diff --git a/internal/handler/system.go b/internal/handler/system.go
index f385ff69c9..e08be930eb 100644
--- a/internal/handler/system.go
+++ b/internal/handler/system.go
@@ -75,7 +75,7 @@ func (h *SystemHandler) Healthz(c *gin.Context) {
 // @Success 200 {object} map[string]interface{}
 // @Router /api/v1/system/config [get]
 func (h *SystemHandler) GetConfig(c *gin.Context) {
-	config, err := h.systemService.GetConfig()
+	config, err := h.systemService.GetConfig(c.Request.Context())
 	if err != nil {
 		common.Respond(c, http.StatusInternalServerError, 500, nil, "Failed to get system configuration")
 		return
diff --git a/internal/service/stub.go b/internal/service/stub.go
index cdc8817549..4e7e9060e2 100644
--- a/internal/service/stub.go
+++ b/internal/service/stub.go
@@ -28,6 +28,17 @@ import (
 	"gorm.io/gorm"
 )
 
+// configExtras is empty in the community edition.
+type configExtras struct{}
+
+// loadConfigExtras returns no additional settings in the community edition.
+func loadConfigExtras(context.Context) (configExtras, error) { return configExtras{}, nil }
+
+// consumeRegistrationProof is a no-op in the community edition.
+func consumeRegistrationProof(context.Context, string) (common.ErrorCode, error) {
+	return common.CodeSuccess, nil
+}
+
 // InitHTTPClientEE is a no-op in the community edition.
 func (h *AdminClient) InitHTTPClientEE() error { return nil }
 
diff --git a/internal/service/system.go b/internal/service/system.go
index e0587a91b8..97b8e87798 100644
--- a/internal/service/system.go
+++ b/internal/service/system.go
@@ -43,14 +43,20 @@ func NewSystemService() *SystemService {
 type ConfigResponse struct {
 	EnableRegister       bool `json:"registerEnabled"`
 	DisablePasswordLogin bool `json:"disablePasswordLogin"`
+	configExtras
 }
 
 // GetConfig get system configuration
-func (s *SystemService) GetConfig() (*ConfigResponse, error) {
+func (s *SystemService) GetConfig(ctx context.Context) (*ConfigResponse, error) {
 	cfg := server.GetConfig()
+	extras, err := loadConfigExtras(ctx)
+	if err != nil {
+		return nil, err
+	}
 	return &ConfigResponse{
 		EnableRegister:       cfg.EnableRegister(),
 		DisablePasswordLogin: cfg.DisablePasswordLogin(),
+		configExtras:         extras,
 	}, nil
 }
 
diff --git a/internal/service/user.go b/internal/service/user.go
index 14d93c9a47..908fe392e1 100644
--- a/internal/service/user.go
+++ b/internal/service/user.go
@@ -136,6 +136,12 @@ func (s *UserService) Register(ctx context.Context, req *RegisterRequest) (*enti
 	if err != nil {
 		return nil, common.CodeExceptionError, err
 	}
+	// Admission policies are checked by middleware before this service runs.
+	// This hook may consume a single-use proof, so reject duplicate accounts
+	// and invalid encrypted passwords before calling it.
+	if code, err := consumeRegistrationProof(ctx, req.Email); err != nil {
+		return nil, code, err
+	}
 
 	var hashedPassword string
 	hashedPassword, err = common.GenerateWerkzeugPasswordHash(decryptedPassword)