diff --git a/models/forgejo_migrations/migrate.go b/models/forgejo_migrations/migrate.go
index bc64f07013..94469b7371 100644
--- a/models/forgejo_migrations/migrate.go
+++ b/models/forgejo_migrations/migrate.go
@@ -109,6 +109,8 @@ var migrations = []*Migration{
 	NewMigration("Add `notify-email` column to `action_run` table", AddNotifyEmailToActionRun),
 	// v34 -> v35
 	NewMigration("Noop because of https://codeberg.org/forgejo/forgejo/issues/8373", NoopAddIndexToActionRunStopped),
+	// v35 -> v36
+	NewMigration("Fix wiki unit default permission", FixWikiUnitDefaultPermission),
 }
 
 // GetCurrentDBVersion returns the current Forgejo database version.
diff --git a/models/forgejo_migrations/v36.go b/models/forgejo_migrations/v36.go
new file mode 100644
index 0000000000..019c177a08
--- /dev/null
+++ b/models/forgejo_migrations/v36.go
@@ -0,0 +1,55 @@
+// Copyright 2025 The Forgejo Authors. All rights reserved.
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package forgejo_migrations //nolint:revive
+
+import (
+	"xorm.io/xorm"
+)
+
+func FixWikiUnitDefaultPermission(x *xorm.Engine) error {
+	// Type is Unit's Type
+	type Type int
+
+	// Enumerate all the unit types
+	const (
+		TypeInvalid         Type = iota // 0 invalid
+		TypeCode                        // 1 code
+		TypeIssues                      // 2 issues
+		TypePullRequests                // 3 PRs
+		TypeReleases                    // 4 Releases
+		TypeWiki                        // 5 Wiki
+		TypeExternalWiki                // 6 ExternalWiki
+		TypeExternalTracker             // 7 ExternalTracker
+		TypeProjects                    // 8 Projects
+		TypePackages                    // 9 Packages
+		TypeActions                     // 10 Actions
+	)
+
+	// RepoUnitAccessMode specifies the users access mode to a repo unit
+	type UnitAccessMode int
+
+	const (
+		// UnitAccessModeUnset - no unit mode set
+		UnitAccessModeUnset UnitAccessMode = iota // 0
+		// UnitAccessModeNone no access
+		UnitAccessModeNone // 1
+		// UnitAccessModeRead read access
+		UnitAccessModeRead // 2
+		// UnitAccessModeWrite write access
+		UnitAccessModeWrite // 3
+	)
+	_ = UnitAccessModeNone
+	_ = UnitAccessModeWrite
+
+	type RepoUnit struct {
+		DefaultPermissions UnitAccessMode `xorm:"NOT NULL DEFAULT 0"`
+	}
+	_, err := x.Where("type = ?", TypeWiki).
+		Where("default_permissions = ?", UnitAccessModeRead).
+		Cols("default_permissions").
+		Update(RepoUnit{
+			DefaultPermissions: UnitAccessModeUnset,
+		})
+	return err
+}
diff --git a/models/repo/repo_unit.go b/models/repo/repo_unit.go
index c11ad70627..e50f79e945 100644
--- a/models/repo/repo_unit.go
+++ b/models/repo/repo_unit.go
@@ -41,27 +41,30 @@ func (err ErrUnitTypeNotExist) Unwrap() error {
 }
 
 // RepoUnitAccessMode specifies the users access mode to a repo unit
+// Only UnitAccessModeWrite is used by the wiki, to mark it as instance-writable
 type UnitAccessMode int
 
 const (
 	// UnitAccessModeUnset - no unit mode set
 	UnitAccessModeUnset UnitAccessMode = iota // 0
+
 	// UnitAccessModeNone no access
-	UnitAccessModeNone // 1
+	// UnitAccessModeNone UnitAccessMode = 1
 	// UnitAccessModeRead read access
-	UnitAccessModeRead // 2
+	// UnitAccessModeRead UnitAccessMode = 2
+
 	// UnitAccessModeWrite write access
-	UnitAccessModeWrite // 3
+	UnitAccessModeWrite UnitAccessMode = 3
 )
 
 func (mode UnitAccessMode) ToAccessMode(modeIfUnset perm.AccessMode) perm.AccessMode {
 	switch mode {
 	case UnitAccessModeUnset:
 		return modeIfUnset
-	case UnitAccessModeNone:
-		return perm.AccessModeNone
-	case UnitAccessModeRead:
-		return perm.AccessModeRead
+	// case UnitAccessModeNone:
+	//	return perm.AccessModeNone
+	// case UnitAccessModeRead:
+	//	return perm.AccessModeRead
 	case UnitAccessModeWrite:
 		return perm.AccessModeWrite
 	default:
diff --git a/models/repo/repo_unit_test.go b/models/repo/repo_unit_test.go
index a1964519bd..3d6d408fcb 100644
--- a/models/repo/repo_unit_test.go
+++ b/models/repo/repo_unit_test.go
@@ -34,8 +34,8 @@ func TestActionsConfig(t *testing.T) {
 }
 
 func TestRepoUnitAccessMode(t *testing.T) {
-	assert.Equal(t, perm.AccessModeNone, UnitAccessModeNone.ToAccessMode(perm.AccessModeAdmin))
-	assert.Equal(t, perm.AccessModeRead, UnitAccessModeRead.ToAccessMode(perm.AccessModeAdmin))
+	// assert.Equal(t, perm.AccessModeNone, UnitAccessModeNone.ToAccessMode(perm.AccessModeAdmin))
+	// assert.Equal(t, perm.AccessModeRead, UnitAccessModeRead.ToAccessMode(perm.AccessModeAdmin))
 	assert.Equal(t, perm.AccessModeWrite, UnitAccessModeWrite.ToAccessMode(perm.AccessModeAdmin))
 	assert.Equal(t, perm.AccessModeRead, UnitAccessModeUnset.ToAccessMode(perm.AccessModeRead))
 }
diff --git a/routers/api/v1/repo/repo.go b/routers/api/v1/repo/repo.go
index 3d6a40e9ab..42385d54a6 100644
--- a/routers/api/v1/repo/repo.go
+++ b/routers/api/v1/repo/repo.go
@@ -861,7 +861,7 @@ func updateRepoUnits(ctx *context.APIContext, owner string, repo *repo_model.Rep
 			if *opts.GloballyEditableWiki {
 				wikiPermissions = repo_model.UnitAccessModeWrite
 			} else {
-				wikiPermissions = repo_model.UnitAccessModeRead
+				wikiPermissions = repo_model.UnitAccessModeUnset
 			}
 		}