diff --git a/pkg/auth/auth_check.go b/pkg/auth/auth_check.go
index f7857c67..50c13d3d 100644
--- a/pkg/auth/auth_check.go
+++ b/pkg/auth/auth_check.go
@@ -125,7 +125,8 @@ func CheckACLs(cmd *cobra.Command, f *cmdutil.Factory) error {
 	}
 	apiKey, err := client.GetApiKey(client.NewApiGetApiKeyRequest(key))
 	if err != nil {
-		return err
+		// Self-read requires its own ACL; don't fail on that, let the real call decide.
+		return nil
 	}
 
 	var hasAcls []string
diff --git a/pkg/auth/auth_check_test.go b/pkg/auth/auth_check_test.go
index fac8075a..9aad0996 100644
--- a/pkg/auth/auth_check_test.go
+++ b/pkg/auth/auth_check_test.go
@@ -71,6 +71,7 @@ func Test_CheckACLs(t *testing.T) {
 		cmd            *cobra.Command
 		adminKey       bool
 		ACLs           []search.Acl
+		selfReadFails  bool
 		wantErr        bool
 		wantErrMessage string
 	}{
@@ -132,6 +133,29 @@ See https://www.algolia.com/doc/guides/security/api-keys/#rights-and-restriction
 			ACLs:     []search.Acl{search.ACL_SEARCH},
 			wantErr:  false,
 		},
+		{
+			name: "self-read fails, need non-admin ACLs",
+			cmd: &cobra.Command{
+				Annotations: map[string]string{
+					"acls": "settings",
+				},
+			},
+			adminKey:      false,
+			selfReadFails: true,
+			wantErr:       false,
+		},
+		{
+			name: "self-read fails, need admin key",
+			cmd: &cobra.Command{
+				Annotations: map[string]string{
+					"acls": "admin",
+				},
+			},
+			adminKey:       false,
+			selfReadFails:  true,
+			wantErr:        true,
+			wantErrMessage: "this command requires an admin API key. Use the `--api-key` flag with a valid admin API key",
+		},
 	}
 
 	for _, tt := range tests {
@@ -149,7 +173,12 @@ See https://www.algolia.com/doc/guides/security/api-keys/#rights-and-restriction
 				)
 			}
 
-			if tt.ACLs != nil && !tt.adminKey {
+			if tt.selfReadFails && !tt.adminKey {
+				r.Register(
+					httpmock.REST("GET", "1/keys/test"),
+					httpmock.ErrorResponse(),
+				)
+			} else if tt.ACLs != nil && !tt.adminKey {
 				r.Register(
 					httpmock.REST("GET", "1/keys/test"),
 					httpmock.JSONResponse(search.ApiKey{Acl: tt.ACLs}),