diff --git a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
new file mode 100644
index 0000000000..d16ba0303a
--- /dev/null
+++ b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.test.ts
@@ -0,0 +1,54 @@
+/*
+ * Copyright 2024 The Backstage Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import { CatalogAuthResolverContext } from './CatalogAuthResolverContext';
+import { getVoidLogger } from '@backstage/backend-common';
+import { CatalogApi } from '@backstage/catalog-client';
+import { mockServices } from '@backstage/backend-test-utils';
+import { TokenIssuer } from '../../identity/types';
+import { DiscoveryService } from '@backstage/backend-plugin-api';
+
+describe('CatalogAuthResolverContext', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+  });
+
+  const mockCatalogApi = {
+    getEntities: jest.fn().mockResolvedValue({ items: [{}] }),
+  } as Partial<jest.Mocked<CatalogApi>>;
+
+  it('adds kind to filter when missing', async () => {
+    const context = CatalogAuthResolverContext.create({
+      logger: getVoidLogger(),
+      catalogApi: mockCatalogApi as CatalogApi,
+      tokenIssuer: {} as TokenIssuer,
+      tokenManager: mockServices.tokenManager(),
+      discovery: {} as DiscoveryService,
+      auth: mockServices.auth(),
+      httpAuth: mockServices.httpAuth(),
+    });
+
+    await context.findCatalogUser({
+      filter: [{}, { kind: 'group' }, { KIND: 'USER' }],
+    });
+    expect(mockCatalogApi.getEntities).toHaveBeenCalledWith(
+      {
+        filter: [{ kind: 'user' }, { kind: 'group' }, { KIND: 'USER' }],
+      },
+      { token: 'mock-service-token:{"sub":"plugin:test","target":"catalog"}' },
+    );
+  });
+});
diff --git a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
index a5c09b800b..4f9673ac79 100644
--- a/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
+++ b/plugins/auth-backend/src/lib/resolvers/CatalogAuthResolverContext.ts
@@ -125,9 +125,8 @@ export class CatalogAuthResolverContext implements AuthResolverContext {
     } else if ('filter' in query) {
       const filter = [query.filter].flat().map(value => {
         if (
-          !(
-            'kind' in
-            Object.keys(value).map(key => key.toLocaleLowerCase('en-US'))
+          !Object.keys(value).some(
+            key => key.toLocaleLowerCase('en-US') === 'kind',
           )
         ) {
           return {