diff --git a/app/services/user_service.py b/app/services/user_service.py
index 8e8656b..c0c1f89 100644
--- a/app/services/user_service.py
+++ b/app/services/user_service.py
@@ -100,6 +100,7 @@ class UserService:
             user_id=user.id,
             tenant_id=tenant_id,
             is_default=True,
+            role_id=role_id,
         )
         db.add(ut)
         await db.flush()
@@ -135,6 +136,15 @@ class UserService:
             user.role = role
         if role_id is not _UNSET:
             user.role_id = role_id
+            # Sync UserTenant.role_id so resolve_permissions picks up the change
+            ut_q = select(UserTenant).where(
+                UserTenant.user_id == user_id,
+                UserTenant.tenant_id == tenant_id,
+            )
+            ut_result = await db.execute(ut_q)
+            user_tenant = ut_result.scalar_one_or_none()
+            if user_tenant:
+                user_tenant.role_id = role_id
         if is_active is not None:
             user.is_active = is_active