diff --git a/pkg/planner/optimize.go b/pkg/planner/optimize.go
index 64865b62a6..27b4e57f27 100644
--- a/pkg/planner/optimize.go
+++ b/pkg/planner/optimize.go
@@ -150,7 +150,7 @@ func Optimize(ctx context.Context, sctx sessionctx.Context, node ast.Node, is in
 		defer debugtrace.LeaveContextCommon(sctx)
 	}
 
-	if !sctx.GetSessionVars().InRestrictedSQL && variable.RestrictedReadOnly.Load() || variable.VarTiDBSuperReadOnly.Load() {
+	if !sctx.GetSessionVars().InRestrictedSQL && (variable.RestrictedReadOnly.Load() || variable.VarTiDBSuperReadOnly.Load()) {
 		allowed, err := allowInReadOnlyMode(sctx, node)
 		if err != nil {
 			return nil, nil, err
diff --git a/pkg/session/session.go b/pkg/session/session.go
index 0f78423e4d..d85f4b0e49 100644
--- a/pkg/session/session.go
+++ b/pkg/session/session.go
@@ -507,7 +507,7 @@ func (s *session) doCommit(ctx context.Context) error {
 		return nil
 	}
 	// check if the cluster is read-only
-	if !s.sessionVars.InRestrictedSQL && variable.RestrictedReadOnly.Load() || variable.VarTiDBSuperReadOnly.Load() {
+	if !s.sessionVars.InRestrictedSQL && (variable.RestrictedReadOnly.Load() || variable.VarTiDBSuperReadOnly.Load()) {
 		// It is not internal SQL, and the cluster has one of RestrictedReadOnly or SuperReadOnly
 		// We need to privilege check again: a privilege check occurred during planning, but we need
 		// to prevent the case that a long running auto-commit statement is now trying to commit.
diff --git a/tests/readonlytest/BUILD.bazel b/tests/readonlytest/BUILD.bazel
index 43be31b700..d7f97572bf 100644
--- a/tests/readonlytest/BUILD.bazel
+++ b/tests/readonlytest/BUILD.bazel
@@ -9,6 +9,8 @@ go_test(
     ],
     flaky = True,
     deps = [
+        "//pkg/kv",
+        "//pkg/testkit",
         "//pkg/testkit/testsetup",
         "@com_github_go_sql_driver_mysql//:mysql",
         "@com_github_stretchr_testify//require",
diff --git a/tests/readonlytest/readonly_test.go b/tests/readonlytest/readonly_test.go
index 654e254273..8ae846fe1a 100644
--- a/tests/readonlytest/readonly_test.go
+++ b/tests/readonlytest/readonly_test.go
@@ -23,6 +23,8 @@ import (
 	"time"
 
 	_ "github.com/go-sql-driver/mysql"
+	"github.com/pingcap/tidb/pkg/kv"
+	"github.com/pingcap/tidb/pkg/testkit"
 	"github.com/stretchr/testify/require"
 	"go.opencensus.io/stats/view"
 )
@@ -266,3 +268,21 @@ func TestReplicationWriter(t *testing.T) {
 	<-timer.C
 	done <- struct{}{}
 }
+
+func TestInternalSQL(t *testing.T) {
+	ctx := kv.WithInternalSourceType(context.Background(), kv.InternalTxnStats)
+	store := testkit.CreateMockStore(t)
+	tk := testkit.NewTestKit(t, store)
+
+	defer func() {
+		tk.MustExec("set global tidb_restricted_read_only=default")
+		tk.MustExec("set global tidb_super_read_only=default")
+	}()
+
+	tk.MustExec("set global tidb_restricted_read_only=On")
+	tk.MustExec("set global tidb_super_read_only=On")
+
+	sql := "insert into mysql.stats_top_n (table_id, is_index, hist_id, value, count) values (874, 0, 1, 'a', 3)"
+	_, err := tk.Session().ExecuteInternal(ctx, sql)
+	require.NoError(t, err)
+}