diff --git a/hbd/server/settings.py b/hbd/server/settings.py
index 1286646..30b5df3 100644
--- a/hbd/server/settings.py
+++ b/hbd/server/settings.py
@@ -238,11 +238,11 @@ def get_settings_sections(config: dict, threshold_checker=None, user=None) -> li
 
     # ---- Users (show metadata only, never password hashes) ----------------
     users_list = []
-    for username, attrs in (config.get("users") or {}).items():
+    for uname, attrs in (config.get("users") or {}).items():
         if not isinstance(attrs, dict):
             continue
         users_list.append({
-            "username": username,
+            "username": uname,
             "full_name": attrs.get("full_name", ""),
             "admin": bool(attrs.get("admin", False)),
             "avatar": attrs.get("avatar", ""),
diff --git a/tests/test_settings_sections.py b/tests/test_settings_sections.py
index 59b4fea..7e1ed3b 100644
--- a/tests/test_settings_sections.py
+++ b/tests/test_settings_sections.py
@@ -191,3 +191,16 @@ def test_settings_data_pickers_filtered_for_nonadmin():
 def test_no_user_means_admin_view():
     sections = settings_mod.get_settings_sections(MULTI_CFG)  # auth disabled
     assert len(sections) > 3
+
+
+def test_filtering_unaffected_by_other_users_in_config():
+    """The users-section loop must not clobber the requesting username (regression)."""
+    cfg = dict(MULTI_CFG)
+    cfg["users"] = {
+        "alice": {"full_name": "Alice", "admin": True, "password": "x"},
+        "bob": {"full_name": "Bob", "admin": False, "password": "x"},
+        "zed": {"full_name": "Zed", "admin": False, "password": "x"},  # bob is not last
+    }
+    sections = settings_mod.get_settings_sections(cfg, user=BOB)
+    hosts = {h["name"] for h in next(s for s in sections if s["id"] == "hosts")["hosts"]}
+    assert hosts == {"bobhost", "managedhost"}