diff --git a/app/assets/javascripts/admin/users/components/actions/ban.vue b/app/assets/javascripts/admin/users/components/actions/ban.vue
index 55938832dce5d4b7dd19e6852081bffa42c98637..898a688c203f0700f2ed57895bbd37ae575a9d24 100644
--- a/app/assets/javascripts/admin/users/components/actions/ban.vue
+++ b/app/assets/javascripts/admin/users/components/actions/ban.vue
@@ -11,7 +11,9 @@ const messageHtml = `
   <ul>
     <li>${s__("AdminUsers|The user can't log in.")}</li>
     <li>${s__("AdminUsers|The user can't access git repositories.")}</li>
-    <li>${s__('AdminUsers|Issues authored by this user are hidden from other users.')}</li>
+    <li>${s__(
+      'AdminUsers|Issues and merge requests authored by this user are hidden from other users.',
+    )}</li>
   </ul>
   <p>${s__('AdminUsers|You can unban their account in the future. Their data remains intact.')}</p>
   <p>${sprintf(
diff --git a/app/assets/javascripts/issuable/components/issuable_header_warnings.vue b/app/assets/javascripts/issuable/components/issuable_header_warnings.vue
index 543dca0afe1f91f40d11b6c058f25ad9fed40e88..a84187ab86b8b4bf2759d79d938a73b057bb56e8 100644
--- a/app/assets/javascripts/issuable/components/issuable_header_warnings.vue
+++ b/app/assets/javascripts/issuable/components/issuable_header_warnings.vue
@@ -1,7 +1,7 @@
 <script>
 import { GlIcon, GlTooltipDirective } from '@gitlab/ui';
 import { mapGetters } from 'vuex';
-import { __ } from '~/locale';
+import { sprintf, __ } from '~/locale';
 import { IssuableType, WorkspaceType } from '~/issues/constants';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import ConfidentialityBadge from '~/vue_shared/components/confidentiality_badge.vue';
@@ -40,7 +40,9 @@ export default {
           iconName: 'spam',
           visible: this.hidden,
           dataTestId: 'hidden',
-          tooltip: __('This issue is hidden because its author has been banned'),
+          tooltip: sprintf(__('This %{issuable} is hidden because its author has been banned'), {
+            issuable: this.getNoteableData.targetType.replace('_', ' '),
+          }),
         },
       ];
     },
diff --git a/app/controllers/projects/merge_requests/application_controller.rb b/app/controllers/projects/merge_requests/application_controller.rb
index d8da448a3239b79abc695cedbadc3e3231dacdbc..76b06b2ce9db1264cadd99774d312a6633eaca22 100644
--- a/app/controllers/projects/merge_requests/application_controller.rb
+++ b/app/controllers/projects/merge_requests/application_controller.rb
@@ -13,6 +13,10 @@ def merge_request
     @issuable =
       @merge_request ||=
         merge_request_includes(@project.merge_requests).find_by_iid!(params[:id])
+
+    return render_404 unless can?(current_user, :read_merge_request, @issuable)
+
+    @issuable
   end
 
   def merge_request_includes(association)
diff --git a/app/finders/issuable_finder.rb b/app/finders/issuable_finder.rb
index 5fcb81949ee93f2e212df09e84bbb3aad64d5672..c5a3293ad2f1f9fecc8794edcdd1593ef06ef9ff 100644
--- a/app/finders/issuable_finder.rb
+++ b/app/finders/issuable_finder.rb
@@ -248,7 +248,10 @@ def force_cte?
   end
 
   def init_collection
-    klass.all
+    return klass.all if params.user_can_see_all_issuables?
+
+    # Only admins and auditors can see hidden issuables, for other users we filter out hidden issuables
+    klass.without_hidden
   end
 
   def default_or_simple_sort?
diff --git a/app/finders/issuable_finder/params.rb b/app/finders/issuable_finder/params.rb
index 32d50802537ceec3bc8b342cc2865bf582788aec..4e17f06e1c16a324519ffa063993427900714187 100644
--- a/app/finders/issuable_finder/params.rb
+++ b/app/finders/issuable_finder/params.rb
@@ -195,6 +195,11 @@ def parent
       project || group
     end
 
+    def user_can_see_all_issuables?
+      Ability.allowed?(current_user, :read_all_resources)
+    end
+    strong_memoize_attr :user_can_see_all_issuables?, :user_can_see_all_issuables
+
     private
 
     def projects_public_or_visible_to_user
diff --git a/app/finders/issues_finder.rb b/app/finders/issues_finder.rb
index e12dce744b5748bea476d7520cb04e01478a260b..bd81f06f93b156de9079afd2e2d4d516e22fb3f3 100644
--- a/app/finders/issues_finder.rb
+++ b/app/finders/issues_finder.rb
@@ -49,7 +49,7 @@ def params_class
 
   # rubocop: disable CodeReuse/ActiveRecord
   def with_confidentiality_access_check
-    return model_class.all if params.user_can_see_all_issues?
+    return model_class.all if params.user_can_see_all_issuables?
 
     # Only admins can see hidden issues, so for non-admins, we filter out any hidden issues
     issues = model_class.without_hidden
diff --git a/app/finders/issues_finder/params.rb b/app/finders/issues_finder/params.rb
index 7f8acb79ed688c10659836346b4d24e31cbdb754..786bfbd4113b84782b1805a76daa84e439432029 100644
--- a/app/finders/issues_finder/params.rb
+++ b/app/finders/issues_finder/params.rb
@@ -44,7 +44,7 @@ def user_can_see_all_confidential_issues?
         if parent
           Ability.allowed?(current_user, :read_confidential_issues, parent)
         else
-          user_can_see_all_issues?
+          user_can_see_all_issuables?
         end
       end
     end
@@ -54,12 +54,6 @@ def user_cannot_see_confidential_issues?
 
       current_user.blank?
     end
-
-    def user_can_see_all_issues?
-      strong_memoize(:user_can_see_all_issues) do
-        Ability.allowed?(current_user, :read_all_resources)
-      end
-    end
   end
 end
 
diff --git a/app/graphql/resolvers/concerns/resolves_merge_requests.rb b/app/graphql/resolvers/concerns/resolves_merge_requests.rb
index d56951bc8212e2d840ceaf6a242974502beb20da..c68e120ee241fb3c0ae80a7383687dddbeeb19ec 100644
--- a/app/graphql/resolvers/concerns/resolves_merge_requests.rb
+++ b/app/graphql/resolvers/concerns/resolves_merge_requests.rb
@@ -34,7 +34,7 @@ def mr_parent
   end
 
   def unconditional_includes
-    [:target_project]
+    [:target_project, :author]
   end
 
   def preloads
diff --git a/app/helpers/issuables_helper.rb b/app/helpers/issuables_helper.rb
index 2b21d8c51e6921776e1a77450c750b76d188db5e..7d99b0da89003bb519546d1157cdf6903c653b9f 100644
--- a/app/helpers/issuables_helper.rb
+++ b/app/helpers/issuables_helper.rb
@@ -275,7 +275,7 @@ def issue_only_initial_data(issuable)
       zoomMeetingUrl: ZoomMeeting.canonical_meeting_url(issuable),
       sentryIssueIdentifier: SentryIssue.find_by(issue: issuable)&.sentry_issue_identifier, # rubocop:disable CodeReuse/ActiveRecord
       iid: issuable.iid.to_s,
-      isHidden: issue_hidden?(issuable),
+      isHidden: issuable_hidden?(issuable),
       canCreateIncident: create_issue_type_allowed?(issuable.project, :incident)
     }
   end
@@ -372,6 +372,20 @@ def state_name_with_icon(issuable)
     end
   end
 
+  def issuable_hidden?(issuable)
+    Feature.enabled?(:ban_user_feature_flag) && issuable.hidden?
+  end
+
+  def hidden_issuable_icon(issuable)
+    return unless issuable_hidden?(issuable)
+
+    title = format(_('This %{issuable} is hidden because its author has been banned'),
+                   issuable: issuable.human_class_name)
+    content_tag(:span, class: 'has-tooltip', title: title) do
+      sprite_icon('spam', css_class: 'gl-vertical-align-text-bottom')
+    end
+  end
+
   private
 
   def sidebar_gutter_collapsed?
diff --git a/app/helpers/issues_helper.rb b/app/helpers/issues_helper.rb
index 1d68dccc741d9b46c97b09ddc977b196c698895f..101df8cdd41f0c2864767cce611d86e9c6124fe9 100644
--- a/app/helpers/issues_helper.rb
+++ b/app/helpers/issues_helper.rb
@@ -70,18 +70,6 @@ def confidential_icon(issue)
     sprite_icon('eye-slash', css_class: 'gl-vertical-align-text-bottom') if issue.confidential?
   end
 
-  def issue_hidden?(issue)
-    Feature.enabled?(:ban_user_feature_flag) && issue.hidden?
-  end
-
-  def hidden_issue_icon(issue)
-    return unless issue_hidden?(issue)
-
-    content_tag(:span, class: 'has-tooltip', title: _('This issue is hidden because its author has been banned')) do
-      sprite_icon('spam', css_class: 'gl-vertical-align-text-bottom')
-    end
-  end
-
   def award_user_list(awards, current_user, limit: 10)
     names = awards.map do |award|
       award.user == current_user ? 'You' : award.user.name
diff --git a/app/models/concerns/issuable.rb b/app/models/concerns/issuable.rb
index 9f0cd96a8f899ad931f9bbe0b285de1266f77ea1..1a50ebde0a39e5f5b2347e4d5b625002f037afde 100644
--- a/app/models/concerns/issuable.rb
+++ b/app/models/concerns/issuable.rb
@@ -144,6 +144,14 @@ def system_note_metadata_loaded?
       includes(*associations)
     end
 
+    scope :without_hidden, -> {
+      if Feature.enabled?(:ban_user_feature_flag)
+        where.not(author_id: Users::BannedUser.all.select(:user_id))
+      else
+        all
+      end
+    }
+
     attr_mentionable :title, pipeline: :single_line
     attr_mentionable :description
 
@@ -227,6 +235,10 @@ def severity
       issuable_severity&.severity || IssuableSeverity::DEFAULT
     end
 
+    def hidden?
+      author&.banned?
+    end
+
     private
 
     def description_max_length_for_new_records_is_valid
diff --git a/app/models/issue.rb b/app/models/issue.rb
index b338ecfce88e7f2dbece3114a6cd814ae3ae014a..f517f42d6ba27d1f76b85e358443c34896123c8a 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -178,14 +178,6 @@ def most_recent
 
   scope :confidential_only, -> { where(confidential: true) }
 
-  scope :without_hidden, -> {
-    if Feature.enabled?(:ban_user_feature_flag)
-      where.not(author_id: Users::BannedUser.all.select(:user_id))
-    else
-      all
-    end
-  }
-
   scope :counts_by_state, -> { reorder(nil).group(:state_id).count }
 
   scope :service_desk, -> { where(author: ::User.support_bot) }
@@ -658,10 +650,6 @@ def readable_by?(user)
     end
   end
 
-  def hidden?
-    author&.banned?
-  end
-
   # Necessary until all issues are backfilled and we add a NOT NULL constraint on the DB
   def work_item_type
     super || WorkItems::Type.default_by_type(issue_type)
diff --git a/app/policies/issuable_policy.rb b/app/policies/issuable_policy.rb
index aa07bb7dc5fefb971e5c6117d2f61acbe1f303f1..779384ee3fe9c0c1903143fd0accaf2f77916713 100644
--- a/app/policies/issuable_policy.rb
+++ b/app/policies/issuable_policy.rb
@@ -16,6 +16,9 @@ class IssuablePolicy < BasePolicy
 
   condition(:is_incident) { @subject.incident? }
 
+  desc "Issuable is hidden"
+  condition(:hidden, scope: :subject) { @subject.hidden? }
+
   rule { can?(:guest_access) & assignee_or_author & ~is_incident }.policy do
     enable :read_issue
     enable :update_issue
diff --git a/app/policies/issue_policy.rb b/app/policies/issue_policy.rb
index 491eebe9dafa07a9c4ae23266fa3413e358f012f..7d4e42580b8601c1c2f6fc9aac3533cc50c68912 100644
--- a/app/policies/issue_policy.rb
+++ b/app/policies/issue_policy.rb
@@ -21,9 +21,6 @@ class IssuePolicy < IssuablePolicy
   desc "Issue is confidential"
   condition(:confidential, scope: :subject) { @subject.confidential? }
 
-  desc "Issue is hidden"
-  condition(:hidden, scope: :subject) { @subject.hidden? }
-
   desc "Issue is persisted"
   condition(:persisted, scope: :subject) { @subject.persisted? }
 
diff --git a/app/policies/merge_request_policy.rb b/app/policies/merge_request_policy.rb
index 32128d84d0b2f626cbb8a610e9352a674c192748..8da2af506c7298c2ba3bd0c66cb9bc016ea820bd 100644
--- a/app/policies/merge_request_policy.rb
+++ b/app/policies/merge_request_policy.rb
@@ -27,6 +27,10 @@ class MergeRequestPolicy < IssuablePolicy
     enable :update_subscription
   end
 
+  rule { hidden & ~admin }.policy do
+    prevent :read_merge_request
+  end
+
   condition(:can_merge) { @subject.can_be_merged_by?(@user) }
 
   rule { can_merge }.policy do
diff --git a/app/views/projects/issues/_issue.html.haml b/app/views/projects/issues/_issue.html.haml
index 1d3320e4f82280ec354e497913859676314d1742..a34ed332fcf697090edaa1ea33a1834707511a4d 100644
--- a/app/views/projects/issues/_issue.html.haml
+++ b/app/views/projects/issues/_issue.html.haml
@@ -6,7 +6,7 @@
           - if issue.confidential?
             %span.has-tooltip{ title: _('Confidential') }
               = confidential_icon(issue)
-          = hidden_issue_icon(issue)
+          = hidden_issuable_icon(issue)
           = link_to issue.title, issue_path(issue), class: 'js-prefetch-document'
         = render_if_exists 'projects/issues/subepic_flag', issue: issue
         - if issue.tasks?
diff --git a/app/views/projects/merge_requests/_merge_request.html.haml b/app/views/projects/merge_requests/_merge_request.html.haml
index 71f8e4c32f5eb6be51d2b4861aacfca0505a5442..d7e26da5f514afc6f7d47a5dc4fed67595ccac51 100644
--- a/app/views/projects/merge_requests/_merge_request.html.haml
+++ b/app/views/projects/merge_requests/_merge_request.html.haml
@@ -12,6 +12,7 @@
     .issuable-main-info
       .merge-request-title.title
         %span.merge-request-title-text.js-onboarding-mr-item
+          = hidden_issuable_icon(merge_request)
           = link_to merge_request.title, merge_request_path(merge_request), class: 'js-prefetch-document'
         - if merge_request.tasks?
           %span.task-status.d-none.d-sm-inline-block
diff --git a/app/views/projects/merge_requests/_mr_title.html.haml b/app/views/projects/merge_requests/_mr_title.html.haml
index a73d2aa5cc4c11bea7c03719420158f14faa40e4..6129e349df384da0fc7f899e9183a6b22117871e 100644
--- a/app/views/projects/merge_requests/_mr_title.html.haml
+++ b/app/views/projects/merge_requests/_mr_title.html.haml
@@ -16,7 +16,7 @@
   .detail-page-header.border-bottom-0.pt-0.pb-0.gl-display-block{ class: "gl-md-display-flex! #{'is-merge-request' if moved_mr_sidebar_enabled? && !fluid_layout}" }
     .detail-page-header-body
       .issuable-meta.gl-display-flex
-        #js-issuable-header-warnings
+        #js-issuable-header-warnings{ data: { hidden: issuable_hidden?(@merge_request).to_s } }
         %h1.title.page-title.gl-font-size-h-display.gl-my-0.gl-display-inline-block{ data: { qa_selector: 'title_content' } }
           = markdown_field(@merge_request, :title)
 
diff --git a/app/views/shared/issue_type/_details_header.html.haml b/app/views/shared/issue_type/_details_header.html.haml
index ccb501dae11329f1309bb15127c40f52f898de00..c8762f8e060eddbd9244f3a251d8a6f91fee8789 100644
--- a/app/views/shared/issue_type/_details_header.html.haml
+++ b/app/views/shared/issue_type/_details_header.html.haml
@@ -13,7 +13,7 @@
       %span.gl-display-none.gl-sm-display-block.gl-ml-2
         = _('Open')
 
-    #js-issuable-header-warnings{ data: { hidden: issue_hidden?(issuable).to_s } }
+    #js-issuable-header-warnings{ data: { hidden: issuable_hidden?(issuable).to_s } }
     = issuable_meta(issuable, @project)
 
     %a.btn.gl-button.btn-default.btn-icon.float-right.gl-display-block.d-sm-none.gutter-toggle.issuable-gutter-toggle.js-sidebar-toggle{ href: "#" }
diff --git a/doc/user/admin_area/moderate_users.md b/doc/user/admin_area/moderate_users.md
index c0daf029b1f4ae318315d796246e92de9d325b00..117781f72223d2e63db555ee7e0db8122af2314e 100644
--- a/doc/user/admin_area/moderate_users.md
+++ b/doc/user/admin_area/moderate_users.md
@@ -223,7 +223,7 @@ On self-managed GitLab, by default this feature is available.
 To hide the feature, ask an administrator to [disable the feature flag](../../administration/feature_flags.md) named `ban_user_feature_flag`.
 On GitLab.com, this feature is available to GitLab.com administrators only.
 
-GitLab administrators can ban and unban users. Banned users are blocked, and their issues are hidden.
+GitLab administrators can ban and unban users. Banned users are blocked, and their issues and merge requests are hidden.
 The banned user's comments are still displayed. Hiding a banned user's comments is [tracked in this issue](https://gitlab.com/gitlab-org/gitlab/-/issues/327356).
 
 ### Ban a user
diff --git a/ee/spec/finders/merge_requests_finder_spec.rb b/ee/spec/finders/merge_requests_finder_spec.rb
index 46e52bc6a4e99c8ccd0ba80bd6e42f893f37f63e..e54488f84c4ae7f0ce6459f208fc9cc17be56e1c 100644
--- a/ee/spec/finders/merge_requests_finder_spec.rb
+++ b/ee/spec/finders/merge_requests_finder_spec.rb
@@ -94,5 +94,22 @@
         expect(merge_requests).to contain_exactly(scoped_labeled_merge_request_1, scoped_labeled_merge_request_2)
       end
     end
+
+    context 'when the author of a merge request is banned' do
+      let_it_be(:banned_user) { create(:user, :banned) }
+      let_it_be(:banned_merge_request) do
+        create(:merge_request, :simple, author: banned_user, source_project: project1)
+      end
+
+      subject(:merge_requests) { described_class.new(user).execute }
+
+      it { is_expected.not_to include(banned_merge_request) }
+
+      context 'when the user is an auditor' do
+        let_it_be(:user) { create(:user, :auditor) }
+
+        it { is_expected.to include(banned_merge_request) }
+      end
+    end
   end
 end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index f0b142047aa4773f52ba35d5f7a0a2f39fca3bfb..05ff95a22c0117000a8504a611b5e8a193aee891 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3301,7 +3301,7 @@ msgstr ""
 msgid "AdminUsers|Is using seat"
 msgstr ""
 
-msgid "AdminUsers|Issues authored by this user are hidden from other users."
+msgid "AdminUsers|Issues and merge requests authored by this user are hidden from other users."
 msgstr ""
 
 msgid "AdminUsers|It's you!"
@@ -42067,6 +42067,9 @@ msgstr ""
 msgid "This %{issuableDisplayName} is locked. Only project members can comment."
 msgstr ""
 
+msgid "This %{issuable} is hidden because its author has been banned"
+msgstr ""
+
 msgid "This %{issuable} is locked. Only %{strong_open}project members%{strong_close} can comment."
 msgstr ""
 
diff --git a/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb b/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
new file mode 100644
index 0000000000000000000000000000000000000000..99344d2cf32b0af0758778085fd7cd9829311b83
--- /dev/null
+++ b/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Admin views hidden merge request', feature_category: :code_review do
+  context 'when signed in as admin and viewing a hidden merge request', :js do
+    let_it_be(:admin) { create(:admin) }
+    let_it_be(:author) { create(:user, :banned) }
+    let_it_be(:project) { create(:project, :repository) }
+    let!(:merge_request) { create(:merge_request, source_project: project, author: author) }
+
+    before do
+      sign_in(admin)
+      gitlab_enable_admin_mode_sign_in(admin)
+      visit(project_merge_request_path(project, merge_request))
+    end
+
+    it 'shows a hidden merge request icon' do
+      page.within('.detail-page-header-body') do
+        tooltip = format(_('This %{issuable} is hidden because its author has been banned'), issuable: 'merge request')
+        expect(page).to have_css("div[data-testid='hidden'][title='#{tooltip}']")
+        expect(page).to have_css('svg[data-testid="spam-icon"]')
+      end
+    end
+  end
+end
diff --git a/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb b/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
new file mode 100644
index 0000000000000000000000000000000000000000..bc5ec1248618fdd3128e5e40a99874fac8860208
--- /dev/null
+++ b/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Admin views hidden merge requests', feature_category: :code_review do
+  context 'when signed in as admin and viewing a hidden merge request' do
+    let_it_be(:admin) { create(:admin) }
+    let_it_be(:author) { create(:user, :banned) }
+    let_it_be(:project) { create(:project) }
+    let!(:merge_request) { create(:merge_request, source_project: project, author: author) }
+
+    before do
+      sign_in(admin)
+      gitlab_enable_admin_mode_sign_in(admin)
+      visit(project_merge_requests_path(project))
+    end
+
+    it 'shows a hidden merge request icon' do
+      page.within("#merge_request_#{merge_request.id}") do
+        tooltip = format(_('This %{issuable} is hidden because its author has been banned'), issuable: 'merge request')
+        expect(page).to have_css("span[title='#{tooltip}']")
+        expect(page).to have_css('svg[data-testid="spam-icon"]')
+      end
+    end
+  end
+end
diff --git a/spec/frontend/issuable/components/issuable_header_warnings_spec.js b/spec/frontend/issuable/components/issuable_header_warnings_spec.js
index e3a36dc8820b4977e93d2acc3cb4b58b726a6ef7..98a81478cb6d6b7df5b008ce6be1bb30beea17af 100644
--- a/spec/frontend/issuable/components/issuable_header_warnings_spec.js
+++ b/spec/frontend/issuable/components/issuable_header_warnings_spec.js
@@ -57,6 +57,7 @@ describe('IssuableHeaderWarnings', () => {
         beforeEach(() => {
           store.getters.getNoteableData.confidential = confidentialStatus;
           store.getters.getNoteableData.discussion_locked = lockStatus;
+          store.getters.getNoteableData.targetType = issuableType;
 
           createComponent({ store, provide: { hidden: hiddenStatus } });
         });
@@ -84,7 +85,7 @@ describe('IssuableHeaderWarnings', () => {
 
           if (hiddenStatus) {
             expect(hiddenIcon.attributes('title')).toBe(
-              'This issue is hidden because its author has been banned',
+              `This ${issuableType} is hidden because its author has been banned`,
             );
             expect(getBinding(hiddenIcon.element, 'gl-tooltip')).not.toBeUndefined();
           }
diff --git a/spec/helpers/issuables_helper_spec.rb b/spec/helpers/issuables_helper_spec.rb
index 15b57a4c9eb034673de57c96a2f63674add9775e..2a61b38337bd8e9996cf80f6d1a1f3ef84f39a94 100644
--- a/spec/helpers/issuables_helper_spec.rb
+++ b/spec/helpers/issuables_helper_spec.rb
@@ -629,4 +629,66 @@
       expect(helper.sidebar_milestone_tooltip_label(milestone)).to eq('&lt;img onerror=alert(1)&gt;<br/>Milestone')
     end
   end
+
+  describe '#issuable_hidden?' do
+    let_it_be(:issuable) { build(:issue) }
+
+    context 'when issuable is hidden' do
+      let_it_be(:banned_user) { build(:user, :banned) }
+      let_it_be(:hidden_issuable) { build(:issue, author: banned_user) }
+
+      context 'when `ban_user_feature_flag` feature flag is enabled' do
+        it 'returns `true`' do
+          expect(helper.issuable_hidden?(hidden_issuable)).to eq(true)
+        end
+      end
+
+      context 'when `ban_user_feature_flag` feature flag is disabled' do
+        before do
+          stub_feature_flags(ban_user_feature_flag: false)
+        end
+
+        it 'returns `false`' do
+          expect(helper.issuable_hidden?(hidden_issuable)).to eq(false)
+        end
+      end
+    end
+
+    context 'when issuable is not hidden' do
+      it 'returns `false`' do
+        expect(helper.issuable_hidden?(issuable)).to eq(false)
+      end
+    end
+  end
+
+  describe '#hidden_issuable_icon' do
+    let_it_be(:banned_user) { build(:user, :banned) }
+    let_it_be(:hidden_issuable) { build(:issue, author: banned_user) }
+    let_it_be(:issuable) { build(:issue) }
+    let_it_be(:mock_svg) { '<svg></svg>'.html_safe }
+
+    before do
+      allow(helper).to receive(:sprite_icon).and_return(mock_svg)
+    end
+
+    context 'when issuable is hidden' do
+      it 'returns icon with tooltip' do
+        expect(helper.hidden_issuable_icon(hidden_issuable)).to eq("<span class=\"has-tooltip\" title=\"This issue is hidden because its author has been banned\">#{mock_svg}</span>")
+      end
+
+      context 'when issuable is a merge request' do
+        let_it_be(:hidden_issuable) { build(:merge_request, author: banned_user) }
+
+        it 'returns icon with tooltip' do
+          expect(helper.hidden_issuable_icon(hidden_issuable)).to eq("<span class=\"has-tooltip\" title=\"This merge request is hidden because its author has been banned\">#{mock_svg}</span>")
+        end
+      end
+    end
+
+    context 'when issuable is not hidden' do
+      it 'returns `nil`' do
+        expect(helper.hidden_issuable_icon(issuable)).to be_nil
+      end
+    end
+  end
 end
diff --git a/spec/helpers/issues_helper_spec.rb b/spec/helpers/issues_helper_spec.rb
index ed363268cdfcdd4737a64293ac26f841040590a6..39e50070169666e74c3bbe5b3c5e86ff22089778 100644
--- a/spec/helpers/issues_helper_spec.rb
+++ b/spec/helpers/issues_helper_spec.rb
@@ -508,55 +508,4 @@
       end
     end
   end
-
-  describe '#issue_hidden?' do
-    context 'when issue is hidden' do
-      let_it_be(:banned_user) { build(:user, :banned) }
-      let_it_be(:hidden_issue) { build(:issue, author: banned_user) }
-
-      context 'when `ban_user_feature_flag` feature flag is enabled' do
-        it 'returns `true`' do
-          expect(helper.issue_hidden?(hidden_issue)).to eq(true)
-        end
-      end
-
-      context 'when `ban_user_feature_flag` feature flag is disabled' do
-        before do
-          stub_feature_flags(ban_user_feature_flag: false)
-        end
-
-        it 'returns `false`' do
-          expect(helper.issue_hidden?(hidden_issue)).to eq(false)
-        end
-      end
-    end
-
-    context 'when issue is not hidden' do
-      it 'returns `false`' do
-        expect(helper.issue_hidden?(issue)).to eq(false)
-      end
-    end
-  end
-
-  describe '#hidden_issue_icon' do
-    let_it_be(:banned_user) { build(:user, :banned) }
-    let_it_be(:hidden_issue) { build(:issue, author: banned_user) }
-    let_it_be(:mock_svg) { '<svg></svg>'.html_safe }
-
-    before do
-      allow(helper).to receive(:sprite_icon).and_return(mock_svg)
-    end
-
-    context 'when issue is hidden' do
-      it 'returns icon with tooltip' do
-        expect(helper.hidden_issue_icon(hidden_issue)).to eq("<span class=\"has-tooltip\" title=\"This issue is hidden because its author has been banned\">#{mock_svg}</span>")
-      end
-    end
-
-    context 'when issue is not hidden' do
-      it 'returns `nil`' do
-        expect(helper.hidden_issue_icon(issue)).to be_nil
-      end
-    end
-  end
 end
diff --git a/spec/models/concerns/issuable_spec.rb b/spec/models/concerns/issuable_spec.rb
index e553e34ab51192b0702f80d1f729ad552ad9805f..88d44e48064b5704f8cf10b0386b305384311218 100644
--- a/spec/models/concerns/issuable_spec.rb
+++ b/spec/models/concerns/issuable_spec.rb
@@ -337,6 +337,53 @@
     it { expect(MergeRequest.to_ability_name).to eq("merge_request") }
   end
 
+  describe '.without_hidden' do
+    let_it_be(:banned_user) { create(:user, :banned) }
+
+    where(issuable_type: [:issue, :merge_request])
+
+    with_them do
+      let!(:public_issuable) { create(issuable_type, :closed) }
+      let!(:hidden_issuable) { create(issuable_type, :closed, author: banned_user) }
+
+      subject { issuable_type.to_s.classify.constantize.without_hidden }
+
+      it 'only returns public issuables' do
+        expect(subject).to contain_exactly(public_issuable)
+      end
+
+      context 'when feature flag is disabled' do
+        before do
+          stub_feature_flags(ban_user_feature_flag: false)
+        end
+
+        it 'returns public and hidden issuables' do
+          expect(subject).to contain_exactly(public_issuable, hidden_issuable)
+        end
+      end
+    end
+  end
+
+  describe '#hidden?' do
+    let_it_be(:author) { create(:user) }
+
+    where(issuable_type: [:issue, :merge_request])
+
+    with_them do
+      let(:issuable) { build_stubbed(issuable_type, author: author) }
+
+      subject { issuable.hidden? }
+
+      it { is_expected.to eq(false) }
+
+      context 'when the author is banned' do
+        let_it_be(:author) { create(:user, :banned) }
+
+        it { is_expected.to eq(true) }
+      end
+    end
+  end
+
   describe "#sort_by_attribute" do
     let(:project) { create(:project) }
 
diff --git a/spec/models/issue_spec.rb b/spec/models/issue_spec.rb
index 82ee062aef037f28ef90d85983f7d4737e98ee15..c8904519629147ff2da7d899b369f6f598553bd8 100644
--- a/spec/models/issue_spec.rb
+++ b/spec/models/issue_spec.rb
@@ -1432,26 +1432,6 @@
     end
   end
 
-  describe '.without_hidden' do
-    let_it_be(:banned_user) { create(:user, :banned) }
-    let_it_be(:public_issue) { create(:issue, project: reusable_project) }
-    let_it_be(:hidden_issue) { create(:issue, project: reusable_project, author: banned_user) }
-
-    it 'only returns without_hidden issues' do
-      expect(described_class.without_hidden).to eq([public_issue])
-    end
-
-    context 'when feature flag is disabled' do
-      before do
-        stub_feature_flags(ban_user_feature_flag: false)
-      end
-
-      it 'returns public and hidden issues' do
-        expect(described_class.without_hidden).to contain_exactly(public_issue, hidden_issue)
-      end
-    end
-  end
-
   describe '.by_project_id_and_iid' do
     let_it_be(:issue_a) { create(:issue, project: reusable_project) }
     let_it_be(:issue_b) { create(:issue, iid: issue_a.iid) }
diff --git a/spec/policies/merge_request_policy_spec.rb b/spec/policies/merge_request_policy_spec.rb
index 741a0db300918ece6c7bece7e327537291330608..6c19590fcce3210347ae08ce62ffc7c7892ff940 100644
--- a/spec/policies/merge_request_policy_spec.rb
+++ b/spec/policies/merge_request_policy_spec.rb
@@ -461,4 +461,20 @@ def permissions(user, merge_request)
       end
     end
   end
+
+  context 'when the author of the merge request is banned' do
+    let_it_be(:user) { create(:user) }
+    let_it_be(:admin) { create(:user, :admin) }
+    let_it_be(:author) { create(:user, :banned) }
+    let_it_be(:project) { create(:project, :public) }
+    let_it_be(:hidden_merge_request) { create(:merge_request, source_project: project, author: author) }
+
+    it 'does not allow non-admin user to read the merge_request' do
+      expect(permissions(user, hidden_merge_request)).not_to be_allowed(:read_merge_request)
+    end
+
+    it 'allows admin to read the merge_request', :enable_admin_mode do
+      expect(permissions(admin, hidden_merge_request)).to be_allowed(:read_merge_request)
+    end
+  end
 end
diff --git a/spec/requests/projects/merge_requests_controller_spec.rb b/spec/requests/projects/merge_requests_controller_spec.rb
index f5f8b5c2d83ed5abeff2ab44dac9440d8c4adefc..4d0e47b7f655982d96e67835c1404a18429069e6 100644
--- a/spec/requests/projects/merge_requests_controller_spec.rb
+++ b/spec/requests/projects/merge_requests_controller_spec.rb
@@ -8,14 +8,30 @@
   let_it_be(:user) { merge_request.author }
 
   describe 'GET #show' do
-    before do
-      login_as(user)
+    context 'when logged in' do
+      before do
+        login_as(user)
+      end
+
+      it_behaves_like "observability csp policy", described_class do
+        let(:tested_path) do
+          project_merge_request_path(project, merge_request)
+        end
+      end
     end
 
-    it_behaves_like "observability csp policy", described_class do
-      let(:tested_path) do
-        project_merge_request_path(project, merge_request)
+    context 'when the author of the merge request is banned' do
+      let_it_be(:user) { create(:user, :banned) }
+      let_it_be(:project) { create(:project, :public) }
+      let_it_be(:merge_request) { create(:merge_request, source_project: project, author: user) }
+
+      subject { response }
+
+      before do
+        get project_merge_request_path(project, merge_request)
       end
+
+      it { is_expected.to have_gitlab_http_status(:not_found) }
     end
   end