diff --git a/app/controllers/groups_controller.rb b/app/controllers/groups_controller.rb
index b91559d3df2..685393f8783 100644
--- a/app/controllers/groups_controller.rb
+++ b/app/controllers/groups_controller.rb
@@ -218,26 +218,43 @@ class GroupsController < ApplicationController
       "#{SiteSetting.title} - #{I18n.t("rss_description.group_posts", group_name: group.name)}"
     @link = Discourse.base_url
     @description = I18n.t("rss_description.group_posts", group_name: group.name)
+
     render "posts/latest", formats: [:rss]
   end
 
   def mentions
     raise Discourse::NotFound unless SiteSetting.enable_mentions?
+
     group = find_group(:group_id)
+    guardian.ensure_can_see_group_members!(group)
+
     posts =
       group.mentioned_posts_for(guardian, params.permit(:before_post_id, :category_id)).limit(20)
-    render_serialized posts.to_a, GroupPostSerializer
+
+    response = { posts: serialize_data(posts, GroupPostSerializer) }
+
+    if guardian.can_lazy_load_categories?
+      category_ids = posts.map { |p| p.topic.category_id }.compact.uniq
+      categories = Category.secured(guardian).with_parents(category_ids)
+      response[:categories] = serialize_data(categories, CategoryBadgeSerializer)
+    end
+
+    render json: response
   end
 
   def mentions_feed
     raise Discourse::NotFound unless SiteSetting.enable_mentions?
+
     group = find_group(:group_id)
+    guardian.ensure_can_see_group_members!(group)
+
     @posts =
       group.mentioned_posts_for(guardian, params.permit(:before_post_id, :category_id)).limit(50)
     @title =
       "#{SiteSetting.title} - #{I18n.t("rss_description.group_mentions", group_name: group.name)}"
     @link = Discourse.base_url
     @description = I18n.t("rss_description.group_mentions", group_name: group.name)
+
     render "posts/latest", formats: [:rss]
   end
 
diff --git a/spec/requests/groups_controller_spec.rb b/spec/requests/groups_controller_spec.rb
index cb8e5fb4384..c679ebedb1f 100644
--- a/spec/requests/groups_controller_spec.rb
+++ b/spec/requests/groups_controller_spec.rb
@@ -526,6 +526,46 @@ RSpec.describe GroupsController do
     end
   end
 
+  describe "#mentions" do
+    it "ensures mentions are enabled" do
+      SiteSetting.enable_mentions = false
+
+      sign_in(user)
+      get "/groups/#{group.name}/mentions.json"
+
+      expect(response.status).to eq(404)
+    end
+
+    it "ensures the group can be seen" do
+      sign_in(user)
+      group.update!(visibility_level: Group.visibility_levels[:owners])
+
+      get "/groups/#{group.name}/mentions.json"
+
+      expect(response.status).to eq(404)
+    end
+
+    it "ensures the group members can be seen" do
+      sign_in(user)
+      group.update!(members_visibility_level: Group.visibility_levels[:owners])
+
+      get "/groups/#{group.name}/mentions.json"
+
+      expect(response.status).to eq(403)
+    end
+
+    it "returns the right response" do
+      post = Fabricate(:post)
+      GroupMention.create!(post: post, group: group)
+
+      sign_in(user)
+      get "/groups/#{group.name}/mentions.json"
+
+      expect(response.status).to eq(200)
+      expect(response.parsed_body["posts"].first["id"]).to eq(post.id)
+    end
+  end
+
   describe "#posts" do
     it "ensures the group can be seen" do
       sign_in(user)