diff --git a/apps/users/src/handlers/auth.rs b/apps/users/src/handlers/auth.rs
index cce3a4f..23702f6 100644
--- a/apps/users/src/handlers/auth.rs
+++ b/apps/users/src/handlers/auth.rs
@@ -330,14 +330,19 @@ async fn register(
     for role_key in role_candidates {
         let role_id = ensure_role_exists(&state.pool, &role_key).await;
         if let Some(role_id) = role_id {
-            // For demo accounts, auto-approve the role immediately
-            let status = if is_demo_account { "APPROVED" } else { "PENDING" };
-            
+            // Roles assigned at signup are immediately ACTIVE for login + session.
+            // Document/profile review (handled separately in onboarding / verifications)
+            // still uses PENDING_APPROVAL via user_role_profiles — do NOT gate raw
+            // role assignment on that flow. Previously this defaulted to "PENDING"
+            // which made get_user_role_keys return [] and login issued a JWT with
+            // no role, breaking the "role not assigned" UX bug.
+            let status = "APPROVED";
+
             // Try to update existing assignment first
             let update_result = sqlx::query(
                 r#"
                 UPDATE user_role_assignments
-                SET status = $3
+                SET status = $3, approved_at = NOW()
                 WHERE user_id = $1 AND role_id = $2
                 "#,
             )