diff --git a/nest-backend/src/app.ts b/nest-backend/src/app.ts
index 9cca0aa..67c430c 100644
--- a/nest-backend/src/app.ts
+++ b/nest-backend/src/app.ts
@@ -7,6 +7,7 @@ import bugsRouter from './routes/bugs.js';
 import feedRouter from './routes/feed.js';
 import eventsRouter from './routes/events.js';
 import teamRouter from './routes/team.js';
+import settingsRouter from './routes/settings.js';
 
 const app = express();
 
@@ -122,6 +123,7 @@ app.use('/api/bugs', bugsRouter);
 app.use('/api/feed', feedRouter);
 app.use('/api/events', eventsRouter);
 app.use('/api/team', teamRouter);
+app.use('/api/settings', settingsRouter);
 
 // 404
 app.use((_req, res) => res.status(404).json({ error: 'Not found' }));
diff --git a/nest-backend/src/routes/settings.ts b/nest-backend/src/routes/settings.ts
new file mode 100644
index 0000000..684fd3f
--- /dev/null
+++ b/nest-backend/src/routes/settings.ts
@@ -0,0 +1,44 @@
+import { Router } from 'express';
+import type { Request, Response } from 'express';
+import prisma from '../lib/prisma.js';
+import { authenticate, requireAdmin } from '../middleware/auth.js';
+
+const router = Router();
+
+function getOrCreateSettings() {
+  return prisma.siteSettings.upsert({
+    where: { id: 1 },
+    update: {},
+    create: { id: 1 },
+  });
+}
+
+// GET /api/settings — public
+router.get('/', async (_req: Request, res: Response): Promise<void> => {
+  const settings = await getOrCreateSettings();
+  res.json({ forumEnabled: settings.forumEnabled, bugsEnabled: settings.bugsEnabled });
+});
+
+// PATCH /api/settings — admin only
+router.patch('/', authenticate, requireAdmin, async (req: Request, res: Response): Promise<void> => {
+  const { forumEnabled, bugsEnabled } = req.body as { forumEnabled?: unknown; bugsEnabled?: unknown };
+
+  const data: { forumEnabled?: boolean; bugsEnabled?: boolean } = {};
+  if (typeof forumEnabled === 'boolean') data.forumEnabled = forumEnabled;
+  if (typeof bugsEnabled === 'boolean') data.bugsEnabled = bugsEnabled;
+
+  if (Object.keys(data).length === 0) {
+    res.status(400).json({ error: 'No valid fields to update' });
+    return;
+  }
+
+  const settings = await prisma.siteSettings.upsert({
+    where: { id: 1 },
+    update: data,
+    create: { id: 1, ...data },
+  });
+
+  res.json({ forumEnabled: settings.forumEnabled, bugsEnabled: settings.bugsEnabled });
+});
+
+export default router;