diff --git a/backend/database.go b/backend/database.go
index 0b65fe7..dfe25e9 100644
--- a/backend/database.go
+++ b/backend/database.go
@@ -860,16 +860,12 @@ func (d *Database) deleteAssetsNotIn(ctx context.Context, userID string, assetID
 	if err := bulkInsertTemp(ctx, tx, "tmpKeepAssets", assetIDs); err != nil {
 		return fmt.Errorf("populate temp table: %w", err)
 	}
-	defer func() {
-		if _, err := tx.ExecContext(ctx, "DROP TABLE IF EXISTS tmpKeepAssets"); err != nil {
-			log.Printf("[DB] Failed to drop temp table: %v", err)
-		}
-	}()
 
 	if _, err := tx.ExecContext(ctx, "DELETE FROM assets WHERE userID = ? AND immichID NOT IN (SELECT val FROM tmpKeepAssets)", userID); err != nil {
 		return fmt.Errorf("delete stale assets: %w", err)
 	}
 
+	tx.ExecContext(ctx, "DROP TABLE IF EXISTS tmpKeepAssets")
 	return tx.Commit()
 }
 
diff --git a/backend/syncService.go b/backend/syncService.go
index 2c2223e..84c1533 100644
--- a/backend/syncService.go
+++ b/backend/syncService.go
@@ -217,7 +217,13 @@ func (s *SyncService) doUserFullSync(ctx context.Context, userID string, immich
 
 	s.syncStacks(ctx, userID, immich)
 	if err := s.syncLibraries(ctx, userID, immich); err != nil {
-		log.Printf("[Sync] Library sync failed during full sync for user %s: %v", userID, err)
+		// A 401/403 only means the key is not an admin key: syncLibraries already logs
+		// that as an expected condition, so don't repeat it here as a failure.
+		var httpErr *ImmichHTTPError
+		isMissingAccess := errors.As(err, &httpErr) && (httpErr.StatusCode == http.StatusUnauthorized || httpErr.StatusCode == http.StatusForbidden)
+		if !isMissingAccess {
+			log.Printf("[Sync] Library sync failed during full sync for user %s: %v", userID, err)
+		}
 		s.db.deleteSyncState(ctx, userID, "libraryIDBackfillDone")
 	} else {
 		if err := s.db.setSyncState(ctx, userID, "libraryIDBackfillDone", "true"); err != nil {