diff --git a/server/account/src/admin.ts b/server/account/src/admin.ts
new file mode 100644
index 0000000000..c5199e4b30
--- /dev/null
+++ b/server/account/src/admin.ts
@@ -0,0 +1,19 @@
+//
+// Copyright © 2025 Hardcore Engineering Inc.
+//
+// Licensed under the Eclipse Public License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License. You may
+// obtain a copy of the License at https://www.eclipse.org/legal/epl-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+//
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+const ADMIN_EMAILS = new Set(process.env.ADMIN_EMAILS?.split(',') ?? [])
+
+export function isAdminEmail (email: string): boolean {
+  return ADMIN_EMAILS.has(email.trim())
+}
diff --git a/server/account/src/operations.ts b/server/account/src/operations.ts
index ecdbd36e8f..fff46dc1c2 100644
--- a/server/account/src/operations.ts
+++ b/server/account/src/operations.ts
@@ -91,12 +91,11 @@ import {
   wrap,
   verifyAllowedServices
 } from './utils'
+import { isAdminEmail } from './admin'
 
 // Move to config?
 const processingTimeoutMs = 30 * 1000
 
-const ADMIN_EMAILS = new Set(process.env.ADMIN_EMAILS?.split(',') ?? [])
-
 /* =================================== */
 /* ============OPERATIONS============= */
 /* =================================== */
@@ -132,12 +131,12 @@ export async function login (
 
     const isConfirmed = emailSocialId.verifiedOn != null
 
-    const isAdmin: Record<string, string> = ADMIN_EMAILS.has(email.trim()) ? { admin: 'true' } : {}
-    ctx.info('Login succeeded', { email, normalizedEmail, isConfirmed, emailSocialId, ...isAdmin })
+    const extraToken: Record<string, string> = isAdminEmail(email) ? { admin: 'true' } : {}
+    ctx.info('Login succeeded', { email, normalizedEmail, isConfirmed, emailSocialId, ...extraToken })
 
     return {
       account: existingAccount.uuid,
-      token: isConfirmed ? generateToken(existingAccount.uuid, undefined, isAdmin) : undefined
+      token: isConfirmed ? generateToken(existingAccount.uuid, undefined, extraToken) : undefined
     }
   } catch (err: any) {
     Analytics.handleError(err)
diff --git a/server/account/src/utils.ts b/server/account/src/utils.ts
index 9793087643..feebb45a2c 100644
--- a/server/account/src/utils.ts
+++ b/server/account/src/utils.ts
@@ -536,7 +536,7 @@ export async function selectWorkspace (
   if (accountUuid === systemAccountUuid) {
     return {
       account: accountUuid,
-      token: generateToken(accountUuid, workspace.uuid),
+      token: generateToken(accountUuid, workspace.uuid, extra),
       endpoint: getEndpoint(ctx, workspace.uuid, workspace.region, getKind(workspace.region)),
       workspace: workspace.uuid,
       workspaceUrl: workspace.url,
@@ -563,7 +563,7 @@ export async function selectWorkspace (
 
   return {
     account: accountUuid,
-    token: generateToken(accountUuid, workspace.uuid),
+    token: generateToken(accountUuid, workspace.uuid, extra),
     endpoint: getEndpoint(ctx, workspace.uuid, workspace.region, getKind(workspace.region)),
     workspace: workspace.uuid,
     workspaceUrl: workspace.url,