diff --git a/backend/e2e-test/routes/v2/service-token.spec.ts b/backend/e2e-test/routes/v2/service-token.spec.ts
index a07eda4b9..6cc8f6e34 100644
--- a/backend/e2e-test/routes/v2/service-token.spec.ts
+++ b/backend/e2e-test/routes/v2/service-token.spec.ts
@@ -510,7 +510,7 @@ describe("Service token fail cases", async () => {
         authorization: `Bearer ${serviceToken}`
       }
     });
-    expect(fetchSecrets.statusCode).toBe(401);
+    expect(fetchSecrets.statusCode).toBe(403);
     expect(fetchSecrets.json().error).toBe("PermissionDenied");
     await deleteServiceToken();
   });
@@ -532,7 +532,7 @@ describe("Service token fail cases", async () => {
         authorization: `Bearer ${serviceToken}`
       }
     });
-    expect(fetchSecrets.statusCode).toBe(401);
+    expect(fetchSecrets.statusCode).toBe(403);
     expect(fetchSecrets.json().error).toBe("PermissionDenied");
     await deleteServiceToken();
   });
@@ -557,7 +557,7 @@ describe("Service token fail cases", async () => {
         authorization: `Bearer ${serviceToken}`
       }
     });
-    expect(writeSecrets.statusCode).toBe(401);
+    expect(writeSecrets.statusCode).toBe(403);
     expect(writeSecrets.json().error).toBe("PermissionDenied");
 
     // but read access should still work fine
diff --git a/backend/e2e-test/routes/v3/secrets.spec.ts b/backend/e2e-test/routes/v3/secrets.spec.ts
index e7e271279..c035692ed 100644
--- a/backend/e2e-test/routes/v3/secrets.spec.ts
+++ b/backend/e2e-test/routes/v3/secrets.spec.ts
@@ -1075,7 +1075,7 @@ describe("Secret V3 Raw Router Without E2EE enabled", async () => {
       },
       body: createSecretReqBody
     });
-    expect(createSecRes.statusCode).toBe(400);
+    expect(createSecRes.statusCode).toBe(404);
   });
 
   test("Update secret raw", async () => {
@@ -1093,7 +1093,7 @@ describe("Secret V3 Raw Router Without E2EE enabled", async () => {
       },
       body: updateSecretReqBody
     });
-    expect(updateSecRes.statusCode).toBe(400);
+    expect(updateSecRes.statusCode).toBe(404);
   });
 
   test("Delete secret raw", async () => {
@@ -1110,6 +1110,6 @@ describe("Secret V3 Raw Router Without E2EE enabled", async () => {
       },
       body: deletedSecretReqBody
     });
-    expect(deletedSecRes.statusCode).toBe(400);
+    expect(deletedSecRes.statusCode).toBe(404);
   });
 });
diff --git a/backend/src/server/routes/sanitizedSchemas.ts b/backend/src/server/routes/sanitizedSchemas.ts
index 562772b88..54dc9515c 100644
--- a/backend/src/server/routes/sanitizedSchemas.ts
+++ b/backend/src/server/routes/sanitizedSchemas.ts
@@ -30,38 +30,28 @@ export const integrationAuthPubSchema = IntegrationAuthsSchema.pick({
 export const DefaultResponseErrorsSchema = {
   400: z.object({
     statusCode: z.literal(400),
-    message: z.literal(
-      `<string>: Contains a human-readable message about what went wrong. 400 errors are bad request errors, and are will occur to happen when passing or unexpected bad data in the request`
-    ),
-    error: z.literal(`<string>: Contains a human-readable error name.`)
+    message: z.string(),
+    error: z.string()
   }),
   404: z.object({
     statusCode: z.literal(404),
-    message: z.literal(
-      `<string>: Contains a human-readable message about what went wrong. 404 errors are not found errors, and will occur when a resource is not found`
-    ),
-    error: z.literal(`<string>: Contains a human-readable error name.`)
+    message: z.string(),
+    error: z.string()
   }),
   401: z.object({
     statusCode: z.literal(401),
-    message: z.literal(
-      `<string>: Contains a human-readable message about what went wrong. 401 errors are unauthorized errors, and will occur when attempting to access a resource with invalid or missing credentials`
-    ),
-    error: z.literal(`<string>: Contains a human-readable error name.`)
+    message: z.string(),
+    error: z.string()
   }),
   403: z.object({
     statusCode: z.literal(403),
     message: z.any(),
-    error: z.literal(
-      `<string>: Contains a human-readable error name. The message can be both an object or a string. It will always be a string except if the error is happening due to a request validation error.`
-    )
+    error: z.string()
   }),
   500: z.object({
     statusCode: z.literal(500),
-    message: z.literal(
-      `<string>: Contains a human-readable message about what went wrong. 500 errors are internal server errors, and will occur when an unexpected error occurs on the server`
-    ),
-    error: z.literal(`<string>: Contains a human-readable error name.`)
+    message: z.string(),
+    error: z.string()
   })
 };