diff --git a/server.js b/server.js
index ac699f7..39d2f2c 100644
--- a/server.js
+++ b/server.js
@@ -1194,7 +1194,11 @@ app.get('/api/workflows/:id', authenticateSSO, async (req, res) => {
     if (rows.length === 0) return res.status(404).json({ error: 'Not found' });
     const wf = rows[0];
     let definition = {};
-    try { definition = JSON.parse(wf.definition || '{}'); } catch { /* corrupt definition — return empty */ }
+    try {
+      definition = typeof wf.definition === 'string'
+        ? JSON.parse(wf.definition || '{}')
+        : (wf.definition || {});
+    } catch { /* corrupt definition — return empty */ }
     res.json({ ...wf, definition });
   } catch (error) {
     console.error('[API] GET /api/workflows/:id error:', error);
@@ -1659,7 +1663,11 @@ app.get('/api/internal/executions/:id', authenticateGandalf, async (req, res) =>
     }
     const execution = rows[0];
     let logs = [];
-    try { logs = JSON.parse(execution.logs || '[]'); } catch { logs = []; }
+    try {
+      logs = typeof execution.logs === 'string'
+        ? JSON.parse(execution.logs || '[]')
+        : (execution.logs || []);
+    } catch { logs = []; }
     res.json({ ...execution, logs });
   } catch (error) {
     console.error('[API] GET /api/internal/executions/:id error:', error);