diff --git a/src/deviceutils/device_api.c b/src/deviceutils/device_api.c
index 3b719c57..68fc5283 100644
--- a/src/deviceutils/device_api.c
+++ b/src/deviceutils/device_api.c
@@ -43,12 +43,12 @@
 /* function isSecureDbgSrvUnlocked - determines whether secure debug services may be enabled for the given build type.
  *       Usage: bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType)
  *
- *       For eDEV builds, debug services are always unlocked.
+ *       For non-PROD builds (eDEV, eVBN, eQA, etc.), debug services are always unlocked.
  *
  *       For ePROD builds, debug services are unlocked only when all of the following are true:
  *           - debug services are enabled via isDebugServicesEnabled() (RFC-controlled),
  *           - the LABSIGNED_ENABLED device property indicates a labsigned image, and
- *           - the deviceType value from RFC allows test devices (for example "test").
+ *           - the deviceType value from RFC is "test".
  *
  *       RETURN - true if secure debug services are allowed to run for the given build type; false otherwise.
  */
@@ -59,10 +59,10 @@ bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType)
 	char labsigned[8] = {0};
 	int ret = -1;
 
-    if (eBuildType == eDEV) {
+    if (eBuildType != ePROD) {
         isDebugServicesUnlocked = true;
     }
-    else if (eBuildType == ePROD) 
+    else /* eBuildType == ePROD */
 	{
 		bool dbgServices = isDebugServicesEnabled();
 		getDeviceTypeRFC(deviceType, sizeof(deviceType));
diff --git a/src/deviceutils/device_api.h b/src/deviceutils/device_api.h
index 19a36969..202fa2ca 100644
--- a/src/deviceutils/device_api.h
+++ b/src/deviceutils/device_api.h
@@ -305,16 +305,16 @@ size_t GetServURL(char *pServURL, size_t szBufSize);
  *
  *         The decision is based on:
  *           - DbgServices RFC
- *           - DeviceType RFC
- *           - build type (Dev or Prod)
+ *           - DeviceType RFC (lowercase "test" or "prod")
+ *           - build type (non-PROD vs Prod)
  *           - LABSIGNED_ENABLED property value from /etc/device.properties
  *
  *         Usage: bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType)
  *
  *         RETURN - true if:
- *                    - the build type is Dev; or
+ *                    - the build type is non-PROD (Dev, VBN, QA, etc.); or
  *                    - the build type is Prod, DbgServices RFC is enabled,
- *                      DeviceType is "test", and LABSIGNED_ENABLED is set to true;
+ *                      DeviceType RFC is "test", and LABSIGNED_ENABLED is set to "true";
  *                  false otherwise.
  */
 bool isSecureDbgSrvUnlocked(BUILDTYPE eBuildType);
diff --git a/unittest/deviceutils/device_api_gtest.cpp b/unittest/deviceutils/device_api_gtest.cpp
index f7918bbd..e1c82148 100644
--- a/unittest/deviceutils/device_api_gtest.cpp
+++ b/unittest/deviceutils/device_api_gtest.cpp
@@ -509,7 +509,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessStatered_DebugServices_E
     //EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
     ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
     //EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(1));
-    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
     ret = system("echo \"https://www.statered.com\" > /tmp/stateredrecovry.conf");
     ret = GetServURL(output, sizeof(output));
     EXPECT_EQ(strncmp(output,servUrl,strlen(servUrl)),0);
@@ -528,7 +527,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessStatered_DebugServices_D
     //EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
     ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
     //EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(1));
-    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
     ret = system("echo \"https://www.statered.com\" > /tmp/stateredrecovry.conf");
     ret = GetServURL(output, sizeof(output));
     EXPECT_EQ(strncmp(output,servUrl,strlen(servUrl)),0);
@@ -544,10 +542,21 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessStatered_Prod_DebugServi
     int ret;
     char servUrl[]="https://www.statered.com";
     EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(true));
-    //EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
     ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
-    //EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(1));
     EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
+                .Times(1)
+                .WillOnce(Invoke([](char *deviceType, size_t size) {
+                    strncpy(deviceType, "test", size - 1);
+                    deviceType[size - 1] = '\0';
+                }));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
+                .Times(1)
+                .WillOnce(Invoke([](const char *model, char *data, int size) {
+                    strncpy(data, "true", size - 1);
+                    data[size - 1] = '\0';
+                    return 0; /* UTILS_SUCCESS */
+                }));
     ret = system("echo \"https://www.statered.com\" > /tmp/stateredrecovry.conf");
     ret = GetServURL(output, sizeof(output));
     EXPECT_EQ(strncmp(output,servUrl,strlen(servUrl)),0);
@@ -594,7 +603,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_DebugServices_E
     EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(0));
     //EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
     ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
-    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
     ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
     ret=GetServURL(output , sizeof(output));
     EXPECT_EQ(strncmp(output , servUrl , strlen(servUrl)),0);
@@ -614,7 +622,6 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_DebugServices_D
     EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(0));
     //EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _)).Times(1).WillOnce(Return(1));
     ret = system("echo \"BUILD_TYPE=vbn\" > /tmp/device_gtest.prop");
-    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
     ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
     ret=GetServURL(output , sizeof(output));
     EXPECT_EQ(strncmp(output , servUrl , strlen(servUrl)),0);
@@ -634,6 +641,19 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_Prod_DebugServi
     EXPECT_CALL(*g_DeviceUtilsMock, filePresentCheck(_)).Times(1).WillOnce(Return(0));
     ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
     EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
+                .Times(1)
+                .WillOnce(Invoke([](char *deviceType, size_t size) {
+                    strncpy(deviceType, "test", size - 1);
+                    deviceType[size - 1] = '\0';
+                }));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
+                .Times(1)
+                .WillOnce(Invoke([](const char *model, char *data, int size) {
+                    strncpy(data, "true", size - 1);
+                    data[size - 1] = '\0';
+                    return 0; /* UTILS_SUCCESS */
+                }));
     ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
     ret=GetServURL(output , sizeof(output));
     EXPECT_EQ(strncmp(output , servUrl , strlen(servUrl)),0);
@@ -670,6 +690,139 @@ TEST_F(DeviceApiTestFixture, TestName_GetServURL_SuccessSwupdate_Prod_DebugServi
     printf("Server URL = %s\n", output);
 }
 
+/* Tests for isSecureDbgSrvUnlocked PROD gating: labsigned + deviceType + dbgServices */
+
+/* PROD + dbgServices=false → locked (should not use state-red or swupdate override) */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_DbgDisabled_Locked)
+{
+    char output[64];
+    int ret;
+    char servUrl[]="https://www.tr181Rfc.com";
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(false));
+    ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+                .Times(1)
+                .WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
+                    strncpy(out_value, servUrl, datasize - 1);
+                    out_value[datasize - 1] = '\0';
+                    return (int)strlen(out_value);
+                }));
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
+    printf("Output ========================= %s\n ", output);
+    ret = system("rm -f /tmp/swupdate.conf");
+    ret = system("rm -f /tmp/device_gtest.prop");
+}
+
+/* PROD + dbgServices=true + deviceType=prod (not "test") → locked */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_DeviceTypeProd_Locked)
+{
+    char output[64];
+    int ret;
+    char servUrl[]="https://www.tr181Rfc.com";
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
+                .Times(1)
+                .WillOnce(Invoke([](char *deviceType, size_t size) {
+                    strncpy(deviceType, "prod", size - 1);
+                    deviceType[size - 1] = '\0';
+                }));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
+                .Times(1)
+                .WillOnce(Invoke([](const char *model, char *data, int size) {
+                    strncpy(data, "true", size - 1);
+                    data[size - 1] = '\0';
+                    return 0; /* UTILS_SUCCESS */
+                }));
+    ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+                .Times(1)
+                .WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
+                    strncpy(out_value, servUrl, datasize - 1);
+                    out_value[datasize - 1] = '\0';
+                    return (int)strlen(out_value);
+                }));
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
+    printf("Output ========================= %s\n ", output);
+    ret = system("rm -f /tmp/swupdate.conf");
+    ret = system("rm -f /tmp/device_gtest.prop");
+}
+
+/* PROD + dbgServices=true + deviceType=test + labsigned=false → locked */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_LabsignedFalse_Locked)
+{
+    char output[64];
+    int ret;
+    char servUrl[]="https://www.tr181Rfc.com";
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
+                .Times(1)
+                .WillOnce(Invoke([](char *deviceType, size_t size) {
+                    strncpy(deviceType, "test", size - 1);
+                    deviceType[size - 1] = '\0';
+                }));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
+                .Times(1)
+                .WillOnce(Invoke([](const char *model, char *data, int size) {
+                    strncpy(data, "false", size - 1);
+                    data[size - 1] = '\0';
+                    return 0; /* UTILS_SUCCESS */
+                }));
+    ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+                .Times(1)
+                .WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
+                    strncpy(out_value, servUrl, datasize - 1);
+                    out_value[datasize - 1] = '\0';
+                    return (int)strlen(out_value);
+                }));
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
+    printf("Output ========================= %s\n ", output);
+    ret = system("rm -f /tmp/swupdate.conf");
+    ret = system("rm -f /tmp/device_gtest.prop");
+}
+
+/* PROD + dbgServices=true + deviceType=test + getDevicePropertyData fails → locked */
+TEST_F(DeviceApiTestFixture, TestName_GetServURL_Prod_LabsignedCheckFails_Locked)
+{
+    char output[64];
+    int ret;
+    char servUrl[]="https://www.tr181Rfc.com";
+    EXPECT_CALL(*g_DeviceUtilsMock, isInStateRed()).Times(1).WillOnce(Return(false));
+    ret = system("echo \"BUILD_TYPE=PROD\" > /tmp/device_gtest.prop");
+    EXPECT_CALL(*g_DeviceUtilsMock, isDebugServicesEnabled()).Times(1).WillOnce(Return(true));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDeviceTypeRFC(_, _))
+                .Times(1)
+                .WillOnce(Invoke([](char *deviceType, size_t size) {
+                    strncpy(deviceType, "test", size - 1);
+                    deviceType[size - 1] = '\0';
+                }));
+    EXPECT_CALL(*g_DeviceUtilsMock, getDevicePropertyData(_, _, _))
+                .Times(1)
+                .WillOnce(Return(-1)); /* simulate failure */
+    ret = system("echo \"https://www.rdkautotool.com\" > /tmp/swupdate.conf");
+    EXPECT_CALL(*g_DeviceUtilsMock, read_RFCProperty(_, _, _, _))
+                .Times(1)
+                .WillOnce(Invoke([&servUrl](char *type, const char *key, char *out_value, size_t datasize) {
+                    strncpy(out_value, servUrl, datasize - 1);
+                    out_value[datasize - 1] = '\0';
+                    return (int)strlen(out_value);
+                }));
+    ret = GetServURL(output, sizeof(output));
+    EXPECT_EQ(strncmp(output, "https://www.tr181Rfc.com/xconf/swu/stb", strlen("https://www.tr181Rfc.com/xconf/swu/stb")), 0);
+    printf("Output ========================= %s\n ", output);
+    ret = system("rm -f /tmp/swupdate.conf");
+    ret = system("rm -f /tmp/device_gtest.prop");
+}
+
 /* COMMENTED OUT: GetBuildType is now in common_utilities
 TEST_F(DeviceApiTestFixture, TestName_GetBuildType_Success)
 {