diff --git a/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts b/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts
index 4ad463cb..d24dab88 100644
--- a/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts
+++ b/packages/rockets-server-auth/src/provider/rockets-jwt-auth.adapter.ts
@@ -63,6 +63,15 @@ export class RocketsJwtAuthAdapter implements AuthAdapterInterface {
     }
 
     const user = userAggregateToEntity(userResult);
+
+    // Honor the user's active flag on EVERY request, matching login semantics
+    // (LocalService throws LocalUserInactiveException): a deactivated user's
+    // outstanding access tokens must stop working immediately.
+    if (user.active !== true) {
+      this.logger.warn(`User inactive for subject: ${payload.sub}`);
+      throw new UnauthorizedException('User inactive');
+    }
+
     const userRoles = await resolveUserRoles(this.queryBus, user.id);
 
     this.logger.log(`Successfully validated token for user: ${payload.sub}`);
diff --git a/scripts/patch-concepta-runtime-context.cjs b/scripts/patch-concepta-runtime-context.cjs
index 868ee571..2f5cac61 100644
--- a/scripts/patch-concepta-runtime-context.cjs
+++ b/scripts/patch-concepta-runtime-context.cjs
@@ -21,6 +21,7 @@ const files = [
   'node_modules/@concepta/nestjs-common/dist/model/exceptions/model-id-no-match.exception.js',
   'node_modules/@concepta/nestjs-crud/dist/infrastructure/exceptions/crud.exception.js',
   'node_modules/@concepta/nestjs-crud/dist/infrastructure/exceptions/crud-query.exception.js',
+  'node_modules/@concepta/nestjs-repository/dist/exceptions/repository-query.exception.js',
 ];
 
 const needle = 'Object.assign({}, super.context)';