diff --git a/packages/api/src/app/service.spec.ts b/packages/api/src/app/service.spec.ts
index f881b87354..03e9a60d73 100644
--- a/packages/api/src/app/service.spec.ts
+++ b/packages/api/src/app/service.spec.ts
@@ -254,6 +254,18 @@ describe('createAppConfigService', () => {
       expect(config).toEqual(deps._baseConfig);
     });
 
+    it('falls back to base config on buildPrincipals error', async () => {
+      const deps = createDeps({
+        getUserPrincipals: jest.fn().mockRejectedValue(new Error('principal lookup failed')),
+      });
+      const { getAppConfig } = createAppConfigService(deps);
+
+      const config = await getAppConfig({ userId: 'uid1', role: 'USER' });
+
+      expect(deps.getApplicableConfigs).not.toHaveBeenCalled();
+      expect(config).toEqual(deps._baseConfig);
+    });
+
     it('falls back to base config on getApplicableConfigs error', async () => {
       const deps = createDeps({
         getApplicableConfigs: jest.fn().mockRejectedValue(new Error('DB down')),
diff --git a/packages/api/src/app/service.ts b/packages/api/src/app/service.ts
index 29fda7df92..237a9f13f4 100644
--- a/packages/api/src/app/service.ts
+++ b/packages/api/src/app/service.ts
@@ -168,14 +168,20 @@ export function createAppConfigService(deps: AppConfigServiceDeps) {
       }
     }
 
+    let principals: Array<{ principalType: string; principalId?: string | Types.ObjectId }>;
     try {
-      const principals = await buildPrincipals(role, userId);
+      principals = await buildPrincipals(role, userId);
+    } catch (error) {
+      logger.error('[getAppConfig] Error building principals, falling back to base:', error);
+      return baseConfig;
+    }
 
-      if (principals.length === 0) {
-        await cache.set(cacheKey, baseConfig, overrideCacheTtl);
-        return baseConfig;
-      }
+    if (principals.length === 0) {
+      await cache.set(cacheKey, baseConfig, overrideCacheTtl);
+      return baseConfig;
+    }
 
+    try {
       const configs = await getApplicableConfigs(principals);
 
       if (configs.length === 0) {