diff --git a/app/controllers/messages/by_bots_controller.rb b/app/controllers/messages/by_bots_controller.rb
index 1d0c08a..e7762e8 100644
--- a/app/controllers/messages/by_bots_controller.rb
+++ b/app/controllers/messages/by_bots_controller.rb
@@ -5,6 +5,8 @@ class Messages::ByBotsController < MessagesController
     set_room
     @messages = find_paged_messages
     render json: messages_as_json(@messages)
+  rescue ActiveRecord::RecordNotFound
+    head :not_found
   end
 
   def create
diff --git a/test/controllers/messages/by_bots_controller_test.rb b/test/controllers/messages/by_bots_controller_test.rb
index e98207e..3ef0b08 100644
--- a/test/controllers/messages/by_bots_controller_test.rb
+++ b/test/controllers/messages/by_bots_controller_test.rb
@@ -93,6 +93,20 @@ class Messages::ByBotsControlleTest < ActionDispatch::IntegrationTest
     assert_response :redirect  # Redirects to login
   end
 
+  test "index returns 404 for room bot is not a member of" do
+    # bender bot is NOT a member of the designers room
+    room_without_bot = rooms(:designers)
+    get room_bot_messages_index_url(room_without_bot, users(:bender).bot_key)
+    assert_response :not_found
+  end
+
+  test "index works for room bot IS a member of" do
+    # bender bot IS a member of watercooler
+    room_with_bot = rooms(:watercooler)
+    get room_bot_messages_index_url(room_with_bot, users(:bender).bot_key)
+    assert_response :success
+  end
+
   test "regular messages index still denied for bots" do
     # The standard messages endpoint (not the bot-specific one) should still be forbidden
     get room_messages_url(@room, bot_key: users(:bender).bot_key)