diff --git a/src/lib/supabase/AuthProvider.tsx b/src/lib/supabase/AuthProvider.tsx
index e3b63cf9f..82c57199a 100644
--- a/src/lib/supabase/AuthProvider.tsx
+++ b/src/lib/supabase/AuthProvider.tsx
@@ -280,7 +280,7 @@ export function AuthProvider({ children }: { children: React.ReactNode }) {
 
       const { error } = await supabase.auth.signInWithOtp({
         email: normalizedEmail,
-        options: { shouldCreateUser: false },
+        options: { shouldCreateUser: true },
       });
       if (error) throw error;
     },
diff --git a/src/test/auth/AuthProvider.behavior.test.tsx b/src/test/auth/AuthProvider.behavior.test.tsx
index aba082ede..f6ffad060 100644
--- a/src/test/auth/AuthProvider.behavior.test.tsx
+++ b/src/test/auth/AuthProvider.behavior.test.tsx
@@ -416,7 +416,7 @@ describe('AuthProvider behavior', () => {
     });
   });
 
-  it('sends an email OTP for the normalized email address', async () => {
+  it('allows email OTP signup for the normalized email address', async () => {
     render(
       <AuthProvider>
         <PasswordlessAuthConsumer />
@@ -428,7 +428,7 @@ describe('AuthProvider behavior', () => {
     await waitFor(() => {
       expect(signInWithOtpMock).toHaveBeenCalledWith({
         email: 'student@example.com',
-        options: { shouldCreateUser: false },
+        options: { shouldCreateUser: true },
       });
     });
   });
diff --git a/supabase/migrations/20260907155821_reconcile_user_roles_updated_at.sql b/supabase/migrations/20260907155821_reconcile_user_roles_updated_at.sql
new file mode 100644
index 000000000..dac9cbd5f
--- /dev/null
+++ b/supabase/migrations/20260907155821_reconcile_user_roles_updated_at.sql
@@ -0,0 +1,4 @@
+-- Production's legacy user_roles table predates the updated_at column used by
+-- current admin and demo-code upserts. Newer environments already have it.
+ALTER TABLE public.user_roles
+ADD COLUMN IF NOT EXISTS updated_at timestamptz NOT NULL DEFAULT now();