diff --git a/app/server/modules/sso/sso.integration.ts b/app/server/modules/sso/sso.integration.ts
index be50d709..00a4695b 100644
--- a/app/server/modules/sso/sso.integration.ts
+++ b/app/server/modules/sso/sso.integration.ts
@@ -170,7 +170,10 @@ async function beforeAcceptInvitation({ invitation }: AcceptInvitationHookData)
 
 export const ssoIntegration = {
 	plugin: sso({
-		trustEmailVerified: false,
+		// Better Auth's SSO callback only reaches our account-linking hook when the
+		// provider email is trusted. The hook below still enforces org membership or
+		// an explicit invitation intent before any existing account can be linked.
+		trustEmailVerified: true,
 		providersLimit: async (user: User) => {
 			const isOrgAdmin = await authService.isOrgAdminAnywhere(user.id);
 			return isOrgAdmin ? 10 : 0;