diff --git a/backend/src/routes/friends.js b/backend/src/routes/friends.js
index 14b443b..e78be3a 100644
--- a/backend/src/routes/friends.js
+++ b/backend/src/routes/friends.js
@@ -45,6 +45,11 @@ router.get('/', authMiddleware, asyncHandler(async (req, res) => {
   );
 
   // Also get people who have shared challenges with me (auto-friends from challenges)
+  // Build the NOT IN clause only if there are friends to exclude
+  const notInClause = friends.length > 0 
+    ? `AND u.id NOT IN (${friends.map(() => '?').join(',')})` 
+    : '';
+  
   const challengeFriends = await query(
     `SELECT DISTINCT
       u.id, u.username, u.email,
@@ -66,7 +71,7 @@ router.get('/', authMiddleware, asyncHandler(async (req, res) => {
       INNER JOIN challenges c ON cp.challenge_id = c.id
       WHERE c.created_by = ? AND cp.user_id != ? AND cp.status = 'accepted'
     )
-    AND u.id NOT IN (${friends.map(() => '?').join(',') || 'NULL'})
+    ${notInClause}
     ORDER BY u.username`,
     [req.user.userId, req.user.userId, req.user.userId, req.user.userId, req.user.userId, req.user.userId, ...friends.map(f => f.id)]
   );