diff -Naur /var/www/arvados-api/current/app/models/user.rb arvados-api/current/app/models/user.rb
--- /var/www/arvados-api/current/app/models/user.rb	2026-03-02 13:28:02.000000000 +0100
+++ arvados-api/current/app/models/user.rb	2025-12-09 14:20:54.000000000 +0100
@@ -202,6 +202,8 @@
   # having can_manage on another user.
   def self.all_group_permissions
     all_perms = {}
+    ActiveRecord::Base.connection.exec_query("SET enable_hashjoin=off")
+    ActiveRecord::Base.connection.exec_query("SET enable_mergejoin=off")
     ActiveRecord::Base.connection.
       exec_query(%{
 SELECT user_uuid, target_uuid, perm_level
@@ -214,6 +216,8 @@
       all_perms[user_uuid] ||= {}
       all_perms[user_uuid][group_uuid] = PERMS_FOR_VAL[max_p_val.to_i]
     end
+    ActiveRecord::Base.connection.exec_query("SET enable_hashjoin=on")
+    ActiveRecord::Base.connection.exec_query("SET enable_mergejoin=on")
     all_perms
   end
 
@@ -223,6 +227,8 @@
   def group_permissions(level=1)
     @group_perms ||= {}
     if @group_perms.empty?
+      ActiveRecord::Base.connection.exec_query("SET enable_hashjoin=off")
+      ActiveRecord::Base.connection.exec_query("SET enable_mergejoin=off")
       user_uuids_subquery = USER_UUIDS_SUBQUERY_TEMPLATE % {user: "$1", perm_level: 1}
 
       ActiveRecord::Base.connection.
@@ -238,6 +244,8 @@
         rows.each do |group_uuid, max_p_val|
         @group_perms[group_uuid] = PERMS_FOR_VAL[max_p_val.to_i]
       end
+      ActiveRecord::Base.connection.exec_query("SET enable_hashjoin=on")
+      ActiveRecord::Base.connection.exec_query("SET enable_mergejoin=on")
     end
 
     case level
diff -Naur /var/www/arvados-api/current/app/models/workflow.rb arvados-api/current/app/models/workflow.rb
--- /var/www/arvados-api/current/app/models/workflow.rb	2026-03-02 13:28:02.000000000 +0100
+++ arvados-api/current/app/models/workflow.rb	2025-11-26 18:02:39.000000000 +0100
@@ -84,7 +84,19 @@
 
   def self.readable_by(*users_list)
     return super if users_list.select { |u| u.is_a?(User) && u.is_admin }.any?
-    super.where(collection_uuid: nil).or(where(Collection.readable_by(*users_list).where("collections.uuid = workflows.collection_uuid").arel.exists))
+#    super.where(collection_uuid: nil).or(where(Collection.readable_by(*users_list).where("collections.uuid = workflows.collection_uuid").arel.exists))
+    base = super
+
+    left  = base.where(collection_uuid: nil)
+  
+    right = base.where(
+      Collection.readable_by(*users_list)
+                .where("collections.uuid = workflows.collection_uuid")
+                .arel
+                .exists
+    )
+  
+    left.or(right)
   end
 
 end