diff --git a/backend/.sqlx/query-c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5.json b/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
similarity index 52%
rename from backend/.sqlx/query-c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5.json
rename to backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
index bf8e2eceaf..dc7c41cfd3 100644
--- a/backend/.sqlx/query-c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5.json
+++ b/backend/.sqlx/query-192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "DELETE FROM scim_deactivated_user WHERE email = $1",
+  "query": "DELETE FROM token WHERE email = $1",
   "describe": {
     "columns": [],
     "parameters": {
@@ -10,5 +10,5 @@
     },
     "nullable": []
   },
-  "hash": "c8b50b6ff9e73844e14fc36f01c324415093cd5c904cba0825c69afd37d1eeb5"
+  "hash": "192ddae8c3c82a8f099a4944483024d9826a328bf0416c22daf06fff5ced08f6"
 }
diff --git a/backend/.sqlx/query-1d0e4015ddca083d210cb8cf759b5bc0fca32b608327ff475f66a48de88d8f9a.json b/backend/.sqlx/query-1d0e4015ddca083d210cb8cf759b5bc0fca32b608327ff475f66a48de88d8f9a.json
deleted file mode 100644
index e6f559d884..0000000000
--- a/backend/.sqlx/query-1d0e4015ddca083d210cb8cf759b5bc0fca32b608327ff475f66a48de88d8f9a.json
+++ /dev/null
@@ -1,14 +0,0 @@
-{
-  "db_name": "PostgreSQL",
-  "query": "INSERT INTO scim_deactivated_user (email, name) SELECT email, name FROM password WHERE email = $1 ON CONFLICT (email) DO UPDATE SET deactivated_at = NOW(), name = EXCLUDED.name",
-  "describe": {
-    "columns": [],
-    "parameters": {
-      "Left": [
-        "Text"
-      ]
-    },
-    "nullable": []
-  },
-  "hash": "1d0e4015ddca083d210cb8cf759b5bc0fca32b608327ff475f66a48de88d8f9a"
-}
diff --git a/backend/.sqlx/query-23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443.json b/backend/.sqlx/query-23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443.json
new file mode 100644
index 0000000000..d6946e80d0
--- /dev/null
+++ b/backend/.sqlx/query-23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443.json
@@ -0,0 +1,28 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT email, disabled FROM password WHERE email = $1",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "email",
+        "type_info": "Varchar"
+      },
+      {
+        "ordinal": 1,
+        "name": "disabled",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false,
+      false
+    ]
+  },
+  "hash": "23b9c862d050b00aaa332527b62ef901cd3c417b9f3af03f35009213143bd443"
+}
diff --git a/backend/.sqlx/query-8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67.json b/backend/.sqlx/query-8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67.json
new file mode 100644
index 0000000000..fc86915946
--- /dev/null
+++ b/backend/.sqlx/query-8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67.json
@@ -0,0 +1,15 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "UPDATE password SET disabled = $1 WHERE email = $2",
+  "describe": {
+    "columns": [],
+    "parameters": {
+      "Left": [
+        "Bool",
+        "Text"
+      ]
+    },
+    "nullable": []
+  },
+  "hash": "8bd266705fc8272f3d8941922ad7d18161eb6f5ec1ba9f1b55feffe8b6518c67"
+}
diff --git a/backend/.sqlx/query-6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412.json b/backend/.sqlx/query-99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3.json
similarity index 68%
rename from backend/.sqlx/query-6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412.json
rename to backend/.sqlx/query-99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3.json
index 7096b481f4..6e9dd142f6 100644
--- a/backend/.sqlx/query-6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412.json
+++ b/backend/.sqlx/query-99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT instance_group.id, COALESCE(instance_group.scim_display_name, instance_group.name) as display_name\n             FROM email_to_igroup\n             JOIN instance_group ON instance_group.name = email_to_igroup.igroup\n             WHERE email_to_igroup.email = $1",
+  "query": "SELECT instance_group.id, COALESCE(instance_group.scim_display_name, instance_group.name) as display_name\n         FROM email_to_igroup\n         JOIN instance_group ON instance_group.name = email_to_igroup.igroup\n         WHERE email_to_igroup.email = $1",
   "describe": {
     "columns": [
       {
@@ -24,5 +24,5 @@
       null
     ]
   },
-  "hash": "6d33c5aa3965682831d0cb3f1d8ca17c7a59c468f6758be0dc4391734987b412"
+  "hash": "99c289a8bcf87588ecb89575f66e1fbfce74dd6b69a8a039714a02ce7558a1b3"
 }
diff --git a/backend/.sqlx/query-ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21.json b/backend/.sqlx/query-ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21.json
new file mode 100644
index 0000000000..a9348dfa8b
--- /dev/null
+++ b/backend/.sqlx/query-ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21.json
@@ -0,0 +1,22 @@
+{
+  "db_name": "PostgreSQL",
+  "query": "SELECT super_admin FROM password WHERE email = $1 AND disabled = false",
+  "describe": {
+    "columns": [
+      {
+        "ordinal": 0,
+        "name": "super_admin",
+        "type_info": "Bool"
+      }
+    ],
+    "parameters": {
+      "Left": [
+        "Text"
+      ]
+    },
+    "nullable": [
+      false
+    ]
+  },
+  "hash": "ccc49a2a6e11f874825365de758bdc0e1934d67d3f2b14047d434b77d370af21"
+}
diff --git a/backend/.sqlx/query-638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6.json b/backend/.sqlx/query-daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656.json
similarity index 59%
rename from backend/.sqlx/query-638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6.json
rename to backend/.sqlx/query-daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656.json
index d37bc73dad..5b18e66ed4 100644
--- a/backend/.sqlx/query-638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6.json
+++ b/backend/.sqlx/query-daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656.json
@@ -1,6 +1,6 @@
 {
   "db_name": "PostgreSQL",
-  "query": "INSERT INTO password (email, login_type, verified, username, name) VALUES ($1, 'saml', true, $2, $3) ON CONFLICT DO NOTHING",
+  "query": "INSERT INTO password (email, login_type, verified, username, name) VALUES ($1, 'saml', true, $2, $3) ON CONFLICT (email) DO UPDATE SET disabled = false",
   "describe": {
     "columns": [],
     "parameters": {
@@ -12,5 +12,5 @@
     },
     "nullable": []
   },
-  "hash": "638d3c2ba1198dce5b5b0e47df59a92ff8011e19fbefcc3960d6f0fe167e55b6"
+  "hash": "daa1a6bf3d4a1001da88301932a7ac9019767074158e0c027988e5b0d51a3656"
 }
diff --git a/backend/.sqlx/query-b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5.json b/backend/.sqlx/query-fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924.json
similarity index 54%
rename from backend/.sqlx/query-b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5.json
rename to backend/.sqlx/query-fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924.json
index da2686d243..c85c557a90 100644
--- a/backend/.sqlx/query-b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5.json
+++ b/backend/.sqlx/query-fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924.json
@@ -1,11 +1,11 @@
 {
   "db_name": "PostgreSQL",
-  "query": "SELECT EXISTS(SELECT 1 FROM scim_deactivated_user WHERE email = $1)",
+  "query": "SELECT disabled FROM password WHERE email = $1",
   "describe": {
     "columns": [
       {
         "ordinal": 0,
-        "name": "exists",
+        "name": "disabled",
         "type_info": "Bool"
       }
     ],
@@ -15,8 +15,8 @@
       ]
     },
     "nullable": [
-      null
+      false
     ]
   },
-  "hash": "b8a99e0658a97e9c4950f37a8e68e19d1723bcb5bfa05f50fa22e30683d98ee5"
+  "hash": "fc6c6310ae8ac5eb351d7e2af1678447d0aa3d143e94e49924ff7ac8b7abf924"
 }
diff --git a/backend/ee-repo-ref.txt b/backend/ee-repo-ref.txt
index 81101f3d8d..6c40da5a0c 100644
--- a/backend/ee-repo-ref.txt
+++ b/backend/ee-repo-ref.txt
@@ -1 +1 @@
-a3a554aa2a142aef61cf346160272ec95397d961
\ No newline at end of file
+e505e0413649966e36fc02c7f2bf293fe153334f
\ No newline at end of file
diff --git a/backend/migrations/20260324000000_scim_deactivated_user.down.sql b/backend/migrations/20260324000000_scim_deactivated_user.down.sql
index 6c2e5a2ba5..1af6e77c62 100644
--- a/backend/migrations/20260324000000_scim_deactivated_user.down.sql
+++ b/backend/migrations/20260324000000_scim_deactivated_user.down.sql
@@ -1 +1 @@
-DROP TABLE IF EXISTS scim_deactivated_user;
+ALTER TABLE password DROP COLUMN IF EXISTS disabled;
diff --git a/backend/migrations/20260324000000_scim_deactivated_user.up.sql b/backend/migrations/20260324000000_scim_deactivated_user.up.sql
index 6d27fcd879..7410481bdd 100644
--- a/backend/migrations/20260324000000_scim_deactivated_user.up.sql
+++ b/backend/migrations/20260324000000_scim_deactivated_user.up.sql
@@ -1,5 +1 @@
-CREATE TABLE scim_deactivated_user (
-    email VARCHAR(255) PRIMARY KEY,
-    name VARCHAR(255),
-    deactivated_at TIMESTAMP WITH TIME ZONE NOT NULL DEFAULT NOW()
-);
+ALTER TABLE password ADD COLUMN disabled BOOLEAN NOT NULL DEFAULT false;
diff --git a/backend/windmill-api-users/src/users.rs b/backend/windmill-api-users/src/users.rs
index 8f7bec1398..627e8be3fe 100644
--- a/backend/windmill-api-users/src/users.rs
+++ b/backend/windmill-api-users/src/users.rs
@@ -1687,7 +1687,7 @@ async fn login(
     };
     let email_w_h: Option<(String, String, bool)> = sqlx::query_as(
         "SELECT email, password_hash, super_admin FROM password WHERE email = $1 AND login_type = \
-         'password'",
+         'password' AND disabled = false",
     )
     .bind(&email)
     .fetch_optional(&mut *tx)
@@ -1776,7 +1776,7 @@ async fn refresh_token(
     }
 
     let super_admin = sqlx::query_scalar!(
-        "SELECT super_admin FROM password WHERE email = $1",
+        "SELECT super_admin FROM password WHERE email = $1 AND disabled = false",
         &authed.email
     )
     .fetch_optional(&mut *tx)