diff --git a/apps/api/src/auth/auth.server.ts b/apps/api/src/auth/auth.server.ts
index b54ba8a074..3301dda54b 100644
--- a/apps/api/src/auth/auth.server.ts
+++ b/apps/api/src/auth/auth.server.ts
@@ -1,5 +1,6 @@
 import '../config/load-env';
 import {
+  ChangeEmailConfirmationEmail,
   MagicLinkEmail,
   OTPVerificationEmail,
   VerifyEmail,
@@ -572,6 +573,23 @@ export const auth = betterAuth({
   socialProviders,
   user: {
     modelName: 'User',
+    changeEmail: {
+      enabled: true,
+      // Double opt-in: this link goes to the CURRENT address; confirming it
+      // makes better-auth send a verification link to the NEW address (via
+      // emailVerification.sendVerificationEmail), which applies the change.
+      sendChangeEmailConfirmation: async ({ user, newEmail, url }) => {
+        await triggerEmail({
+          to: user.email,
+          subject: 'Confirm your email change for Comp AI',
+          react: ChangeEmailConfirmationEmail({
+            currentEmail: user.email,
+            newEmail,
+            url,
+          }),
+        });
+      },
+    },
   },
   organization: {
     modelName: 'Organization',
diff --git a/apps/api/src/email/templates/login-email-changed.tsx b/apps/api/src/email/templates/login-email-changed.tsx
new file mode 100644
index 0000000000..ad59f5eece
--- /dev/null
+++ b/apps/api/src/email/templates/login-email-changed.tsx
@@ -0,0 +1,80 @@
+import {
+  Body,
+  Container,
+  Font,
+  Heading,
+  Html,
+  Preview,
+  Section,
+  Tailwind,
+  Text,
+} from '@react-email/components';
+import { Footer } from '../components/footer';
+import { Logo } from '../components/logo';
+
+interface Props {
+  organizationName: string;
+  oldEmail: string;
+  newEmail: string;
+}
+
+export const LoginEmailChangedEmail = ({ organizationName, oldEmail, newEmail }: Props) => {
+  return (
+    <Html>
+      <Tailwind>
+        <head>
+          <Font
+            fontFamily="Geist"
+            fallbackFontFamily="Helvetica"
+            fontWeight={400}
+            fontStyle="normal"
+          />
+          <Font
+            fontFamily="Geist"
+            fallbackFontFamily="Helvetica"
+            fontWeight={500}
+            fontStyle="normal"
+          />
+        </head>
+        <Preview>Your Comp AI login email was changed</Preview>
+
+        <Body className="mx-auto my-auto bg-[#fff] font-sans">
+          <Container
+            className="mx-auto my-[40px] max-w-[600px] border-transparent p-[20px] md:border-[#E8E7E1]"
+            style={{ borderStyle: 'solid', borderWidth: 1 }}
+          >
+            <Logo />
+            <Heading className="mx-0 my-[30px] p-0 text-center text-[24px] font-normal text-[#121212]">
+              Your login email was changed
+            </Heading>
+
+            <Text className="text-[14px] leading-[24px] text-[#121212]">
+              An administrator of <span className="font-medium">{organizationName}</span>{' '}
+              changed your Comp AI login email from{' '}
+              <span className="font-medium">{oldEmail}</span> to{' '}
+              <span className="font-medium">{newEmail}</span>.
+            </Text>
+            <Text className="text-[14px] leading-[24px] text-[#121212]">
+              From now on, use <span className="font-medium">{newEmail}</span> to
+              sign in.
+            </Text>
+
+            <br />
+            <Section>
+              <Text className="text-[12px] leading-[24px] text-[#666666]">
+                If you did not expect this change, contact your organization
+                administrator or support@trycomp.ai.
+              </Text>
+            </Section>
+
+            <br />
+
+            <Footer />
+          </Container>
+        </Body>
+      </Tailwind>
+    </Html>
+  );
+};
+
+export default LoginEmailChangedEmail;
diff --git a/apps/api/src/people/people.controller.ts b/apps/api/src/people/people.controller.ts
index 176c09dd16..1102062e01 100644
--- a/apps/api/src/people/people.controller.ts
+++ b/apps/api/src/people/people.controller.ts
@@ -470,6 +470,7 @@ export class PeopleController {
   @ApiResponse(UPDATE_MEMBER_RESPONSES[400])
   @ApiResponse(UPDATE_MEMBER_RESPONSES[401])
   @ApiResponse(UPDATE_MEMBER_RESPONSES[404])
+  @ApiResponse(UPDATE_MEMBER_RESPONSES[409])
   @ApiResponse(UPDATE_MEMBER_RESPONSES[500])
   async updateMember(
     @Param('id') memberId: string,
diff --git a/apps/api/src/people/people.service.spec.ts b/apps/api/src/people/people.service.spec.ts
index f1b142426e..496950bb71 100644
--- a/apps/api/src/people/people.service.spec.ts
+++ b/apps/api/src/people/people.service.spec.ts
@@ -3,6 +3,7 @@ import {
   NotFoundException,
   ForbiddenException,
   BadRequestException,
+  ConflictException,
 } from '@nestjs/common';
 import { PeopleService } from './people.service';
 import { FleetService } from '../lib/fleet.service';
@@ -10,8 +11,19 @@ import { TimelinesService } from '../timelines/timelines.service';
 import { MemberValidator } from './utils/member-validator';
 import { MemberQueries } from './utils/member-queries';
 
-// Mock the database
+// Mock the database. Includes a stand-in Prisma.PrismaClientKnownRequestError
+// so the service's `instanceof` error-code branches can be exercised.
 jest.mock('@db', () => ({
+  Prisma: {
+    PrismaClientKnownRequestError: class PrismaClientKnownRequestError extends Error {
+      code: string;
+      constructor(message: string, { code }: { code: string }) {
+        super(message);
+        this.code = code;
+        this.name = 'PrismaClientKnownRequestError';
+      }
+    },
+  },
   db: {
     member: {
       findFirst: jest.fn(),
@@ -86,8 +98,13 @@ jest.mock('@trycompai/email', () => ({
 
 jest.mock('./utils/member-validator');
 jest.mock('./utils/member-queries');
+jest.mock('./utils/login-email-change');
 
-import { db } from '@db';
+import { db, Prisma } from '@db';
+import {
+  notifyLoginEmailChanged,
+  validateLoginEmailChange,
+} from './utils/login-email-change';
 
 describe('PeopleService', () => {
   let service: PeopleService;
@@ -298,6 +315,143 @@ describe('PeopleService', () => {
       );
     });
 
+    describe('login email change', () => {
+      const existingMember = {
+        id: 'mem_1',
+        userId: 'usr_target',
+        role: 'employee',
+      };
+      const updatedMember = {
+        id: 'mem_1',
+        user: { name: 'Alice' },
+        role: 'employee',
+      };
+
+      beforeEach(() => {
+        (MemberValidator.validateOrganization as jest.Mock).mockResolvedValue(
+          undefined,
+        );
+        (MemberValidator.validateMemberExists as jest.Mock).mockResolvedValue(
+          existingMember,
+        );
+        (MemberQueries.updateMember as jest.Mock).mockResolvedValue(
+          updatedMember,
+        );
+      });
+
+      it('applies the normalized email and notifies both addresses', async () => {
+        (validateLoginEmailChange as jest.Mock).mockResolvedValue({
+          oldEmail: 'old@company.dev',
+          newEmail: 'new@company.io',
+        });
+
+        await service.updateById('mem_1', 'org_123', {
+          email: ' New@Company.IO ',
+        });
+
+        expect(validateLoginEmailChange).toHaveBeenCalledWith({
+          userId: 'usr_target',
+          organizationId: 'org_123',
+          requestedEmail: ' New@Company.IO ',
+        });
+        expect(MemberQueries.updateMember).toHaveBeenCalledWith(
+          'mem_1',
+          'org_123',
+          { email: 'new@company.io' },
+        );
+        expect(notifyLoginEmailChanged).toHaveBeenCalledWith(
+          expect.objectContaining({
+            organizationId: 'org_123',
+            change: {
+              oldEmail: 'old@company.dev',
+              newEmail: 'new@company.io',
+            },
+          }),
+        );
+      });
+
+      it('drops a no-op email change and does not notify', async () => {
+        (validateLoginEmailChange as jest.Mock).mockResolvedValue(null);
+
+        await service.updateById('mem_1', 'org_123', {
+          email: 'old@company.dev',
+          department: 'it',
+        });
+
+        expect(MemberQueries.updateMember).toHaveBeenCalledWith(
+          'mem_1',
+          'org_123',
+          { department: 'it' },
+        );
+        expect(notifyLoginEmailChanged).not.toHaveBeenCalled();
+      });
+
+      it('rejects combining a userId reassignment with an email change', async () => {
+        await expect(
+          service.updateById('mem_1', 'org_123', {
+            userId: 'usr_other',
+            email: 'new@company.io',
+          }),
+        ).rejects.toThrow(BadRequestException);
+
+        expect(validateLoginEmailChange).not.toHaveBeenCalled();
+        expect(MemberQueries.updateMember).not.toHaveBeenCalled();
+      });
+
+      it('returns the member without writing when the no-op email is the only field', async () => {
+        (validateLoginEmailChange as jest.Mock).mockResolvedValue(null);
+        (MemberQueries.findByIdInOrganization as jest.Mock).mockResolvedValue(
+          updatedMember,
+        );
+
+        const result = await service.updateById('mem_1', 'org_123', {
+          email: 'old@company.dev',
+        });
+
+        expect(result).toEqual(updatedMember);
+        expect(MemberQueries.updateMember).not.toHaveBeenCalled();
+        // Must include deactivated members — the update path accepts them,
+        // so the no-op return can't silently 404 on a deactivated member.
+        expect(MemberQueries.findByIdInOrganization).toHaveBeenCalledWith(
+          'mem_1',
+          'org_123',
+          { includeDeactivated: true },
+        );
+      });
+
+      it('translates a unique-constraint race on the write into a 409', async () => {
+        (validateLoginEmailChange as jest.Mock).mockResolvedValue({
+          oldEmail: 'old@company.dev',
+          newEmail: 'new@company.io',
+        });
+        (MemberQueries.updateMember as jest.Mock).mockRejectedValue(
+          new Prisma.PrismaClientKnownRequestError('Unique constraint failed', {
+            code: 'P2002',
+            clientVersion: 'test',
+          }),
+        );
+
+        await expect(
+          service.updateById('mem_1', 'org_123', { email: 'new@company.io' }),
+        ).rejects.toThrow(ConflictException);
+      });
+
+      it('propagates ConflictException from validation without wrapping', async () => {
+        (validateLoginEmailChange as jest.Mock).mockRejectedValue(
+          new ConflictException('That email is already used by another account'),
+        );
+
+        await expect(
+          service.updateById('mem_1', 'org_123', {
+            email: 'taken@company.io',
+          }),
+        ).rejects.toThrow(ConflictException);
+
+        expect(MemberQueries.updateMember).not.toHaveBeenCalled();
+        expect(notifyLoginEmailChanged).not.toHaveBeenCalled();
+      });
+    });
+
     it('should validate new userId when changing user', async () => {
       const updateData = { userId: 'usr_new' };
       const existingMember = {
diff --git a/apps/api/src/people/people.service.ts b/apps/api/src/people/people.service.ts
index cacdc24369..74c1d7e36b 100644
--- a/apps/api/src/people/people.service.ts
+++ b/apps/api/src/people/people.service.ts
@@ -3,9 +3,10 @@ import {
   NotFoundException,
   Logger,
   BadRequestException,
+  ConflictException,
   ForbiddenException,
 } from '@nestjs/common';
-import { db } from '@db';
+import { db, Prisma } from '@db';
 import { FleetService } from '../lib/fleet.service';
 import { BUILT_IN_ROLE_PERMISSIONS } from '@trycompai/auth';
 import type { PeopleResponseDto } from './dto/people-responses.dto';
@@ -15,6 +16,11 @@ import type { BulkCreatePeopleDto } from './dto/bulk-create-people.dto';
 import { MemberValidator } from './utils/member-validator';
 import { MemberQueries } from './utils/member-queries';
 import { authorizeRoleChange } from './utils/role-authorization';
+import {
+  notifyLoginEmailChanged,
+  validateLoginEmailChange,
+  type LoginEmailChange,
+} from './utils/login-email-change';
 import {
   collectAssignedItems,
   clearAssignments,
@@ -333,12 +339,60 @@ export class PeopleService {
         );
       }
 
+      // Changing the email here changes the LOGIN email (User.email, global),
+      // so it needs uniqueness + cross-org guards before the raw write.
+      let emailChange: LoginEmailChange | null = null;
+      if (updateData.email !== undefined) {
+        if (updateData.userId && updateData.userId !== existingMember.userId) {
+          // The email write targets the member's CURRENT user, so combining it
+          // with a userId reassignment would rename the wrong account.
+          throw new BadRequestException(
+            'Cannot change userId and email in the same request',
+          );
+        }
+        emailChange = await validateLoginEmailChange({
+          userId: existingMember.userId,
+          organizationId,
+          requestedEmail: updateData.email,
+        });
+        if (emailChange) {
+          updateData.email = emailChange.newEmail;
+        } else {
+          delete updateData.email;
+          if (Object.keys(updateData).length === 0) {
+            // No-op: return the member without writing. Unlike findById, this
+            // must include deactivated members — the update path accepts them.
+            const member = await MemberQueries.findByIdInOrganization(
+              memberId,
+              organizationId,
+              { includeDeactivated: true },
+            );
+            if (!member) {
+              throw new NotFoundException(
+                `Member with ID ${memberId} not found in organization ${organizationId}`,
+              );
+            }
+            return member;
+          }
+        }
+      }
+
       const updatedMember = await MemberQueries.updateMember(
         memberId,
         organizationId,
         updateData,
       );
 
+      if (emailChange) {
+        // Fire-and-forget: notification latency/failure must not block the
+        // update response. notifyLoginEmailChanged handles its own errors.
+        void notifyLoginEmailChanged({
+          organizationId,
+          change: emailChange,
+          logger: this.logger,
+        });
+      }
+
       this.logger.log(
         `Updated member: ${updatedMember.user.name} (${memberId})`,
       );
@@ -347,10 +401,21 @@ export class PeopleService {
       if (
         error instanceof NotFoundException ||
         error instanceof BadRequestException ||
-        error instanceof ForbiddenException
+        error instanceof ForbiddenException ||
+        error instanceof ConflictException
       ) {
         throw error;
       }
+      // A concurrent email change can slip past the preflight uniqueness
+      // check; translate the unique-constraint violation to the same 409.
+      if (
+        error instanceof Prisma.PrismaClientKnownRequestError &&
+        error.code === 'P2002'
+      ) {
+        throw new ConflictException(
+          'That email is already used by another account',
+        );
+      }
       this.logger.error(
         `Failed to update member ${memberId} in organization ${organizationId}:`,
         error,
diff --git a/apps/api/src/people/schemas/update-member.responses.ts b/apps/api/src/people/schemas/update-member.responses.ts
index f3b4009799..61655c127f 100644
--- a/apps/api/src/people/schemas/update-member.responses.ts
+++ b/apps/api/src/people/schemas/update-member.responses.ts
@@ -63,6 +63,24 @@ export const UPDATE_MEMBER_RESPONSES: Record<string, ApiResponseOptions> = {
       },
     },
   },
+  409: {
+    status: 409,
+    description:
+      'Conflict - Login email already used by another account, or the member belongs to other organizations',
+    content: {
+      'application/json': {
+        schema: {
+          type: 'object',
+          properties: {
+            message: {
+              type: 'string',
+              example: 'That email is already used by another account',
+            },
+          },
+        },
+      },
+    },
+  },
   404: {
     status: 404,
     description: 'Organization, member, or user not found',
diff --git a/apps/api/src/people/utils/login-email-change.spec.ts b/apps/api/src/people/utils/login-email-change.spec.ts
new file mode 100644
index 0000000000..4441c157c8
--- /dev/null
+++ b/apps/api/src/people/utils/login-email-change.spec.ts
@@ -0,0 +1,141 @@
+import { ConflictException, Logger } from '@nestjs/common';
+
+jest.mock('@db', () => ({
+  db: {
+    user: {
+      findUniqueOrThrow: jest.fn(),
+      findFirst: jest.fn(),
+    },
+    member: {
+      count: jest.fn(),
+    },
+    organization: {
+      findUniqueOrThrow: jest.fn(),
+    },
+  },
+}));
+
+jest.mock('../../email/trigger-email', () => ({
+  triggerEmail: jest.fn().mockResolvedValue(undefined),
+}));
+
+import { db } from '@db';
+import { triggerEmail } from '../../email/trigger-email';
+import {
+  notifyLoginEmailChanged,
+  validateLoginEmailChange,
+} from './login-email-change';
+
+describe('validateLoginEmailChange', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (db.user.findUniqueOrThrow as jest.Mock).mockResolvedValue({
+      email: 'old@company.dev',
+    });
+    (db.user.findFirst as jest.Mock).mockResolvedValue(null);
+    (db.member.count as jest.Mock).mockResolvedValue(0);
+  });
+
+  it('normalizes the requested email and returns the change', async () => {
+    const change = await validateLoginEmailChange({
+      userId: 'usr_1',
+      organizationId: 'org_1',
+      requestedEmail: '  New@Company.IO ',
+    });
+
+    expect(change).toEqual({
+      oldEmail: 'old@company.dev',
+      newEmail: 'new@company.io',
+    });
+  });
+
+  it('returns null when the requested email is already the login email', async () => {
+    const change = await validateLoginEmailChange({
+      userId: 'usr_1',
+      organizationId: 'org_1',
+      requestedEmail: 'OLD@company.dev',
+    });
+
+    expect(change).toBeNull();
+    expect(db.user.findFirst).not.toHaveBeenCalled();
+  });
+
+  it('throws ConflictException when the email belongs to another account', async () => {
+    (db.user.findFirst as jest.Mock).mockResolvedValue({ id: 'usr_other' });
+
+    await expect(
+      validateLoginEmailChange({
+        userId: 'usr_1',
+        organizationId: 'org_1',
+        requestedEmail: 'taken@company.io',
+      }),
+    ).rejects.toThrow(ConflictException);
+
+    expect(db.user.findFirst).toHaveBeenCalledWith({
+      where: {
+        email: { equals: 'taken@company.io', mode: 'insensitive' },
+        id: { not: 'usr_1' },
+      },
+      select: { id: true },
+    });
+  });
+
+  it('throws ConflictException when the user is active in other organizations', async () => {
+    (db.member.count as jest.Mock).mockResolvedValue(1);
+
+    await expect(
+      validateLoginEmailChange({
+        userId: 'usr_1',
+        organizationId: 'org_1',
+        requestedEmail: 'new@company.io',
+      }),
+    ).rejects.toThrow(ConflictException);
+
+    expect(db.member.count).toHaveBeenCalledWith({
+      where: {
+        userId: 'usr_1',
+        organizationId: { not: 'org_1' },
+        isActive: true,
+        deactivated: false,
+      },
+    });
+  });
+});
+
+describe('notifyLoginEmailChanged', () => {
+  const logger = { error: jest.fn() } as unknown as Logger;
+  const change = { oldEmail: 'old@company.dev', newEmail: 'new@company.io' };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    (db.organization.findUniqueOrThrow as jest.Mock).mockResolvedValue({
+      name: 'Acme',
+    });
+  });
+
+  it('notifies both the old and new address', async () => {
+    await notifyLoginEmailChanged({
+      organizationId: 'org_1',
+      change,
+      logger,
+    });
+
+    expect(triggerEmail).toHaveBeenCalledTimes(2);
+    const recipients = (triggerEmail as jest.Mock).mock.calls.map(
+      ([params]) => params.to,
+    );
+    expect(recipients).toEqual(
+      expect.arrayContaining(['old@company.dev', 'new@company.io']),
+    );
+  });
+
+  it('swallows notification failures instead of failing the update', async () => {
+    (triggerEmail as jest.Mock).mockRejectedValue(new Error('smtp down'));
+
+    await expect(
+      notifyLoginEmailChanged({ organizationId: 'org_1', change, logger }),
+    ).resolves.toBeUndefined();
+
+    expect(logger.error).toHaveBeenCalled();
+  });
+});
diff --git a/apps/api/src/people/utils/login-email-change.ts b/apps/api/src/people/utils/login-email-change.ts
new file mode 100644
index 0000000000..a043ca1618
--- /dev/null
+++ b/apps/api/src/people/utils/login-email-change.ts
@@ -0,0 +1,104 @@
+import { ConflictException, Logger } from '@nestjs/common';
+import { db } from '@db';
+import { triggerEmail } from '../../email/trigger-email';
+import { LoginEmailChangedEmail } from '../../email/templates/login-email-changed';
+
+export interface LoginEmailChange {
+  oldEmail: string;
+  newEmail: string;
+}
+
+/**
+ * Validates an admin-initiated login email change for a member.
+ *
+ * Returns the normalized change to apply, or null when the requested email
+ * is already the member's login email (no-op). Throws ConflictException when
+ * the email belongs to another account, or when the target user also belongs
+ * to other organizations (a login email is global, so one org's admin must
+ * not change it for a user shared with other orgs — that user can change it
+ * themselves from Settings → User).
+ */
+export async function validateLoginEmailChange(params: {
+  userId: string;
+  organizationId: string;
+  requestedEmail: string;
+}): Promise<LoginEmailChange | null> {
+  const { userId, organizationId, requestedEmail } = params;
+  const newEmail = requestedEmail.trim().toLowerCase();
+
+  const user = await db.user.findUniqueOrThrow({
+    where: { id: userId },
+    select: { email: true },
+  });
+
+  if (user.email.toLowerCase() === newEmail) {
+    return null;
+  }
+
+  const emailTaken = await db.user.findFirst({
+    where: {
+      email: { equals: newEmail, mode: 'insensitive' },
+      id: { not: userId },
+    },
+    select: { id: true },
+  });
+  if (emailTaken) {
+    throw new ConflictException(
+      'That email is already used by another account',
+    );
+  }
+
+  const otherOrgMemberships = await db.member.count({
+    where: {
+      userId,
+      organizationId: { not: organizationId },
+      isActive: true,
+      deactivated: false,
+    },
+  });
+  if (otherOrgMemberships > 0) {
+    throw new ConflictException(
+      'This member also belongs to other organizations, so their login email cannot be changed from here. They can change it themselves under Settings → User.',
+    );
+  }
+
+  return { oldEmail: user.email, newEmail };
+}
+
+/**
+ * Notifies both the old and new address that the login email changed.
+ * Fire-and-forget: a notification failure must not fail the update itself.
+ */
+export async function notifyLoginEmailChanged(params: {
+  organizationId: string;
+  change: LoginEmailChange;
+  logger: Logger;
+}): Promise<void> {
+  const { organizationId, change, logger } = params;
+
+  try {
+    const organization = await db.organization.findUniqueOrThrow({
+      where: { id: organizationId },
+      select: { name: true },
+    });
+
+    await Promise.all(
+      [change.oldEmail, change.newEmail].map((to) =>
+        triggerEmail({
+          to,
+          subject: 'Your Comp AI login email was changed',
+          react: LoginEmailChangedEmail({
+            organizationName: organization.name,
+            oldEmail: change.oldEmail,
+            newEmail: change.newEmail,
+          }),
+        }),
+      ),
+    );
+  } catch (error) {
+    logger.error(
+      `Failed to send login email change notifications (${change.oldEmail} -> ${change.newEmail}):`,
+      error,
+    );
+  }
+}
diff --git a/apps/api/src/people/utils/member-queries.ts b/apps/api/src/people/utils/member-queries.ts
index 19f4883599..b62bac4155 100644
--- a/apps/api/src/people/utils/member-queries.ts
+++ b/apps/api/src/people/utils/member-queries.ts
@@ -95,12 +95,13 @@ export class MemberQueries {
   static async findByIdInOrganization(
     memberId: string,
     organizationId: string,
+    options?: { includeDeactivated?: boolean },
   ): Promise<PeopleResponseDto | null> {
     return db.member.findFirst({
       where: {
         id: memberId,
         organizationId,
-        deactivated: false,
+        ...(options?.includeDeactivated ? {} : { deactivated: false }),
       },
       select: this.MEMBER_SELECT,
     });
diff --git a/apps/api/src/questionnaire/utils/content-extractor.spec.ts b/apps/api/src/questionnaire/utils/content-extractor.spec.ts
index ad1fd5a069..058b35daa1 100644
--- a/apps/api/src/questionnaire/utils/content-extractor.spec.ts
+++ b/apps/api/src/questionnaire/utils/content-extractor.spec.ts
@@ -1,4 +1,5 @@
 import { extractContentFromFile } from './content-extractor';
+import AdmZip from 'adm-zip';
 import ExcelJS from 'exceljs';
 import { PDFDocument } from 'pdf-lib';
 import { generateText } from 'ai';
@@ -162,4 +163,43 @@ describe('content-extractor: extractContentFromFile', () => {
       extractContentFromFile(base64, 'application/octet-stream'),
     ).rejects.toThrow('Unsupported file type');
   });
+
+  // Regression test for the 2026-07-16 api.trycomp.ai outage: HECVAT Full
+  // ships a whole-sheet dataValidation (~17 billion cells) that makes
+  // ExcelJS block the event loop for minutes. Without the sanitizing step
+  // in loadWorkbook this test does not fail — it hangs.
+  it('should extract content from an Excel file with a whole-sheet data validation', async () => {
+    const buffer = await createTestExcelBuffer([
+      {
+        name: 'Questions',
+        rows: [
+          ['Question', 'Response'],
+          ['Will your company sign a BAA?', 'Yes'],
+        ],
+      },
+    ]);
+
+    const zip = new AdmZip(buffer);
+    const entryName = 'xl/worksheets/sheet1.xml';
+    const xml = zip.readAsText(entryName);
+    const validation =
+      '<dataValidations count="1">' +
+      '<dataValidation allowBlank="1" showInputMessage="1" ' +
+      'prompt="Changes cannot be made in this sheet." ' +
+      'sqref="F18:F1048576 N1:XFD1048576 A3:A1048576"/>' +
+      '</dataValidations>';
+    zip.updateFile(
+      entryName,
+      Buffer.from(
+        xml.replace('</worksheet>', `${validation}</worksheet>`),
+        'utf8',
+      ),
+    );
+    const base64 = zip.toBuffer().toString('base64');
+
+    const result = await extractContentFromFile(base64, XLSX_MIME);
+
+    expect(result).toContain('Will your company sign a BAA?');
+    expect(result).toContain('Yes');
+  });
 });
diff --git a/apps/api/src/questionnaire/utils/content-extractor.ts b/apps/api/src/questionnaire/utils/content-extractor.ts
index cf5e39a24d..3cdc80444d 100644
--- a/apps/api/src/questionnaire/utils/content-extractor.ts
+++ b/apps/api/src/questionnaire/utils/content-extractor.ts
@@ -5,19 +5,13 @@ import ExcelJS from 'exceljs';
 import AdmZip from 'adm-zip';
 import mammoth from 'mammoth';
 import { PDFDocument } from 'pdf-lib';
+import {
+  assertXlsxDecompressionWithinLimit,
+  loadXlsxWorkbook,
+} from '@/utils/load-xlsx';
 import { PARSING_MODEL, VISION_EXTRACTION_PROMPT } from './constants';
 import { parseQuestionsAndAnswers } from './question-parser';
 
-/**
- * Loads an Excel workbook from a buffer.
- */
-async function loadWorkbook(data: Uint8Array): Promise<ExcelJS.Workbook> {
-  const workbook = new ExcelJS.Workbook();
-  type LoadFn = (data: Uint8Array) => Promise<ExcelJS.Workbook>;
-  await (workbook.xlsx.load as unknown as LoadFn)(data);
-  return workbook;
-}
-
 export interface ContentExtractionLogger {
   info: (message: string, meta?: Record<string, unknown>) => void;
   warn: (message: string, meta?: Record<string, unknown>) => void;
@@ -618,7 +612,7 @@ function extractFromExcelXml(
  * are interpreted by the workbook parser instead of regex over raw XML.
  */
 async function extractFromExcelStandard(fileBuffer: Buffer): Promise<string> {
-  const workbook = await loadWorkbook(fileBuffer);
+  const workbook = await loadXlsxWorkbook(fileBuffer);
   const sheets: string[] = [];
 
   for (const worksheet of workbook.worksheets) {
@@ -672,6 +666,10 @@ async function extractFromExcel(
 
   logger.info('Processing Excel file', { fileType, fileSizeMB });
 
+  // Must run before extractExcelRawContent: its catch falls back to the
+  // AdmZip XML path, which would inflate an oversized archive anyway.
+  assertXlsxDecompressionWithinLimit(fileBuffer);
+
   const result = await extractExcelRawContent(fileBuffer, logger);
 
   const extractionTime = ((Date.now() - excelStartTime) / 1000).toFixed(2);
diff --git a/apps/api/src/trigger/vector-store/helpers/extract-content-from-file.ts b/apps/api/src/trigger/vector-store/helpers/extract-content-from-file.ts
index d9f7916d80..ea4a2932b2 100644
--- a/apps/api/src/trigger/vector-store/helpers/extract-content-from-file.ts
+++ b/apps/api/src/trigger/vector-store/helpers/extract-content-from-file.ts
@@ -1,3 +1,4 @@
+import { loadXlsxWorkbook } from '@/utils/load-xlsx';
 import { logger } from '@/vector-store/logger';
 import { anthropic } from '@ai-sdk/anthropic';
 import { openai } from '@ai-sdk/openai';
@@ -5,18 +6,6 @@ import { generateText } from 'ai';
 import ExcelJS from 'exceljs';
 import mammoth from 'mammoth';
 
-/**
- * Loads an Excel workbook from a Uint8Array/Buffer.
- * ExcelJS type declarations are incompatible with Node 22+ / TS 5.8+ Buffer types,
- * so we use a typed wrapper to avoid the mismatch.
- */
-async function loadWorkbook(data: Uint8Array): Promise<ExcelJS.Workbook> {
-  const workbook = new ExcelJS.Workbook();
-  type LoadFn = (data: Uint8Array) => Promise<ExcelJS.Workbook>;
-  await (workbook.xlsx.load as unknown as LoadFn)(data);
-  return workbook;
-}
-
 const htmlEntityMap = {
   '&nbsp;': ' ',
   '&amp;': '&',
@@ -67,7 +56,7 @@ export async function extractContentFromFile(
         fileSizeMB,
       });
 
-      const workbook = await loadWorkbook(fileBuffer);
+      const workbook = await loadXlsxWorkbook(fileBuffer);
 
       // Process sheets sequentially
       const sheets: string[] = [];
diff --git a/apps/api/src/utils/load-xlsx.spec.ts b/apps/api/src/utils/load-xlsx.spec.ts
new file mode 100644
index 0000000000..44887fd288
--- /dev/null
+++ b/apps/api/src/utils/load-xlsx.spec.ts
@@ -0,0 +1,76 @@
+import AdmZip from 'adm-zip';
+import ExcelJS from 'exceljs';
+import {
+  assertXlsxDecompressionWithinLimit,
+  loadXlsxWorkbook,
+} from './load-xlsx';
+
+const FULL_SHEET_VALIDATION =
+  '<dataValidations count="1">' +
+  '<dataValidation allowBlank="1" showInputMessage="1" ' +
+  'prompt="Changes cannot be made in this sheet." ' +
+  'sqref="F18:F1048576 N1:XFD1048576 A3:A1048576"/>' +
+  '</dataValidations>';
+
+async function buildWorkbook(): Promise<Buffer> {
+  const workbook = new ExcelJS.Workbook();
+  const sheet = workbook.addWorksheet('Questions');
+  sheet.getCell('A1').value = 'Will your company sign a BAA?';
+  sheet.getCell('B1').value = 'Yes';
+  const data = await workbook.xlsx.writeBuffer();
+  return Buffer.from(data as ArrayBuffer);
+}
+
+function injectValidation(xlsx: Buffer, block: string): Buffer {
+  const zip = new AdmZip(xlsx);
+  const entryName = 'xl/worksheets/sheet1.xml';
+  const xml = zip.readAsText(entryName);
+  zip.updateFile(
+    entryName,
+    Buffer.from(xml.replace('</worksheet>', `${block}</worksheet>`), 'utf8'),
+  );
+  return zip.toBuffer();
+}
+
+describe('loadXlsxWorkbook', () => {
+  it('loads a workbook poisoned with a whole-sheet data validation', async () => {
+    const poisoned = injectValidation(
+      await buildWorkbook(),
+      FULL_SHEET_VALIDATION,
+    );
+
+    const workbook = await loadXlsxWorkbook(poisoned);
+    const sheet = workbook.getWorksheet('Questions');
+
+    expect(sheet?.getCell('A1').value).toBe('Will your company sign a BAA?');
+    expect(sheet?.getCell('B1').value).toBe('Yes');
+  });
+
+  it('rejects buffers that are not xlsx archives', async () => {
+    await expect(
+      loadXlsxWorkbook(Buffer.from('not an xlsx file')),
+    ).rejects.toThrow();
+  });
+});
+
+describe('assertXlsxDecompressionWithinLimit', () => {
+  it('accepts a normal workbook under the default limit', async () => {
+    const clean = await buildWorkbook();
+
+    expect(() => assertXlsxDecompressionWithinLimit(clean)).not.toThrow();
+  });
+
+  it('rejects archives whose declared uncompressed size exceeds the limit', async () => {
+    const clean = await buildWorkbook();
+
+    expect(() => assertXlsxDecompressionWithinLimit(clean, 10)).toThrow(
+      /safety limit/,
+    );
+  });
+
+  it('ignores buffers that are not zip archives', () => {
+    expect(() =>
+      assertXlsxDecompressionWithinLimit(Buffer.from('not a zip')),
+    ).not.toThrow();
+  });
+});
diff --git a/apps/api/src/utils/load-xlsx.ts b/apps/api/src/utils/load-xlsx.ts
new file mode 100644
index 0000000000..7280a4365f
--- /dev/null
+++ b/apps/api/src/utils/load-xlsx.ts
@@ -0,0 +1,63 @@
+import AdmZip from 'adm-zip';
+import ExcelJS from 'exceljs';
+import { stripXlsxDataValidations } from './sanitize-xlsx';
+
+// Generous for questionnaires (HECVAT Full inflates to ~6 MB) while still
+// rejecting zip bombs that expand to multiple GB.
+export const MAX_XLSX_UNCOMPRESSED_BYTES = 512 * 1024 * 1024;
+
+/**
+ * Rejects xlsx archives whose declared uncompressed size exceeds the limit,
+ * using only the zip central directory — nothing is inflated. Call this
+ * before any code path that decompresses worksheet XML (ExcelJS or AdmZip),
+ * so a zip bomb is refused before it can exhaust memory.
+ */
+export function assertXlsxDecompressionWithinLimit(
+  data: Uint8Array,
+  limitBytes: number = MAX_XLSX_UNCOMPRESSED_BYTES,
+): void {
+  let entries: AdmZip.IZipEntry[];
+  try {
+    const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    entries = new AdmZip(buffer).getEntries();
+  } catch {
+    // Not a readable archive — let the workbook loader report its own error.
+    return;
+  }
+
+  let totalBytes = 0;
+  for (const entry of entries) {
+    totalBytes += entry.header.size;
+  }
+
+  if (totalBytes > limitBytes) {
+    const totalMB = Math.round(totalBytes / (1024 * 1024));
+    const limitMB = Math.round(limitBytes / (1024 * 1024));
+    throw new Error(
+      `Excel file expands to ${totalMB} MB uncompressed, exceeding the ${limitMB} MB safety limit.`,
+    );
+  }
+}
+
+/**
+ * The only supported way to open an xlsx with ExcelJS in this codebase:
+ * enforces the decompression limit and strips whole-sheet dataValidations
+ * (see stripXlsxDataValidations) before parsing. There is deliberately no
+ * fallback to the original bytes — if the sanitized archive fails to load,
+ * re-parsing the unsanitized one could reintroduce the event-loop hang the
+ * sanitizer exists to prevent (2026-07-16 outage).
+ */
+export async function loadXlsxWorkbook(
+  data: Uint8Array,
+): Promise<ExcelJS.Workbook> {
+  assertXlsxDecompressionWithinLimit(data);
+
+  const workbook = new ExcelJS.Workbook();
+  // ExcelJS type declarations are incompatible with Node 22+ / TS 5.8+
+  // Buffer types, so we use a typed wrapper to avoid the mismatch.
+  type LoadFn = (data: Uint8Array) => Promise<ExcelJS.Workbook>;
+  await (workbook.xlsx.load as unknown as LoadFn)(
+    stripXlsxDataValidations(data),
+  );
+  return workbook;
+}
diff --git a/apps/api/src/utils/sanitize-xlsx.spec.ts b/apps/api/src/utils/sanitize-xlsx.spec.ts
new file mode 100644
index 0000000000..c4257f3ab5
--- /dev/null
+++ b/apps/api/src/utils/sanitize-xlsx.spec.ts
@@ -0,0 +1,97 @@
+import AdmZip from 'adm-zip';
+import ExcelJS from 'exceljs';
+import { stripXlsxDataValidations } from './sanitize-xlsx';
+
+// A whole-sheet validation range like the one the HECVAT Full template ships
+// (~17 billion cells). Loading it un-stripped would block the event loop for
+// minutes, so passing tests must go through the sanitized path.
+const FULL_SHEET_VALIDATION =
+  '<dataValidations count="1">' +
+  '<dataValidation allowBlank="1" showInputMessage="1" showErrorMessage="1" ' +
+  'prompt="Changes cannot be made in this sheet." ' +
+  'sqref="F18:F1048576 N1:XFD1048576 A3:A1048576"/>' +
+  '</dataValidations>';
+
+async function buildWorkbook(): Promise<Buffer> {
+  const workbook = new ExcelJS.Workbook();
+  const sheet = workbook.addWorksheet('Questions');
+  sheet.getCell('A1').value = 'Will your company sign a BAA?';
+  sheet.getCell('B1').value = 'Yes';
+  const data = await workbook.xlsx.writeBuffer();
+  return Buffer.from(data as ArrayBuffer);
+}
+
+function injectValidation(xlsx: Buffer, block: string): Buffer {
+  const zip = new AdmZip(xlsx);
+  const entryName = 'xl/worksheets/sheet1.xml';
+  const xml = zip.readAsText(entryName);
+  zip.updateFile(
+    entryName,
+    Buffer.from(xml.replace('</worksheet>', `${block}</worksheet>`), 'utf8'),
+  );
+  return zip.toBuffer();
+}
+
+function readSheetXml(xlsx: Uint8Array): string {
+  const zip = new AdmZip(Buffer.from(xlsx));
+  return zip.readAsText('xl/worksheets/sheet1.xml');
+}
+
+describe('stripXlsxDataValidations', () => {
+  it('removes dataValidations blocks from worksheet xml', async () => {
+    const poisoned = injectValidation(
+      await buildWorkbook(),
+      FULL_SHEET_VALIDATION,
+    );
+
+    const sanitized = stripXlsxDataValidations(poisoned);
+
+    expect(readSheetXml(poisoned)).toContain('<dataValidations');
+    expect(readSheetXml(sanitized)).not.toContain('<dataValidations');
+  });
+
+  it('removes self-closing dataValidations elements', async () => {
+    const poisoned = injectValidation(
+      await buildWorkbook(),
+      '<dataValidations count="0"/>',
+    );
+
+    const sanitized = stripXlsxDataValidations(poisoned);
+
+    expect(readSheetXml(sanitized)).not.toContain('<dataValidations');
+  });
+
+  it('returns the input unchanged when there is nothing to strip', async () => {
+    const clean = await buildWorkbook();
+
+    expect(stripXlsxDataValidations(clean)).toBe(clean);
+  });
+
+  it('fails closed when the buffer is not a readable archive', () => {
+    // An archive AdmZip cannot read might still parse in ExcelJS's more
+    // lenient unzipper, validations included — so it must be rejected,
+    // never passed through unsanitized.
+    const garbage = Buffer.from('not an xlsx file');
+
+    expect(() => stripXlsxDataValidations(garbage)).toThrow(
+      /Unable to sanitize/,
+    );
+  });
+
+  it('keeps the workbook loadable with all cell text intact', async () => {
+    const poisoned = injectValidation(
+      await buildWorkbook(),
+      FULL_SHEET_VALIDATION,
+    );
+
+    const sanitized = stripXlsxDataValidations(poisoned);
+
+    const workbook = new ExcelJS.Workbook();
+    type LoadFn = (data: Uint8Array) => Promise<ExcelJS.Workbook>;
+    await (workbook.xlsx.load as unknown as LoadFn)(sanitized);
+    const sheet = workbook.getWorksheet('Questions');
+
+    expect(sheet?.getCell('A1').value).toBe('Will your company sign a BAA?');
+    expect(sheet?.getCell('B1').value).toBe('Yes');
+  });
+});
diff --git a/apps/api/src/utils/sanitize-xlsx.ts b/apps/api/src/utils/sanitize-xlsx.ts
new file mode 100644
index 0000000000..c23dca5e85
--- /dev/null
+++ b/apps/api/src/utils/sanitize-xlsx.ts
@@ -0,0 +1,60 @@
+import AdmZip from 'adm-zip';
+
+const WORKSHEET_ENTRY_RE = /^xl\/worksheets\/[^/]+\.xml$/;
+
+// Matches a whole <dataValidations>...</dataValidations> block or a
+// self-closing <dataValidations/>. Validations cannot nest, so the
+// non-greedy body match is safe.
+const DATA_VALIDATIONS_BLOCK_RE =
+  /<dataValidations(?:\s[^>]*)?\/>|<dataValidations(?:\s[^>]*)?>[\s\S]*?<\/dataValidations>/g;
+
+/**
+ * Removes <dataValidations> blocks from every worksheet inside an xlsx
+ * archive before the workbook is handed to ExcelJS.
+ *
+ * ExcelJS registers each validation on every individual cell of its sqref
+ * range, so a template with a whole-sheet range — e.g. HECVAT Full ships
+ * "N1:XFD1048576" ≈ 17 billion cells — blocks the event loop until the
+ * process is killed (incident 2026-07-16, api.trycomp.ai outage).
+ * Validations only hold dropdown rules and prompts, never cell text, so
+ * removing them cannot change extracted content.
+ *
+ * Returns the original bytes untouched only when the archive was read
+ * successfully and contained nothing to strip. Fails closed otherwise:
+ * if the archive cannot be inspected or rewritten, it throws rather than
+ * letting potentially unsanitized bytes reach ExcelJS — an archive that
+ * AdmZip cannot read might still be accepted by ExcelJS's more lenient
+ * unzipper, validations included.
+ */
+export function stripXlsxDataValidations(data: Uint8Array): Uint8Array {
+  try {
+    const buffer = Buffer.isBuffer(data) ? data : Buffer.from(data);
+    const zip = new AdmZip(buffer);
+    let changed = false;
+
+    for (const entry of zip.getEntries()) {
+      if (!WORKSHEET_ENTRY_RE.test(entry.entryName)) {
+        continue;
+      }
+
+      const xml = entry.getData().toString('utf8');
+      if (!xml.includes('<dataValidations')) {
+        continue;
+      }
+
+      const cleaned = xml.replace(DATA_VALIDATIONS_BLOCK_RE, '');
+      if (cleaned !== xml) {
+        zip.updateFile(entry.entryName, Buffer.from(cleaned, 'utf8'));
+        changed = true;
+      }
+    }
+
+    return changed ? zip.toBuffer() : data;
+  } catch (error) {
+    throw new Error(
+      `Unable to sanitize the Excel archive: ${
+        error instanceof Error ? error.message : 'unknown error'
+      }. The file may be corrupt — re-save it in Excel and upload it again.`,
+    );
+  }
+}
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleCombobox.test.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleCombobox.test.tsx
new file mode 100644
index 0000000000..290ca1ac9c
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleCombobox.test.tsx
@@ -0,0 +1,70 @@
+import { render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { beforeAll, describe, expect, it, vi } from 'vitest';
+import { MultiRoleCombobox } from './MultiRoleCombobox';
+
+// jsdom doesn't implement these APIs that Radix Popover / cmdk rely on.
+beforeAll(() => {
+  Element.prototype.scrollIntoView = vi.fn();
+  Element.prototype.hasPointerCapture = vi.fn(() => false);
+  Element.prototype.releasePointerCapture = vi.fn();
+  globalThis.ResizeObserver = class {
+    observe() {}
+    unobserve() {}
+    disconnect() {}
+  } as unknown as typeof ResizeObserver;
+});
+
+const ALLOWED = ['admin', 'auditor', 'employee', 'contractor'];
+
+async function openAndGetRoleItem(name: string) {
+  const user = userEvent.setup();
+  await user.click(screen.getByRole('combobox'));
+  const item = (await screen.findByText(name)).closest('[cmdk-item]');
+  if (!(item instanceof HTMLElement)) {
+    throw new Error(`Role item "${name}" not found`);
+  }
+  return { user, item };
+}
+
+describe('MultiRoleCombobox selection', () => {
+  it('does not cancel pointerdown on a role item (regression: role not selectable)', async () => {
+    // The role items previously had `onPointerDown={(e) => e.preventDefault()}`.
+    // Cancelling pointerdown suppresses the browser's native pointer->click
+    // sequence that drives cmdk's `onSelect`, so clicking a role did nothing.
+    // jsdom fires a synthetic click that bypasses the pointer sequence, so we
+    // assert the underlying DOM contract directly: the item must let the
+    // pointerdown default action proceed.
+    render(
+      <MultiRoleCombobox
+        selectedRoles={[]}
+        onSelectedRolesChange={vi.fn()}
+        allowedRoles={ALLOWED}
+        placeholder="Select a role"
+      />,
+    );
+
+    const { item } = await openAndGetRoleItem('Admin');
+    const pointerDown = new PointerEvent('pointerdown', { bubbles: true, cancelable: true });
+    item.dispatchEvent(pointerDown);
+
+    expect(pointerDown.defaultPrevented).toBe(false);
+  });
+
+  it('adds a role to the selection when clicked', async () => {
+    const handleChange = vi.fn();
+    render(
+      <MultiRoleCombobox
+        selectedRoles={[]}
+        onSelectedRolesChange={handleChange}
+        allowedRoles={ALLOWED}
+        placeholder="Select a role"
+      />,
+    );
+
+    const { user, item } = await openAndGetRoleItem('Admin');
+    await user.click(item);
+
+    expect(handleChange).toHaveBeenCalledWith(['admin']);
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleComboboxContent.tsx b/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleComboboxContent.tsx
index f15177c6c8..09d7b2f049 100644
--- a/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleComboboxContent.tsx
+++ b/apps/app/src/app/(app)/[orgId]/people/all/components/MultiRoleComboboxContent.tsx
@@ -89,8 +89,6 @@ export function MultiRoleComboboxContent({
               <CommandItem
                 key={role.value}
                 value={getRoleDisplayLabel(role.value)} // Use translated label for search/value
-                onPointerDown={(e) => e.preventDefault()}
-                onClick={(e) => e.stopPropagation()}
                 onSelect={() => {
                   handleSelect(role.value);
                   onCloseDialog();
@@ -140,8 +138,6 @@ export function MultiRoleComboboxContent({
                   <CommandItem
                     key={customRole.id}
                     value={customRole.name}
-                    onPointerDown={(e) => e.preventDefault()}
-                    onClick={(e) => e.stopPropagation()}
                     onSelect={() => {
                       handleSelect(roleValue);
                       onCloseDialog();
diff --git a/apps/app/src/app/(app)/[orgId]/settings/user/components/LoginEmailSettings.test.tsx b/apps/app/src/app/(app)/[orgId]/settings/user/components/LoginEmailSettings.test.tsx
new file mode 100644
index 0000000000..79e6a46051
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/settings/user/components/LoginEmailSettings.test.tsx
@@ -0,0 +1,145 @@
+import { fireEvent, render, screen, waitFor } from '@testing-library/react';
+import type { HTMLAttributes, LabelHTMLAttributes, ReactNode } from 'react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mockChangeEmail = vi.fn();
+
+vi.mock('@/utils/auth-client', () => ({
+  authClient: {
+    changeEmail: (...args: unknown[]) => mockChangeEmail(...args),
+  },
+}));
+
+vi.mock('sonner', () => ({
+  toast: { success: vi.fn(), error: vi.fn() },
+}));
+
+vi.mock('@trycompai/design-system', () => ({
+  Button: ({ children, ...props }: HTMLAttributes<HTMLButtonElement> & { disabled?: boolean; type?: 'submit' | 'button' }) => (
+    <button {...props}>{children}</button>
+  ),
+  Input: (props: HTMLAttributes<HTMLInputElement>) => <input {...props} />,
+  Label: ({ children, ...props }: LabelHTMLAttributes<HTMLLabelElement>) => (
+    <label {...props}>{children}</label>
+  ),
+  Section: ({
+    title,
+    description,
+    children,
+  }: {
+    title?: ReactNode;
+    description?: ReactNode;
+    children?: ReactNode;
+  }) => (
+    <section>
+      <h2>{title}</h2>
+      <p>{description}</p>
+      {children}
+    </section>
+  ),
+  Stack: ({ children }: { children?: ReactNode }) => <div>{children}</div>,
+  Text: ({ children }: { children?: ReactNode }) => <p>{children}</p>,
+}));
+
+import { toast } from 'sonner';
+import { LoginEmailSettings } from './LoginEmailSettings';
+
+const CURRENT_EMAIL = 'admin@old-domain.com';
+
+const submitWithEmail = async (email: string) => {
+  fireEvent.change(screen.getByLabelText('New email address'), {
+    target: { value: email },
+  });
+  fireEvent.click(screen.getByRole('button', { name: 'Change email' }));
+};
+
+describe('LoginEmailSettings', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it('shows the current login email', () => {
+    render(<LoginEmailSettings currentEmail={CURRENT_EMAIL} />);
+    expect(
+      screen.getByText(`You currently sign in as ${CURRENT_EMAIL}.`),
+    ).toBeInTheDocument();
+  });
+
+  it('requests the change and shows the pending notice on success', async () => {
+    mockChangeEmail.mockResolvedValue({ data: { status: true }, error: null });
+    render(<LoginEmailSettings currentEmail={CURRENT_EMAIL} />);
+
+    await submitWithEmail('Admin@New-Domain.com');
+
+    await waitFor(() => {
+      expect(mockChangeEmail).toHaveBeenCalledWith({
+        newEmail: 'admin@new-domain.com',
+        callbackURL: `${window.location.origin}/`,
+      });
+    });
+    expect(toast.success).toHaveBeenCalledWith(
+      `Confirmation link sent to ${CURRENT_EMAIL}`,
+    );
+    expect(
+      screen.getByText(/We sent a confirmation link to admin@old-domain.com/),
+    ).toBeInTheDocument();
+  });
+
+  it('rejects the current email as the new address', async () => {
+    render(<LoginEmailSettings currentEmail={CURRENT_EMAIL} />);
+
+    await submitWithEmail(CURRENT_EMAIL.toUpperCase());
+
+    expect(
+      await screen.findByText('This is already your login email'),
+    ).toBeInTheDocument();
+    expect(mockChangeEmail).not.toHaveBeenCalled();
+  });
+
+  it('rejects an invalid email without calling the API', async () => {
+    render(<LoginEmailSettings currentEmail={CURRENT_EMAIL} />);
+
+    await submitWithEmail('not-an-email');
+
+    expect(
+      await screen.findByText('Enter a valid email address'),
+    ).toBeInTheDocument();
+    expect(mockChangeEmail).not.toHaveBeenCalled();
+  });
+
+  it('hides the pending notice once the login email actually changes', async () => {
+    mockChangeEmail.mockResolvedValue({ data: { status: true }, error: null });
+    const { rerender } = render(
+      <LoginEmailSettings currentEmail={CURRENT_EMAIL} />,
+    );
+
+    await submitWithEmail('admin@new-domain.com');
+    expect(
+      await screen.findByText(/We sent a confirmation link/),
+    ).toBeInTheDocument();
+
+    // Verification completed elsewhere; the server re-renders with the new email.
+    rerender(<LoginEmailSettings currentEmail="admin@new-domain.com" />);
+
+    expect(
+      screen.queryByText(/We sent a confirmation link/),
+    ).not.toBeInTheDocument();
+  });
+
+  it('surfaces API errors as a toast', async () => {
+    mockChangeEmail.mockResolvedValue({
+      data: null,
+      error: { message: 'Change email is disabled' },
+    });
+    render(<LoginEmailSettings currentEmail={CURRENT_EMAIL} />);
+
+    await submitWithEmail('someone@new-domain.com');
+
+    await waitFor(() => {
+      expect(toast.error).toHaveBeenCalledWith('Change email is disabled');
+    });
+    expect(
+      screen.queryByText(/We sent a confirmation link/),
+    ).not.toBeInTheDocument();
+  });
+});
diff --git a/apps/app/src/app/(app)/[orgId]/settings/user/components/LoginEmailSettings.tsx b/apps/app/src/app/(app)/[orgId]/settings/user/components/LoginEmailSettings.tsx
new file mode 100644
index 0000000000..d581942aa6
--- /dev/null
+++ b/apps/app/src/app/(app)/[orgId]/settings/user/components/LoginEmailSettings.tsx
@@ -0,0 +1,136 @@
+'use client';
+
+import { authClient } from '@/utils/auth-client';
+import { zodResolver } from '@hookform/resolvers/zod';
+import {
+  Button,
+  Input,
+  Label,
+  Section,
+  Stack,
+  Text,
+} from '@trycompai/design-system';
+import { useState } from 'react';
+import { useForm } from 'react-hook-form';
+import { toast } from 'sonner';
+import { z } from 'zod';
+
+interface Props {
+  currentEmail: string;
+}
+
+const buildChangeEmailSchema = (currentEmail: string) =>
+  z.object({
+    newEmail: z
+      .string()
+      .trim()
+      .toLowerCase()
+      .email('Enter a valid email address')
+      .refine((value) => value !== currentEmail.toLowerCase(), {
+        message: 'This is already your login email',
+      }),
+  });
+
+type ChangeEmailFormValues = z.infer<ReturnType<typeof buildChangeEmailSchema>>;
+
+export function LoginEmailSettings({ currentEmail }: Props) {
+  // Tracks which login email the pending request was made against, so the
+  // notice disappears once the change completes and currentEmail moves on.
+  const [pendingRequest, setPendingRequest] = useState<{
+    from: string;
+    to: string;
+  } | null>(null);
+  const pendingEmail =
+    pendingRequest && pendingRequest.from === currentEmail
+      ? pendingRequest.to
+      : null;
+
+  const {
+    register,
+    handleSubmit,
+    formState: { errors, isSubmitting },
+    reset,
+  } = useForm<ChangeEmailFormValues>({
+    resolver: zodResolver(buildChangeEmailSchema(currentEmail)),
+    defaultValues: { newEmail: '' },
+  });
+
+  const handleChangeEmail = handleSubmit(async ({ newEmail }) => {
+    try {
+      const { error } = await authClient.changeEmail({
+        newEmail,
+        callbackURL: `${window.location.origin}/`,
+      });
+
+      if (error) {
+        setPendingRequest(null);
+        toast.error(error.message ?? 'Failed to request the email change');
+        return;
+      }
+
+      setPendingRequest({ from: currentEmail, to: newEmail });
+      reset();
+      toast.success(`Confirmation link sent to ${currentEmail}`);
+    } catch {
+      setPendingRequest(null);
+      toast.error('Failed to request the email change');
+    }
+  });
+
+  return (
+    <Section
+      title="Login Email"
+      description={`You currently sign in as ${currentEmail}.`}
+    >
+      <form onSubmit={handleChangeEmail} noValidate>
+        <Stack gap="md">
+          <Stack gap="sm">
+            <Label htmlFor="newEmail">New email address</Label>
+            <div className="w-full md:max-w-sm">
+              <Input
+                id="newEmail"
+                type="email"
+                placeholder="you@company.com"
+                aria-invalid={errors.newEmail ? true : undefined}
+                aria-describedby={
+                  errors.newEmail ? 'newEmail-error' : undefined
+                }
+                {...register('newEmail')}
+              />
+            </div>
+            {errors.newEmail ? (
+              <div id="newEmail-error" role="alert">
+                <Text size="sm" variant="destructive">
+                  {errors.newEmail.message}
+                </Text>
+              </div>
+            ) : (
+              <Text size="sm" variant="muted">
+                We'll send a confirmation link to your current email first,
+                then a verification link to the new address to complete the
+                change.
+              </Text>
+            )}
+          </Stack>
+
+          <div>
+            <Button type="submit" loading={isSubmitting}>
+              Change email
+            </Button>
+          </div>
+
+          {pendingEmail && (
+            <div className="bg-muted rounded-md p-3" role="status">
+              <Text size="sm" variant="muted">
+                We sent a confirmation link to {currentEmail}. Once you confirm
+                it, a verification link goes to {pendingEmail} to finish the
+                change. If it doesn't arrive, the new address may already be in
+                use.
+              </Text>
+            </div>
+          )}
+        </Stack>
+      </form>
+    </Section>
+  );
+}
diff --git a/apps/app/src/app/(app)/[orgId]/settings/user/page.tsx b/apps/app/src/app/(app)/[orgId]/settings/user/page.tsx
index dd8cf4431f..1b3fdbe81a 100644
--- a/apps/app/src/app/(app)/[orgId]/settings/user/page.tsx
+++ b/apps/app/src/app/(app)/[orgId]/settings/user/page.tsx
@@ -1,6 +1,7 @@
 import { serverApi } from '@/lib/api-server';
 import type { Metadata } from 'next';
 import { EmailNotificationPreferences } from './components/EmailNotificationPreferences';
+import { LoginEmailSettings } from './components/LoginEmailSettings';
 import { McpOrganizationSelector } from './components/McpOrganizationSelector';
 import type { McpOrganizationData } from './hooks/useMcpOrganization';
 
@@ -41,6 +42,7 @@ export default async function UserSettings({
 
   return (
     <div className="space-y-6">
+      <LoginEmailSettings currentEmail={emailRes.data.email} />
       <EmailNotificationPreferences
         initialPreferences={emailRes.data.preferences}
         email={emailRes.data.email}
diff --git a/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.test.ts b/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.test.ts
index 11263cff3b..434a233d35 100644
--- a/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.test.ts
+++ b/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.test.ts
@@ -3,8 +3,10 @@ import {
   buildContextHubText,
   buildSectionUserPrompt,
   buildVendorsBlock,
+  CUSTOM_ONBOARDING_VENDOR_DESCRIPTION,
   NARRATIVE_SECTIONS,
   sectionPrompts,
+  SELECTED_ONBOARDING_VENDOR_DESCRIPTION,
   SENSITIVE_CONTEXT_QUESTIONS,
   type VendorTabEntry,
 } from './generate-auditor-content-prompts';
@@ -34,6 +36,65 @@ describe('buildVendorsBlock', () => {
   it('does not invent entries for an empty Vendors tab', () => {
     expect(buildVendorsBlock([])).toContain('No vendors');
   });
+
+  it('strips the onboarding fallback placeholder descriptions (CS-747: they were echoed as "(Onboarding-selected vendor)")', () => {
+    const vendors: VendorTabEntry[] = [
+      {
+        name: 'Claude AI',
+        description: SELECTED_ONBOARDING_VENDOR_DESCRIPTION,
+        category: 'other',
+        website: null,
+      },
+      {
+        name: 'Acme Internal',
+        description: CUSTOM_ONBOARDING_VENDOR_DESCRIPTION,
+        category: 'other',
+        website: null,
+      },
+      { name: 'AWS', description: 'Cloud hosting', category: 'cloud', website: null },
+    ];
+
+    const block = buildVendorsBlock(vendors);
+
+    // The meaningless placeholders never reach the prompt — the model would
+    // otherwise reproduce them as the vendor's business function.
+    expect(block).not.toContain(SELECTED_ONBOARDING_VENDOR_DESCRIPTION);
+    expect(block).not.toContain(CUSTOM_ONBOARDING_VENDOR_DESCRIPTION);
+
+    // Every vendor is still listed, and real descriptions still flow through.
+    expect(block).toContain('Claude AI');
+    expect(block).toContain('Acme Internal');
+    expect(block).toContain('Cloud hosting');
+    expect(block.split('\n')).toHaveLength(vendors.length);
+  });
+});
+
+describe('critical-vendors prompt format (CS-747)', () => {
+  const prompt = sectionPrompts['critical-vendors'];
+
+  it('does not wrap the vendor function in parentheses', () => {
+    expect(prompt).toContain('[Vendor Name] - [SaaS/PaaS/IaaS] - [brief function]');
+    expect(prompt).not.toMatch(/\(\[brief function\]\)/);
+
+    // The worked examples are unparenthesised too.
+    expect(prompt).toContain('Vercel - PaaS - Application hosting');
+    expect(prompt).not.toContain('(Application hosting)');
+    expect(prompt).not.toContain('(Cloud infrastructure)');
+    expect(prompt).not.toContain('(Team messaging)');
+  });
+
+  // Once buildVendorsBlock strips the onboarding placeholder, a fallback vendor
+  // reaches the model as a bare name. The prompt must give the model a permitted
+  // source for the function (the well-known named product) so it produces the
+  // actual use case rather than omitting it — the section already relies on
+  // vendor knowledge to classify SaaS/PaaS/IaaS. (cubic P2 / CS-747)
+  it('derives the vendor function from the named product and forbids blank/placeholder functions', () => {
+    expect(prompt).toMatch(/named product/i);
+    expect(prompt).toMatch(/widely known to do/i);
+    expect(prompt).toMatch(/never leave the function blank/i);
+    // No onboarding placeholder may ever be echoed back as a function.
+    expect(prompt).toMatch(/never .*(onboarding|placeholder)/i);
+  });
 });
 
 describe('buildSectionUserPrompt', () => {
diff --git a/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.ts b/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.ts
index c5a85482bb..e7043e6c09 100644
--- a/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.ts
+++ b/apps/app/src/trigger/tasks/auditor/generate-auditor-content-prompts.ts
@@ -132,20 +132,21 @@ ${NARRATIVE_EXCLUSIONS}${TONE_RULES}`,
 
 Include EVERY vendor listed in the VENDORS TAB. Do NOT shorten the list, do NOT omit any vendor, and do NOT add vendors that are not in the VENDORS TAB.
 
-For each vendor, classify it as SaaS, PaaS, or IaaS and add a short description of its function.
+For each vendor, classify it as SaaS, PaaS, or IaaS and describe its function. Identify each vendor from its name and state what that named product or service is widely known to do — the vendor's name is a sufficient basis for a concise, factual function. Never leave the function blank, and never restate onboarding metadata (for example "selected during onboarding") as the function.
 
 FORMAT — one vendor per line:
-[Vendor Name] - [SaaS/PaaS/IaaS] - ([brief function])
+[Vendor Name] - [SaaS/PaaS/IaaS] - [brief function]
 
 EXAMPLE:
-Vercel - PaaS - (Application hosting)
-AWS - IaaS - (Cloud infrastructure)
-Slack - SaaS - (Team messaging)
+Vercel - PaaS - Application hosting
+AWS - IaaS - Cloud infrastructure
+Slack - SaaS - Team messaging
 
 RULES:
 - Do NOT include the section title.
 - One vendor per line, in the exact format above.
 - The VENDORS TAB is the source of truth for which vendors to list — include all of them, invent none.
+- The function must be a real description of what the vendor does — never onboarding placeholder text, "unknown", or a blank.
 ${TONE_RULES}`,
 
   'subservice-organizations': `Identify the subservice organisations for the SOC 2 report, choosing ONLY from the VENDORS TAB provided in the sources.
@@ -190,6 +191,19 @@ ABSOLUTELY FORBIDDEN:
 - If information is not available, simply OMIT that topic and write about what IS available.
 - Always produce substantive content based on what you CAN find.`;
 
+// Placeholder descriptions written by the onboarding vendor fallback loop
+// (onboard-organization-helpers.ts) when a vendor is named during onboarding
+// but no real description was extracted. They carry no business function, so
+// buildVendorsBlock drops them before the critical-vendors prompt — left in,
+// the model echoes them verbatim as the vendor's "function" (CS-747, e.g.
+// "Claude AI - SaaS - (Onboarding-selected vendor)").
+export const SELECTED_ONBOARDING_VENDOR_DESCRIPTION = 'Vendor selected during onboarding';
+export const CUSTOM_ONBOARDING_VENDOR_DESCRIPTION = 'Custom vendor added during onboarding';
+export const ONBOARDING_VENDOR_PLACEHOLDER_DESCRIPTIONS: readonly string[] = [
+  SELECTED_ONBOARDING_VENDOR_DESCRIPTION,
+  CUSTOM_ONBOARDING_VENDOR_DESCRIPTION,
+];
+
 /**
  * Formats the org's Vendors tab into a plain-text block for the prompt. Lists
  * EVERY vendor so the model can reproduce the full list — CS-589: the critical
@@ -203,7 +217,16 @@ export function buildVendorsBlock(vendors: VendorTabEntry[]): string {
 
   return vendors
     .map((vendor) => {
-      const details = [vendor.category, vendor.description]
+      const description = vendor.description?.trim();
+      // Drop the onboarding fallback placeholders (CS-747): they are not a real
+      // function, and the model otherwise echoes them verbatim as the vendor's
+      // function. Stripped, the model describes the vendor from its own
+      // knowledge — the same way it already classifies SaaS/PaaS/IaaS.
+      const meaningfulDescription =
+        description && !ONBOARDING_VENDOR_PLACEHOLDER_DESCRIPTIONS.includes(description)
+          ? description
+          : undefined;
+      const details = [vendor.category, meaningfulDescription]
         .map((part) => part?.trim())
         .filter((part): part is string => Boolean(part));
       const detailText = details.length > 0 ? ` — ${details.join(' — ')}` : '';
diff --git a/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts b/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
index cc6289d01a..33eeec6abb 100644
--- a/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
+++ b/apps/app/src/trigger/tasks/onboarding/onboard-organization-helpers.ts
@@ -26,6 +26,10 @@ import {
   applyMitigationPlanFields,
   mirrorActiveDescriptionIntoMap,
 } from '@/lib/strategy-descriptions';
+import {
+  CUSTOM_ONBOARDING_VENDOR_DESCRIPTION,
+  SELECTED_ONBOARDING_VENDOR_DESCRIPTION,
+} from '@/trigger/tasks/auditor/generate-auditor-content-prompts';
 import { buildCitationsHeading } from './build-citations-heading';
 import { RISK_MITIGATION_PROMPT } from './prompts/risk-mitigation';
 import {
@@ -611,9 +615,9 @@ export async function extractVendorsFromContext(
       vendors.push({
         vendor_name: vendorName,
         vendor_website: customUrl || '',
-        vendor_description: isCustom 
-          ? `Custom vendor added during onboarding`
-          : `Vendor selected during onboarding`,
+        vendor_description: isCustom
+          ? CUSTOM_ONBOARDING_VENDOR_DESCRIPTION
+          : SELECTED_ONBOARDING_VENDOR_DESCRIPTION,
         category: VendorCategory.other,
         inherent_probability: Likelihood.possible,
         inherent_impact: Impact.moderate,
diff --git a/packages/docs/openapi.json b/packages/docs/openapi.json
index c468d61dc4..152a292ba2 100644
--- a/packages/docs/openapi.json
+++ b/packages/docs/openapi.json
@@ -2086,6 +2086,22 @@
               }
             }
           },
+          "409": {
+            "description": "Conflict - Login email already used by another account, or the member belongs to other organizations",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "message": {
+                      "type": "string",
+                      "example": "That email is already used by another account"
+                    }
+                  }
+                }
+              }
+            }
+          },
           "500": {
             "description": "Internal server error",
             "content": {
diff --git a/packages/email/emails/change-email-confirmation.tsx b/packages/email/emails/change-email-confirmation.tsx
new file mode 100644
index 0000000000..68b8b477d5
--- /dev/null
+++ b/packages/email/emails/change-email-confirmation.tsx
@@ -0,0 +1,81 @@
+import {
+  Body,
+  Button,
+  Container,
+  Heading,
+  Html,
+  Link,
+  Preview,
+  Section,
+  Tailwind,
+  Text,
+} from '@react-email/components';
+import { Footer } from '../components/footer';
+import { Logo } from '../components/logo';
+
+interface Props {
+  currentEmail: string;
+  newEmail: string;
+  url: string;
+}
+
+export const ChangeEmailConfirmationEmail = ({ currentEmail, newEmail, url }: Props) => {
+  return (
+    <Html>
+      <Tailwind>
+        <head />
+        <Preview>Confirm your email change for Comp AI</Preview>
+
+        <Body className="mx-auto my-auto bg-[#fff] font-sans">
+          <Container
+            className="mx-auto my-[40px] max-w-[600px] border-transparent p-[20px] md:border-[#E8E7E1]"
+            style={{ borderStyle: 'solid', borderWidth: 1 }}
+          >
+            <Logo />
+            <Heading className="mx-0 my-[30px] p-0 text-center text-[24px] font-normal text-[#121212]">
+              Confirm your email change
+            </Heading>
+
+            <Text className="text-[14px] leading-[24px] text-[#121212]">
+              You requested to change your Comp AI login email from{' '}
+              <span className="font-medium">{currentEmail}</span> to{' '}
+              <span className="font-medium">{newEmail}</span>. Confirm below,
+              then follow the verification link we send to your new address to
+              finish the change.
+            </Text>
+            <Section className="mt-[32px] mb-[42px] text-center">
+              <Button
+                className="text-primary border border-solid border-[#121212] bg-transparent px-6 py-3 text-center text-[14px] font-medium text-[#121212] no-underline"
+                href={url}
+              >
+                Confirm email change
+              </Button>
+            </Section>
+
+            <Text className="text-[14px] leading-[24px] break-all text-[#707070]">
+              or copy and paste this URL into your browser{' '}
+              <Link href={url} className="text-[#707070] underline">
+                {url}
+              </Link>
+            </Text>
+
+            <br />
+            <Section>
+              <Text className="text-[12px] leading-[24px] text-[#666666]">
+                If you did not request this change, you can safely ignore this
+                email — your login email will stay{' '}
+                <span className="text-[#121212]">{currentEmail}</span>.
+              </Text>
+            </Section>
+
+            <br />
+
+            <Footer />
+          </Container>
+        </Body>
+      </Tailwind>
+    </Html>
+  );
+};
+
+export default ChangeEmailConfirmationEmail;
diff --git a/packages/email/emails/render.test.tsx b/packages/email/emails/render.test.tsx
index 5acb76c904..fd0844ebbe 100644
--- a/packages/email/emails/render.test.tsx
+++ b/packages/email/emails/render.test.tsx
@@ -1,6 +1,7 @@
 import { render } from '@react-email/render';
 import { describe, expect, it } from 'vitest';
 import { AllPolicyNotificationEmail } from './all-policy-notification';
+import { ChangeEmailConfirmationEmail } from './change-email-confirmation';
 import { InviteEmail } from './invite';
 import { InvitePortalEmail } from './invite-portal';
 import { MagicLinkEmail } from './magic-link';
@@ -120,6 +121,16 @@ const cases = [
     name: 'verify-email',
     el: <VerifyEmail email="user@example.com" url="https://app.trycomp.ai/verify" />,
   },
+  {
+    name: 'change-email-confirmation',
+    el: (
+      <ChangeEmailConfirmationEmail
+        currentEmail="old@example.com"
+        newEmail="new@example.com"
+        url="https://app.trycomp.ai/verify"
+      />
+    ),
+  },
   {
     name: 'training-completed',
     el: (
diff --git a/packages/email/index.ts b/packages/email/index.ts
index c8086af772..6197aea426 100644
--- a/packages/email/index.ts
+++ b/packages/email/index.ts
@@ -1,5 +1,6 @@
 // Email templates
 export * from './emails/all-policy-notification';
+export * from './emails/change-email-confirmation';
 export * from './emails/invite';
 export * from './emails/invite-portal';
 export * from './emails/magic-link';
