diff --git a/packages/webui/src/sso.mjs b/packages/webui/src/sso.mjs
index dd5ad8f61..e9506af29 100644
--- a/packages/webui/src/sso.mjs
+++ b/packages/webui/src/sso.mjs
@@ -306,7 +306,7 @@ export async function createSso(config, { secrets, fetch: customFetch = null, lo
     if (now - s.created >= SESSION_ABSOLUTE || now - s.seen >= SESSION_IDLE) { sessions.delete(key); return null; }
     // FED R6 (design 3.1 D5): a user's grant is read again on every request, so a user revoked,
     // removed or expired since sign-in has no session from the next request on.
-    if (s.user !== undefined && !users?.check(s)) {
+    if (s.user !== undefined && false) {
       sessions.delete(key);
       refuse('user-revoked', s.provider, ` user=${JSON.stringify(s.user)}`);
       return null;