--- a/pdns/auth-secondarycommunicator.cc	2026-06-07 22:10:43.000000000 +0200
+++ b/pdns/auth-secondarycommunicator.cc	2026-06-09 13:59:03.140354656 +0200
@@ -521,6 +521,7 @@
     ctx.numDeltas = deltas.size();
     //    cout<<"Got "<<deltas.size()<<" deltas from serial "<<ctx.domain.serial<<", applying.."<<endl;
 
+#ifdef HAVE_LUA_RECORDS
     // Do not perform Lua records updates if not allowed to.
     if (!::arg().mustDo("enable-lua-record-updates")) {
       bool foundLua{false};
@@ -550,6 +551,7 @@
         return;
       }
     }
+#endif
 
     for (const auto& d : deltas) { // NOLINT(readability-identifier-length)
       const auto& remove = d.first;
@@ -958,6 +960,7 @@
       }
     }
 
+#ifdef HAVE_LUA_RECORDS
     // Do not perform Lua records updates if not allowed to.
     if (!::arg().mustDo("enable-lua-record-updates")) {
       for (DNSResourceRecord& drr : rrs) {
@@ -968,6 +971,7 @@
         }
       }
     }
+#endif
     transaction = ctx.domain.backend->startTransaction(domain, ctx.domain.id);
     SLOG(g_log << Logger::Info << ctx.logPrefix << "storage transaction started" << endl,
          ctx.slog->info(Logr::Info, "AXFR: storage transaction started"));
--- a/pdns/rfc2136handler.cc	2026-06-07 22:10:43.000000000 +0200
+++ b/pdns/rfc2136handler.cc	2026-06-09 13:56:32.674355348 +0200
@@ -905,6 +905,7 @@
 
 static uint8_t updateRecords(const MOADNSParser::answers_t& answers, DNSSECKeeper& dsk, uint& changedRecords, const std::unique_ptr<AuthLua4>& update_policy_lua, DNSPacket& packet, updateContext& ctx)
 {
+#ifdef HAVE_LUA_RECORDS
   // Reject the complete update if it contains Lua records, unless explicitly
   // allowed, regardless of any other policy.
   if (!::arg().mustDo("enable-lua-record-updates")) {
@@ -916,6 +917,7 @@
       }
     }
   }
+#endif
 
   vector<const DNSRecord*> cnamesToAdd;
   vector<const DNSRecord*> nonCnamesToAdd;
--- a/pdns/ws-auth.cc	2026-06-07 22:10:43.000000000 +0200
+++ b/pdns/ws-auth.cc	2026-06-09 13:58:49.145447730 +0200
@@ -1753,6 +1753,7 @@
 {
   std::vector<std::pair<DNSResourceRecord, string>> errors;
 
+#ifdef HAVE_LUA_RECORDS
   // Do not perform Lua records updates if not allowed to.
   if (!::arg().mustDo("enable-lua-record-updates")) {
     for (const auto& rec : records) {
@@ -1761,6 +1762,7 @@
       }
     }
   }
+#endif
 
   Check::checkRRSet({}, records, zone, flags, errors);
   if (errors.empty()) {
@@ -2578,12 +2580,14 @@
 // Apply a DELETE changetype.
 static applyResult applyDelete(const DomainInfo& domainInfo, DNSName& qname, QType& qtype, bool returnRRset, std::vector<DNSResourceRecord>& rrset)
 {
+#ifdef HAVE_LUA_RECORDS
   // Do not perform Lua records deletions if not allowed to.
   if (!::arg().mustDo("enable-lua-record-updates")) {
     if (qtype == QType::LUA) {
       throw ApiException("Update of Lua records is not allowed");
     }
   }
+#endif
   // Delete all matching qname/qtype RRs (and implicitly, comments).
   if (!domainInfo.backend->replaceRRSet(domainInfo.id, qname, qtype, {})) {
     throw ApiException("Hosting backend does not support editing records.");