diff --git a/doc/source/admin/nginx.md b/doc/source/admin/nginx.md
index a943832d81e7..a76b8a6e564d 100644
--- a/doc/source/admin/nginx.md
+++ b/doc/source/admin/nginx.md
@@ -248,6 +248,9 @@ To enable it, add the following to your Galaxy's `server {}` block:
         location /_x_accel_redirect/ {
             internal;
             alias /;
+            # Add upstream response headers that would otherwise be omitted
+            add_header Access-Control-Allow-Origin $upstream_http_access_control_allow_origin;
+            add_header Access-Control-Allow-Methods $upstream_http_access_control_allow_methods;
         }
 ```
 
diff --git a/doc/source/releases/23.2_announce.rst b/doc/source/releases/23.2_announce.rst
index 8b07b2ec1f95..9a6aa84198ea 100644
--- a/doc/source/releases/23.2_announce.rst
+++ b/doc/source/releases/23.2_announce.rst
@@ -42,7 +42,6 @@ Administration Notes
 * Configuration options are now available for carbon emissions reporting. (`#16307 <https://github.com/galaxyproject/galaxy/pull/16307>`__)
 * The pgcleanup script has been modified to allow periodically deleting old datasets; operations can now be restricted to specific object store ids. (`#16340 <https://github.com/galaxyproject/galaxy/pull/16340>`__)
 * Tool memory usage has been improved. (`#16536 <https://github.com/galaxyproject/galaxy/pull/16536>`__)
-* Documentation added for tool panel and panel view administration. (`#17078 <https://github.com/galaxyproject/galaxy/pull/17078>`__)
 * Support added for cgroups-v2 (`#17169 <https://github.com/galaxyproject/galaxy/pull/17169>`__)
 * Support added for configuring job metrics inline; documentation improved (`#17178 <https://github.com/galaxyproject/galaxy/pull/17178>`__)
 
diff --git a/lib/galaxy/model/security.py b/lib/galaxy/model/security.py
index 378f446c5155..d8dbde46c44b 100644
--- a/lib/galaxy/model/security.py
+++ b/lib/galaxy/model/security.py
@@ -765,12 +765,16 @@ def create_private_user_role(self, user):
         return self.get_private_user_role(user)
 
     def get_private_user_role(self, user, auto_create=False):
-        stmt = select(Role).where(
-            and_(
-                UserRoleAssociation.user_id == user.id,
-                Role.id == UserRoleAssociation.role_id,
-                Role.type == Role.types.PRIVATE,
+        stmt = (
+            select(Role)
+            .where(
+                and_(
+                    UserRoleAssociation.user_id == user.id,
+                    Role.id == UserRoleAssociation.role_id,
+                    Role.type == Role.types.PRIVATE,
+                )
             )
+            .distinct()
         )
         role = self.sa_session.execute(stmt).scalar_one_or_none()
         if not role: