			require.NoError(t, err)
 			assert.Equal(t, oldEnableUploads, *cfg.PluginSettings.EnableUploads)
 			assert.Equal(t, oldEnableUploads, *th.App.Config().PluginSettings.EnableUploads)
 
 			cfg.PluginSettings.EnableUploads = nil
-			cfg, _, err = client.UpdateConfig(context.Background(), cfg)
+			cfg, _, err = th.SystemAdminClient.UpdateConfig(context.Background(), cfg)
 			require.NoError(t, err)
 			assert.Equal(t, oldEnableUploads, *cfg.PluginSettings.EnableUploads)
 			assert.Equal(t, oldEnableUploads, *th.App.Config().PluginSettings.EnableUploads)
 		})
 
-		t.Run("Should not be able to modify PluginSettings.SignaturePublicKeyFiles", func(t *testing.T) {
+		t.Run("local mode", func(t *testing.T) {
+			oldEnableUploads := *th.App.Config().PluginSettings.EnableUploads
+			*cfg.PluginSettings.EnableUploads = !oldEnableUploads
+
+			cfg, _, err = th.LocalClient.UpdateConfig(context.Background(), cfg)
+			require.NoError(t, err)
+			assert.NotEqual(t, oldEnableUploads, *cfg.PluginSettings.EnableUploads)
+			assert.NotEqual(t, oldEnableUploads, *th.App.Config().PluginSettings.EnableUploads)
+
+			cfg.PluginSettings.EnableUploads = nil
+			cfg, _, err = th.LocalClient.UpdateConfig(context.Background(), cfg)
+			require.NoError(t, err)
+			assert.Equal(t, oldEnableUploads, *cfg.PluginSettings.EnableUploads)
+			assert.Equal(t, oldEnableUploads, *th.App.Config().PluginSettings.EnableUploads)
+		})
+	})
+
+	t.Run("Should not be able to modify PluginSettings.SignaturePublicKeyFiles", func(t *testing.T) {
+		t.Run("sysadmin", func(t *testing.T) {
 			oldPublicKeys := th.App.Config().PluginSettings.SignaturePublicKeyFiles
 			cfg.PluginSettings.SignaturePublicKeyFiles = append(cfg.PluginSettings.SignaturePublicKeyFiles, "new_signature")
 
-			cfg, _, err = client.UpdateConfig(context.Background(), cfg)
+			cfg, _, err = th.SystemAdminClient.UpdateConfig(context.Background(), cfg)
 			require.NoError(t, err)
 			assert.Equal(t, oldPublicKeys, cfg.PluginSettings.SignaturePublicKeyFiles)
 			assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
 
 			cfg.PluginSettings.SignaturePublicKeyFiles = nil
-			cfg, _, err = client.UpdateConfig(context.Background(), cfg)
+			cfg, _, err = th.SystemAdminClient.UpdateConfig(context.Background(), cfg)
+			require.NoError(t, err)
+			assert.Equal(t, oldPublicKeys, cfg.PluginSettings.SignaturePublicKeyFiles)
+			assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
+		})
+
+		t.Run("local mode", func(t *testing.T) {
+			oldPublicKeys := th.App.Config().PluginSettings.SignaturePublicKeyFiles
+			cfg.PluginSettings.SignaturePublicKeyFiles = append(cfg.PluginSettings.SignaturePublicKeyFiles, "new_signature")
+
+			cfg, _, err = th.LocalClient.UpdateConfig(context.Background(), cfg)
+			require.NoError(t, err)
+			assert.NotEqual(t, oldPublicKeys, cfg.PluginSettings.SignaturePublicKeyFiles)
+			assert.NotEqual(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)
+
+			cfg.PluginSettings.SignaturePublicKeyFiles = nil
+			cfg, _, err = th.LocalClient.UpdateConfig(context.Background(), cfg)
 			require.NoError(t, err)
 			assert.Equal(t, oldPublicKeys, cfg.PluginSettings.SignaturePublicKeyFiles)
 			assert.Equal(t, oldPublicKeys, th.App.Config().PluginSettings.SignaturePublicKeyFiles)