diff --git a/app/graphql/types/mfa_status_type.rb b/app/graphql/types/mfa_status_type.rb
index aa7632bd..68194d3d 100644
--- a/app/graphql/types/mfa_status_type.rb
+++ b/app/graphql/types/mfa_status_type.rb
@@ -5,6 +5,7 @@ class MfaStatusType < Types::BaseObject
     description 'Represents the MFA status of a user'
 
     authorize :read_mfa_status
+    declarative_policy_subject { |obj| obj[:user] }
 
     field :enabled, Boolean, null: false,
                              description: 'Indicates whether MFA is enabled for the user.'
diff --git a/app/graphql/types/user_type.rb b/app/graphql/types/user_type.rb
index 33ab985d..225ec575 100644
--- a/app/graphql/types/user_type.rb
+++ b/app/graphql/types/user_type.rb
@@ -75,6 +75,7 @@ def mfa_status
         enabled: object.mfa_enabled?,
         totp_enabled: object.totp_secret.present?,
         backup_codes_count: object.backup_codes.size,
+        user: object,
       }
     end
   end