diff --git a/src/Tgstation.Server.Api/Models/Internal/Job.cs b/src/Tgstation.Server.Api/Models/Internal/Job.cs
index b4247221e1..42c6b071a6 100644
--- a/src/Tgstation.Server.Api/Models/Internal/Job.cs
+++ b/src/Tgstation.Server.Api/Models/Internal/Job.cs
@@ -59,6 +59,6 @@ namespace Tgstation.Server.Api.Models.Internal
 		/// The <see cref="Rights"/> required to cancel the <see cref="Job"/>
 		/// </summary>
 		[Permissions(DenyWrite = true)]
-		public int? CancelRight { get; set; }
+		public ulong? CancelRight { get; set; }
 	}
 }
\ No newline at end of file
diff --git a/src/Tgstation.Server.Host/Controllers/ApiController.cs b/src/Tgstation.Server.Host/Controllers/ApiController.cs
index 3ee9405cf6..ec175675a3 100644
--- a/src/Tgstation.Server.Host/Controllers/ApiController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ApiController.cs
@@ -103,7 +103,7 @@ namespace Tgstation.Server.Host.Controllers
 				//if there's no instance user, do a weird thing and add all the instance roles
 				//we need it so we can get to OnActionExecutionAsync where we can properly decide between BadRequest and Forbid
 				//if user is null that means they got the token with an expired password
-				var rightInt = authenticationContext.User == null || (RightsHelper.IsInstanceRight(I) && authenticationContext.InstanceUser == null) ? ~0 : authenticationContext.GetRight(I);
+				var rightInt = authenticationContext.User == null || (RightsHelper.IsInstanceRight(I) && authenticationContext.InstanceUser == null) ? ~0U : authenticationContext.GetRight(I);
 				var rightEnum = RightsHelper.RightToType(I);
 				var right = (Enum)Enum.ToObject(rightEnum, rightInt);
 				foreach (Enum J in Enum.GetValues(rightEnum))
diff --git a/src/Tgstation.Server.Host/Security/AuthenticationContext.cs b/src/Tgstation.Server.Host/Security/AuthenticationContext.cs
index 32ff73c8e3..d98d36c10f 100644
--- a/src/Tgstation.Server.Host/Security/AuthenticationContext.cs
+++ b/src/Tgstation.Server.Host/Security/AuthenticationContext.cs
@@ -59,7 +59,7 @@ namespace Tgstation.Server.Host.Security
 		public IAuthenticationContext Clone() => new AuthenticationContext(SystemIdentity.Clone(), User, InstanceUser);
 
 		/// <inheritdoc />
-		public int GetRight(RightsType rightsType)
+		public ulong GetRight(RightsType rightsType)
 		{
 			var isInstance = RightsHelper.IsInstanceRight(rightsType);
 
@@ -81,7 +81,7 @@ namespace Tgstation.Server.Host.Security
 			
 			if (right == null)
 				throw new InvalidOperationException("A user right was null!");
-			return (int)right;
+			return (ulong)right;
 		}
 	}
 }
diff --git a/src/Tgstation.Server.Host/Security/IAuthenticationContext.cs b/src/Tgstation.Server.Host/Security/IAuthenticationContext.cs
index 2b1ee41a25..23510b2804 100644
--- a/src/Tgstation.Server.Host/Security/IAuthenticationContext.cs
+++ b/src/Tgstation.Server.Host/Security/IAuthenticationContext.cs
@@ -24,7 +24,7 @@ namespace Tgstation.Server.Host.Security
 		/// </summary>
 		/// <param name="rightsType">The <see cref="RightsType"/> of the right to get</param>
 		/// <returns>The value of <paramref name="rightsType"/>. Note that if <see cref="InstanceUser"/> is <see langword="null"/> all <see cref="Instance"/> based rights will return 0</returns>
-		int GetRight(RightsType rightsType);
+		ulong GetRight(RightsType rightsType);
 
 		/// <summary>
 		/// The <see cref="ISystemIdentity"/> of <see cref="User"/> if applicable