diff --git a/goodnews/api.py b/goodnews/api.py
index c50eb14..4bf8d30 100644
--- a/goodnews/api.py
+++ b/goodnews/api.py
@@ -796,19 +796,21 @@ def create_app() -> FastAPI:
     def admin_feedback_read(fid: int, body: FeedbackReadBody, request: Request) -> dict:
         with get_conn() as conn:
             _require_admin(conn, request)
-            if body.read:
-                conn.execute("UPDATE feedback SET read_at = CURRENT_TIMESTAMP WHERE id = ?", (fid,))
-            else:
-                conn.execute("UPDATE feedback SET read_at = NULL WHERE id = ?", (fid,))
+            ts = "CURRENT_TIMESTAMP" if body.read else "NULL"
+            cur = conn.execute(f"UPDATE feedback SET read_at = {ts} WHERE id = ?", (fid,))
             conn.commit()
+            if cur.rowcount == 0:
+                raise HTTPException(status_code=404, detail="feedback not found")
         return {"ok": True, "read": body.read}
 
     @app.delete("/api/admin/feedback/{fid}")
     def admin_feedback_delete(fid: int, request: Request) -> dict:
         with get_conn() as conn:
             _require_admin(conn, request)
-            conn.execute("DELETE FROM feedback WHERE id = ?", (fid,))
+            cur = conn.execute("DELETE FROM feedback WHERE id = ?", (fid,))
             conn.commit()
+            if cur.rowcount == 0:
+                raise HTTPException(status_code=404, detail="feedback not found")
         return {"ok": True}
 
     @app.get("/api/admin/stats")
diff --git a/tests/test_feedback.py b/tests/test_feedback.py
index 57c8ce6..e2c288d 100644
--- a/tests/test_feedback.py
+++ b/tests/test_feedback.py
@@ -88,3 +88,9 @@ def test_feedback_admin_actions_gated(tmp_path, monkeypatch):
     anon = TestClient(app)
     assert anon.post("/api/admin/feedback/1/read", json={"read": True}).status_code == 401
     assert anon.delete("/api/admin/feedback/1").status_code == 401
+
+
+def test_feedback_actions_404_on_missing_id(tmp_path, monkeypatch):
+    tc = _admin_client(tmp_path, monkeypatch)
+    assert tc.post("/api/admin/feedback/9999/read", json={"read": True}).status_code == 404
+    assert tc.delete("/api/admin/feedback/9999").status_code == 404