diff --git a/lib/private/NavigationManager.php b/lib/private/NavigationManager.php
index b545cb879debe..510407653dcbf 100644
--- a/lib/private/NavigationManager.php
+++ b/lib/private/NavigationManager.php
@@ -309,15 +309,16 @@ private function init(bool $resolveClosures = true): void {
 			}
 
 			$logoutUrl = \OC_User::getLogoutUrl($this->urlGenerator);
-			// Logout
-			$this->add([
-				'type' => 'settings',
-				'id' => 'logout',
-				'order' => 99999,
-				'href' => $logoutUrl,
-				'name' => $l->t('Log out'),
-				'icon' => $this->urlGenerator->imagePath('core', 'actions/logout.svg'),
-			]);
+			if ($logoutUrl !== '') {
+				$this->add([
+					'type' => 'settings',
+					'id' => 'logout',
+					'order' => 99999,
+					'href' => $logoutUrl,
+					'name' => $l->t('Log out'),
+					'icon' => $this->urlGenerator->imagePath('core', 'actions/logout.svg'),
+				]);
+			}
 
 			if ($this->isSubadmin()) {
 				// User management
diff --git a/lib/private/legacy/OC_User.php b/lib/private/legacy/OC_User.php
index 1305b0d1647f7..1f2f159d52b1d 100644
--- a/lib/private/legacy/OC_User.php
+++ b/lib/private/legacy/OC_User.php
@@ -282,7 +282,7 @@ public static function isIncognitoMode() {
 	 * Returns the current logout URL valid for the currently logged-in user
 	 *
 	 * @param \OCP\IURLGenerator $urlGenerator
-	 * @return non-empty-string
+	 * @return string
 	 */
 	public static function getLogoutUrl(\OCP\IURLGenerator $urlGenerator) {
 		$backend = self::findFirstActiveUsedBackend();
diff --git a/lib/public/Authentication/IApacheBackend.php b/lib/public/Authentication/IApacheBackend.php
index 375da38ba0671..3fcd549674283 100644
--- a/lib/public/Authentication/IApacheBackend.php
+++ b/lib/public/Authentication/IApacheBackend.php
@@ -27,7 +27,11 @@ public function isSessionActive();
 	/**
 	 * Gets the current logout URL
 	 *
-	 * @return non-empty-string
+	 * Can return an empty string when the backend has no logout URL to
+	 * offer (e.g. Kerberos/SPNEGO where logging out client-side has no
+	 * effect since the browser will just re-authenticate transparently).
+	 *
+	 * @return string
 	 * @since 12.0.3
 	 */
 	public function getLogoutUrl();