diff --git a/src/lib/errors.ts b/src/lib/errors.ts
index 62a49bc..4469cb3 100644
--- a/src/lib/errors.ts
+++ b/src/lib/errors.ts
@@ -12,6 +12,7 @@ export const ERRORS = {
       "Invalid passkey registration. Please request a new challenge first.",
     EITHER_PASSKEY_OR_PHRASE: "Either passkey or passphrase must be provided",
     BOTH_PASSKEY_AND_PHRASE: "Cannot provide both passkey and passphrase",
+    SESSION_MISSING: "No session found",
   },
   TENANTS: {
     NAME_EXISTS: "A tenant with this short name already exists",
diff --git a/src/lib/server/services/agent-service.ts b/src/lib/server/services/agent-service.ts
index 208d905..790bf82 100644
--- a/src/lib/server/services/agent-service.ts
+++ b/src/lib/server/services/agent-service.ts
@@ -10,13 +10,13 @@ import { ValidationError, NotFoundError, ConflictError } from "../utils/errors";
 const agentCreationSchema = z.object({
   name: z.string().min(1).max(100),
   description: z.string().optional(),
-  image: z.string().optional(),
+  image: z.string().optional().nullable(),
 });
 
 const agentUpdateSchema = z.object({
   name: z.string().min(1).max(100).optional(),
   description: z.string().optional(),
-  image: z.string().optional(),
+  image: z.string().optional().nullable(),
 });
 
 const absenceCreationSchema = z.object({
diff --git a/src/routes/api/admin/tenant/+server.ts b/src/routes/api/admin/tenant/+server.ts
index cf801ee..6ae1016 100644
--- a/src/routes/api/admin/tenant/+server.ts
+++ b/src/routes/api/admin/tenant/+server.ts
@@ -1,7 +1,7 @@
 import { json, type RequestHandler } from "@sveltejs/kit";
 import { z } from "zod";
 import { centralDb } from "$lib/server/db";
-import { tenant } from "$lib/server/db/central-schema";
+import { tenant, userSession } from "$lib/server/db/central-schema";
 import { eq } from "drizzle-orm";
 import {
   BackendError,
@@ -35,6 +35,10 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
     const body = await request.json();
     const validation = tenantSwitchSchema.safeParse(body);
 
+    if (!locals.user?.sessionId) {
+      throw new ValidationError(ERRORS.SECURITY.SESSION_MISSING);
+    }
+
     if (!validation.success) {
       logger.warn("Invalid tenant switch request", {
         userId: locals.user?.id,
@@ -69,17 +73,23 @@ export const POST: RequestHandler = async ({ request, locals, cookies }) => {
 
     if (!updatedUser) {
       logger.error("Failed to update user tenant", {
-        userId: locals.user?.userId,
+        userId: locals.user.userId,
         tenantId,
       });
       throw new InternalError(ERRORS.USERS.FAILED_TO_UPDATE);
     }
 
     // Generate new access token with updated tenant context
-    const newAccessToken = await generateAccessToken(
-      updatedUser,
-      (locals.user?.sessionId as string) || "temp-session",
-    );
+    const newAccessToken = await generateAccessToken(updatedUser, locals.user.sessionId);
+
+    // Update session with new access token
+    await centralDb
+      .update(userSession)
+      .set({
+        accessToken: newAccessToken,
+        lastUsedAt: new Date(),
+      })
+      .where(eq(userSession.id, locals.user.sessionId));
 
     // Set new access token cookie
     cookies.set("access_token", newAccessToken, {