diff --git a/src/components/documents/folder-tree-sidebar.tsx b/src/components/documents/folder-tree-sidebar.tsx
index dff1d558..663cb33e 100644
--- a/src/components/documents/folder-tree-sidebar.tsx
+++ b/src/components/documents/folder-tree-sidebar.tsx
@@ -122,6 +122,8 @@ function FolderRow({
         <button
           type="button"
           aria-label={open ? 'Collapse' : 'Expand'}
+          aria-hidden={!hasChildren}
+          tabIndex={hasChildren ? 0 : -1}
           onClick={() => setOpen((o) => !o)}
           className={cn(
             'flex h-5 w-5 items-center justify-center text-muted-foreground hover:text-foreground',
diff --git a/src/lib/services/document-folders.service.ts b/src/lib/services/document-folders.service.ts
index f3770662..fda8c515 100644
--- a/src/lib/services/document-folders.service.ts
+++ b/src/lib/services/document-folders.service.ts
@@ -136,7 +136,7 @@ export async function renameFolder(
     const [updated] = await db
       .update(documentFolders)
       .set({ name: trimmed, updatedAt: new Date() })
-      .where(eq(documentFolders.id, folderId))
+      .where(and(eq(documentFolders.id, folderId), eq(documentFolders.portId, portId)))
       .returning();
     if (!updated) throw new NotFoundError('Folder');
 
@@ -209,7 +209,7 @@ export async function moveFolder(
     const [updated] = await db
       .update(documentFolders)
       .set({ parentId: newParentId, updatedAt: new Date() })
-      .where(eq(documentFolders.id, folderId))
+      .where(and(eq(documentFolders.id, folderId), eq(documentFolders.portId, portId)))
       .returning();
     if (!updated) throw new NotFoundError('Folder');
 
@@ -262,7 +262,9 @@ export async function deleteFolderSoftRescue(
       .set({ folderId: newParent })
       .where(and(eq(documents.folderId, folderId), eq(documents.portId, portId)));
 
-    await tx.delete(documentFolders).where(eq(documentFolders.id, folderId));
+    await tx
+      .delete(documentFolders)
+      .where(and(eq(documentFolders.id, folderId), eq(documentFolders.portId, portId)));
   });
 
   void createAuditLog({