diff --git a/integration/src/test/scala/org/knora/webapi/responders/admin/GroupsResponderADMSpec.scala b/integration/src/test/scala/org/knora/webapi/responders/admin/GroupsResponderADMSpec.scala
index 3c9615566e..36c9baed64 100644
--- a/integration/src/test/scala/org/knora/webapi/responders/admin/GroupsResponderADMSpec.scala
+++ b/integration/src/test/scala/org/knora/webapi/responders/admin/GroupsResponderADMSpec.scala
@@ -43,7 +43,7 @@ class GroupsResponderADMSpec extends CoreSpec {
       }
     }
 
-    "asked about a group identified by 'iri' " should {
+    "asked about a group identified by IRI " should {
       "return group info if the group is known " in {
         val iri      = GroupIri.unsafeFrom(imagesReviewerGroup.id)
         val response = UnsafeZioRun.runOrThrow(groupService(_.findById(iri)))
@@ -152,7 +152,7 @@ class GroupsResponderADMSpec extends CoreSpec {
         group.selfjoin should equal(false)
       }
 
-      "return 'NotFoundException' if a not-existing group IRI is submitted during update" in {
+      "return 'ForbiddenException' if a not-existing group IRI is submitted during update" in {
         val groupIri = "http://rdfh.ch/groups/0000/notexisting"
         val exit = UnsafeZioRun.run(
           groupRestService(
@@ -171,9 +171,9 @@ class GroupsResponderADMSpec extends CoreSpec {
             ),
           ),
         )
-        assertFailsWithA[NotFoundException](
+        assertFailsWithA[ForbiddenException](
           exit,
-          s"Group <$groupIri> not found.",
+          s"Group with IRI '$groupIri' not found",
         )
       }
 
diff --git a/webapi/src/main/scala/org/knora/webapi/slice/admin/api/service/GroupRestService.scala b/webapi/src/main/scala/org/knora/webapi/slice/admin/api/service/GroupRestService.scala
index 68aba0eb26..103d685c3b 100644
--- a/webapi/src/main/scala/org/knora/webapi/slice/admin/api/service/GroupRestService.scala
+++ b/webapi/src/main/scala/org/knora/webapi/slice/admin/api/service/GroupRestService.scala
@@ -62,13 +62,13 @@ final case class GroupRestService(
 
   def putGroup(iri: GroupIri, request: GroupUpdateRequest, user: User): Task[GroupGetResponseADM] =
     for {
+      _ <- auth.ensureSystemAdminOrProjectAdminOfGroup(user, iri)
       _ <- ZIO
              .fail(BadRequestException("No data would be changed. Aborting update request."))
              .when(List(request.name, request.descriptions, request.status, request.selfjoin).flatten.isEmpty)
       groupToUpdate <- groupService
                          .findById(iri)
                          .someOrFail(NotFoundException(s"Group <${iri.value}> not found."))
-      _        <- auth.ensureSystemAdminOrProjectAdminOfGroup(user, iri)
       internal <- groupService.updateGroup(groupToUpdate, request).map(GroupGetResponseADM.apply)
       external <- format.toExternalADM(internal)
     } yield external