diff --git a/app/controllers/api/school_projects_controller.rb b/app/controllers/api/school_projects_controller.rb
index edaf3121..0dc92553 100644
--- a/app/controllers/api/school_projects_controller.rb
+++ b/app/controllers/api/school_projects_controller.rb
@@ -6,13 +6,13 @@ class SchoolProjectsController < ApiController
     load_and_authorize_resource :project
 
     def show_finished
-      @school_project = Project.find_by(identifier: params[:id]).school_project
+      @school_project = Project.find_by!(identifier: params[:id]).school_project
       authorize! :show_finished, @school_project
       render :finished, formats: [:json], status: :ok
     end
 
     def set_finished
-      project = Project.find_by(identifier: params[:id])
+      project = Project.find_by!(identifier: params[:id])
       @school_project = project.school_project
       authorize! :set_finished, @school_project
       result = SchoolProject::SetFinished.call(school_project: @school_project, finished: params[:finished])
diff --git a/spec/requests/school_projects/set_finished_spec.rb b/spec/requests/school_projects/set_finished_spec.rb
index f30f52fc..169ca0a5 100644
--- a/spec/requests/school_projects/set_finished_spec.rb
+++ b/spec/requests/school_projects/set_finished_spec.rb
@@ -80,4 +80,14 @@
       expect(teacher_project.school_project.finished).to be_falsey
     end
   end
+
+  context 'when project does not exist' do
+    before do
+      put('/api/projects/does-not-exist/finished', headers:, params: { finished: false })
+    end
+
+    it 'returns not found response' do
+      expect(response).to have_http_status(:not_found)
+    end
+  end
 end
diff --git a/spec/requests/school_projects/show_finished_spec.rb b/spec/requests/school_projects/show_finished_spec.rb
index 9f187c48..966d0189 100644
--- a/spec/requests/school_projects/show_finished_spec.rb
+++ b/spec/requests/school_projects/show_finished_spec.rb
@@ -52,5 +52,15 @@
         expect(response).to have_http_status(:forbidden)
       end
     end
+
+    context 'when project does not exist' do
+      before do
+        get('/api/projects/does-not-exist/finished', headers:)
+      end
+
+      it 'returns not found response' do
+        expect(response).to have_http_status(:not_found)
+      end
+    end
   end
 end