diff --git a/client/vnc/server/server.go b/client/vnc/server/server.go
index 09112ce57..ba3c4b539 100644
--- a/client/vnc/server/server.go
+++ b/client/vnc/server/server.go
@@ -871,8 +871,8 @@ func (s *Server) readConnectionHeader(conn net.Conn) (*connectionHeader, error)
 // public key learned from the handshake. Any handshake failure is fatal
 // (fail closed).
 func (s *Server) maybeRunNoiseHandshake(conn net.Conn, br *bufio.Reader) ([]byte, bool, error) {
-	peek, err := br.Peek(len(vncIdentityMagic))
-	if err != nil || !bytes.Equal(peek, vncIdentityMagic) {
+	peek, _ := br.Peek(len(vncIdentityMagic))
+	if !bytes.Equal(peek, vncIdentityMagic) {
 		return nil, false, nil
 	}
 	if _, err := br.Discard(len(vncIdentityMagic)); err != nil {
diff --git a/management/server/http/handlers/peers/peers_handler.go b/management/server/http/handlers/peers/peers_handler.go
index 60263db4e..e6f218f0d 100644
--- a/management/server/http/handlers/peers/peers_handler.go
+++ b/management/server/http/handlers/peers/peers_handler.go
@@ -518,7 +518,11 @@ func (h *Handler) CreateTemporaryAccess(w http.ResponseWriter, r *http.Request)
 		if protocol == types.PolicyRuleProtocolNetbirdSSH || protocol == types.PolicyRuleProtocolNetbirdVNC {
 			policy.Rules[0].AuthorizedUser = userAuth.UserId
 		}
-		if protocol == types.PolicyRuleProtocolNetbirdVNC && req.SessionPubKey != nil {
+		if protocol == types.PolicyRuleProtocolNetbirdVNC {
+			if req.SessionPubKey == nil || *req.SessionPubKey == "" {
+				util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is required for VNC temporary access"), w)
+				return
+			}
 			pub, err := base64.StdEncoding.DecodeString(*req.SessionPubKey)
 			if err != nil {
 				util.WriteError(r.Context(), status.Errorf(status.InvalidArgument, "session_pub_key is not valid base64: %v", err), w)
diff --git a/management/server/types/policy_authorized_users.go b/management/server/types/policy_authorized_users.go
index 16337590f..cd5500bad 100644
--- a/management/server/types/policy_authorized_users.go
+++ b/management/server/types/policy_authorized_users.go
@@ -81,7 +81,7 @@ func (cb ruleAuthCallbacks) handleVNCRule(rule *PolicyRule, peerInSources, peerI
 		return
 	}
 	cb.collectVNCUsers(rule, state.vncAuthorizedUsers)
-	if rule.SessionPubKey != "" && rule.AuthorizedUser != "" {
+	if peerInDestinations && rule.SessionPubKey != "" && rule.AuthorizedUser != "" {
 		state.vncSessionPubKeys = append(state.vncSessionPubKeys, VNCSessionPubKey{
 			PubKey: rule.SessionPubKey,
 			UserID: rule.AuthorizedUser,