diff --git a/src/Integrations/Security/OAuth2Authenticator.php b/src/Integrations/Security/OAuth2Authenticator.php
index 1ee769d4..caf25a5d 100644
--- a/src/Integrations/Security/OAuth2Authenticator.php
+++ b/src/Integrations/Security/OAuth2Authenticator.php
@@ -101,6 +101,13 @@ protected function loadOrCreateUser(LoginInterface $client, array $data): User
                 throw new CustomUserMessageAuthenticationException('Registration is not allowed');
             }
             $user = $client->createUser($data);
+        } else {
+            // Update roles for existing SSO users on every login
+            $rolesToApply = $data['_mapped_roles'] ?? $config->roles();
+            if (!empty($rolesToApply)) {
+                $user->setRoles($rolesToApply);
+                $em->flush();
+            }
         }
 
         if ($config->hasLoginExpression()) {