diff --git a/apps/api/src/routes/appointments.ts b/apps/api/src/routes/appointments.ts
index 59723f2..c693325 100644
--- a/apps/api/src/routes/appointments.ts
+++ b/apps/api/src/routes/appointments.ts
@@ -73,7 +73,7 @@ appointmentsRouter.get("/", async (c) => {
   const to = c.req.query("to");
   const staffId = c.req.query("staffId");
   const staffRow = c.get("staff");
-  const isGroomer = staffRow.role === "groomer";
+  const isGroomer = staffRow?.role === "groomer";
 
   const conditions = [];
   if (from) conditions.push(gte(appointments.startTime, new Date(from)));
@@ -108,7 +108,7 @@ appointmentsRouter.get("/", async (c) => {
 appointmentsRouter.get("/:id", async (c) => {
   const db = getDb();
   const staffRow = c.get("staff");
-  const isGroomer = staffRow.role === "groomer";
+  const isGroomer = staffRow?.role === "groomer";
   const [row] = await db
     .select()
     .from(appointments)
diff --git a/apps/api/src/routes/portal.ts b/apps/api/src/routes/portal.ts
index 4d6284f..65960df 100644
--- a/apps/api/src/routes/portal.ts
+++ b/apps/api/src/routes/portal.ts
@@ -134,6 +134,10 @@ portalRouter.post("/appointments/:id/confirm", async (c) => {
     .where(eq(appointments.id, id))
     .returning();
 
+  if (!updated) {
+    return c.json({ error: "Not found" }, 404);
+  }
+
   return c.json({
     id: updated.id,
     confirmationStatus: updated.confirmationStatus,
@@ -194,6 +198,10 @@ portalRouter.post("/appointments/:id/cancel", async (c) => {
     .where(eq(appointments.id, id))
     .returning();
 
+  if (!updated) {
+    return c.json({ error: "Not found" }, 404);
+  }
+
   return c.json({
     id: updated.id,
     status: updated.status,