diff --git a/session/session.go b/session/session.go
index 332ba34e4724c..2c6aa0567fa66 100644
--- a/session/session.go
+++ b/session/session.go
@@ -2241,7 +2241,7 @@ func (s *session) onTxnManagerStmtStartOrRetry(ctx context.Context, node ast.Stm
 
 func (s *session) validateStatementReadOnlyInStaleness(stmtNode ast.StmtNode) error {
 	vars := s.GetSessionVars()
-	if !vars.TxnCtx.IsStaleness && vars.TxnReadTS.PeakTxnReadTS() == 0 && !vars.EnableExternalTSRead {
+	if !vars.TxnCtx.IsStaleness && vars.TxnReadTS.PeakTxnReadTS() == 0 && !vars.EnableExternalTSRead || vars.InRestrictedSQL {
 		return nil
 	}
 	errMsg := "only support read-only statement during read-only staleness transactions"
diff --git a/sessiontxn/staleread/externalts_test.go b/sessiontxn/staleread/externalts_test.go
index 289c24d820d8f..2ee7c6f14f767 100644
--- a/sessiontxn/staleread/externalts_test.go
+++ b/sessiontxn/staleread/externalts_test.go
@@ -15,8 +15,10 @@
 package staleread_test
 
 import (
+	"context"
 	"testing"
 
+	"github.com/pingcap/tidb/kv"
 	"github.com/pingcap/tidb/parser/auth"
 	"github.com/pingcap/tidb/testkit"
 	"github.com/stretchr/testify/require"
@@ -67,12 +69,20 @@ func TestExternalTimestampReadonly(t *testing.T) {
 	tk.MustQuery("select @@tidb_external_ts").Check(testkit.Rows("0"))
 	tk.MustExec("start transaction;set global tidb_external_ts=@@tidb_current_ts;commit;")
 
+	// with tidb_enable_external_ts_read enabled, this session will be readonly
 	tk.MustExec("set tidb_enable_external_ts_read=ON")
 	_, err := tk.Exec("insert into t values (0)")
 	require.Error(t, err)
 
 	tk.MustExec("set tidb_enable_external_ts_read=OFF")
 	tk.MustExec("insert into t values (0)")
+
+	// even when tidb_enable_external_ts_read is enabled, internal SQL will not be affected
+	tk.MustExec("set tidb_enable_external_ts_read=ON")
+	tk.Session().GetSessionVars().InRestrictedSQL = true
+	ctx := kv.WithInternalSourceType(context.Background(), kv.InternalTxnOthers)
+	tk.MustExecWithContext(ctx, "insert into t values (1)")
+	tk.Session().GetSessionVars().InRestrictedSQL = false
 }
 
 func TestExternalTimestampReadWithTransaction(t *testing.T) {