diff --git a/openapi/openapi-generator/src/main/resources/openapi/templates/kora/javaServerSecuritySchema.mustache b/openapi/openapi-generator/src/main/resources/openapi/templates/kora/javaServerSecuritySchema.mustache
index c96846116..01720664d 100644
--- a/openapi/openapi-generator/src/main/resources/openapi/templates/kora/javaServerSecuritySchema.mustache
+++ b/openapi/openapi-generator/src/main/resources/openapi/templates/kora/javaServerSecuritySchema.mustache
@@ -80,7 +80,7 @@ public interface ApiSecurity {
                     future.complete({{#lambda.camelcase}}{{name}}{{/lambda.camelcase}}_principal);
                 } else {
                   {{#vendorExtensions.isLast}}
-                  future.completeExceptionally(HttpServerResponseException.of(403, "Forbidden"));
+                  future.completeExceptionally(HttpServerResponseException.of(401, "Unauthorized"));
                   {{/vendorExtensions.isLast}}
             {{/vendorExtensions.isFirst}}{{/methods}}{{#methods}}{{^vendorExtensions.isFirst}}{{#lambda.indented}}{{#isApiKey}}{{#isKeyInHeader}}
                 var {{#lambda.camelcase}}{{name}}{{/lambda.camelcase}}_token = request.headers().getFirst("{{keyParamName}}");{{/isKeyInHeader}}{{#isKeyInQuery}}
@@ -107,7 +107,7 @@ public interface ApiSecurity {
                         future.complete({{#lambda.camelcase}}{{name}}{{/lambda.camelcase}}_principal);
                     } else {
                       {{#vendorExtensions.isLast}}
-                      future.completeExceptionally(HttpServerResponseException.of(403, "Forbidden"));
+                      future.completeExceptionally(HttpServerResponseException.of(401, "Unauthorized"));
                       {{/vendorExtensions.isLast}}
             {{/lambda.indented}}{{/vendorExtensions.isFirst}}{{/methods}}
             {{#methods}}
@@ -118,7 +118,7 @@ public interface ApiSecurity {
             return future
               .thenCompose(principal -> {
                 if (principal == null) {
-                  return CompletableFuture.failedFuture(HttpServerResponseException.of(403, "Forbidden"));
+                  return CompletableFuture.failedFuture(HttpServerResponseException.of(401, "Unauthorized"));
                 }
                 Principal.set(ctx, principal);
                 try {
diff --git a/openapi/openapi-generator/src/main/resources/openapi/templates/kora/kotlinServerSecuritySchema.mustache b/openapi/openapi-generator/src/main/resources/openapi/templates/kora/kotlinServerSecuritySchema.mustache
index ee8ea5719..ff6546f61 100644
--- a/openapi/openapi-generator/src/main/resources/openapi/templates/kora/kotlinServerSecuritySchema.mustache
+++ b/openapi/openapi-generator/src/main/resources/openapi/templates/kora/kotlinServerSecuritySchema.mustache
@@ -72,7 +72,7 @@ public interface ApiSecurity {
                     future.complete({{#lambda.camelcase}}{{name}}{{/lambda.camelcase}}_principal)
                 } else {
             {{#vendorExtensions.isLast}}
-                    future.completeExceptionally(HttpServerResponseException.of(403, "Forbidden"))
+                    future.completeExceptionally(HttpServerResponseException.of(401, "Unauthorized"))
             {{/vendorExtensions.isLast}}
             {{/vendorExtensions.isFirst}}{{/methods}}{{#methods}}{{^vendorExtensions.isFirst}}{{#lambda.indented}}{{#isApiKey}}{{#isKeyInHeader}}
                     val {{#lambda.camelcase}}{{name}}{{/lambda.camelcase}}_token = request.headers().getFirst("{{keyParamName}}"){{/isKeyInHeader}}{{#isKeyInQuery}}
@@ -98,7 +98,7 @@ public interface ApiSecurity {
                         future.complete({{#lambda.camelcase}}{{name}}{{/lambda.camelcase}}_principal)
                     } else {
                 {{#vendorExtensions.isLast}}
-                        future.completeExceptionally(HttpServerResponseException.of(403, "Forbidden"))
+                        future.completeExceptionally(HttpServerResponseException.of(401, "Unauthorized"))
                 {{/vendorExtensions.isLast}}
                 {{/lambda.indented}}{{/vendorExtensions.isFirst}}{{/methods}}
                 {{#methods}}
@@ -108,7 +108,7 @@ public interface ApiSecurity {
 
             return future.thenCompose { principal ->
                 if (principal == null) {
-                    CompletableFuture.failedFuture(HttpServerResponseException.of(403, "Forbidden"));
+                    CompletableFuture.failedFuture(HttpServerResponseException.of(401, "Unauthorized"));
                 } else {
                     Principal.set(ctx, principal)
                     try {