diff --git a/src/Tgstation.Server.Host/Controllers/ApiRootController.cs b/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
index 5480c689d2..334eba85a4 100644
--- a/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ApiRootController.cs
@@ -27,8 +27,6 @@ using Tgstation.Server.Host.Swarm;
 using Tgstation.Server.Host.System;
 using Tgstation.Server.Host.Utils;
 
-#nullable disable
-
 namespace Tgstation.Server.Host.Controllers
 {
 	/// <summary>
@@ -215,7 +213,7 @@ namespace Tgstation.Server.Host.Controllers
 			if (ApiHeaders == null)
 			{
 				Response.Headers.Add(HeaderNames.WWWAuthenticate, new StringValues($"basic realm=\"Create TGS {ApiHeaders.BearerAuthenticationScheme} token\""));
-				return HeadersIssue(ApiHeadersProvider.HeadersException);
+				return HeadersIssue(ApiHeadersProvider.HeadersException!);
 			}
 
 			if (ApiHeaders.IsTokenAuthentication)
@@ -223,12 +221,12 @@ namespace Tgstation.Server.Host.Controllers
 
 			var oAuthLogin = ApiHeaders.OAuthProvider.HasValue;
 
-			ISystemIdentity systemIdentity = null;
+			ISystemIdentity? systemIdentity = null;
 			if (!oAuthLogin)
 				try
 				{
 					// trust the system over the database because a user's name can change while still having the same SID
-					systemIdentity = await systemIdentityFactory.CreateSystemIdentity(ApiHeaders.Username, ApiHeaders.Password, cancellationToken);
+					systemIdentity = await systemIdentityFactory.CreateSystemIdentity(ApiHeaders.Username!, ApiHeaders.Password!, cancellationToken);
 				}
 				catch (NotImplementedException)
 				{
@@ -241,8 +239,8 @@ namespace Tgstation.Server.Host.Controllers
 				IQueryable<Models.User> query = DatabaseContext.Users.AsQueryable();
 				if (oAuthLogin)
 				{
-					var oAuthProvider = ApiHeaders.OAuthProvider.Value;
-					string externalUserId;
+					var oAuthProvider = ApiHeaders.OAuthProvider!.Value;
+					string? externalUserId;
 					try
 					{
 						var validator = oAuthProviders
@@ -313,7 +311,7 @@ namespace Tgstation.Server.Host.Controllers
 					if (!usingSystemIdentity)
 					{
 						// DB User password check and update
-						if (!isLikelyDbUser || !cryptographySuite.CheckUserPassword(user, ApiHeaders.Password))
+						if (!isLikelyDbUser || !cryptographySuite.CheckUserPassword(user, ApiHeaders.Password!))
 							return Unauthorized();
 						if (user.PasswordHash != originalHash)
 						{
@@ -329,7 +327,7 @@ namespace Tgstation.Server.Host.Controllers
 					}
 					else
 					{
-						var usernameMismatch = systemIdentity.Username != user.Name;
+						var usernameMismatch = systemIdentity!.Username != user.Name;
 						if (isLikelyDbUser || usernameMismatch)
 						{
 							DatabaseContext.Users.Attach(user);
@@ -354,7 +352,7 @@ namespace Tgstation.Server.Host.Controllers
 					}
 
 				// Now that the bookeeping is done, tell them to fuck off if necessary
-				if (!user.Enabled.Value)
+				if (!user.Enabled!.Value)
 				{
 					Logger.LogTrace("Not logging in disabled user {userId}.", user.Id);
 					return Forbid();
@@ -367,7 +365,7 @@ namespace Tgstation.Server.Host.Controllers
 					var identExpiry = token.ParseJwt().ValidTo;
 					identExpiry += tokenFactory.ValidationParameters.ClockSkew;
 					identExpiry += TimeSpan.FromSeconds(15);
-					identityCache.CacheSystemIdentity(user, systemIdentity, identExpiry);
+					identityCache.CacheSystemIdentity(user, systemIdentity!, identExpiry);
 				}
 
 				Logger.LogDebug("Successfully logged in user {userId}!", user.Id);