diff --git a/server/db/pg/schema/schema.ts b/server/db/pg/schema/schema.ts
index 24fa5d795..5f0fbf344 100644
--- a/server/db/pg/schema/schema.ts
+++ b/server/db/pg/schema/schema.ts
@@ -763,7 +763,7 @@ export const roles = pgTable("roles", {
     name: varchar("name").notNull(),
     description: varchar("description"),
     requireDeviceApproval: boolean("requireDeviceApproval").default(false),
-    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("none"), // "none" | "full" | "commands"
+    sshSudoMode: varchar("sshSudoMode", { length: 32 }).default("full"), // "none" | "full" | "commands"
     sshSudoCommands: text("sshSudoCommands").default("[]"),
     sshCreateHomeDir: boolean("sshCreateHomeDir").default(true),
     sshUnixGroups: text("sshUnixGroups").default("[]")
diff --git a/server/db/sqlite/schema/schema.ts b/server/db/sqlite/schema/schema.ts
index e3ec840bd..4d3a7482f 100644
--- a/server/db/sqlite/schema/schema.ts
+++ b/server/db/sqlite/schema/schema.ts
@@ -995,7 +995,7 @@ export const roles = sqliteTable("roles", {
     requireDeviceApproval: integer("requireDeviceApproval", {
         mode: "boolean"
     }).default(false),
-    sshSudoMode: text("sshSudoMode").default("none"), // "none" | "full" | "commands"
+    sshSudoMode: text("sshSudoMode").default("full"), // "none" | "full" | "commands"
     sshSudoCommands: text("sshSudoCommands").default("[]"),
     sshCreateHomeDir: integer("sshCreateHomeDir", { mode: "boolean" }).default(
         true
diff --git a/server/routers/org/createOrg.ts b/server/routers/org/createOrg.ts
index f7ea3018f..a4efc991d 100644
--- a/server/routers/org/createOrg.ts
+++ b/server/routers/org/createOrg.ts
@@ -33,7 +33,6 @@ import { calculateUserClientsForOrgs } from "@server/lib/calculateUserClientsFor
 import { doCidrsOverlap } from "@server/lib/ip";
 import { generateCA } from "@server/lib/sshCA";
 import { encrypt } from "@server/lib/crypto";
-import { generateId } from "@server/auth/sessions/app";
 
 const validOrgIdRegex = /^[a-z0-9_]+(-[a-z0-9_]+)*$/;
 
diff --git a/src/components/RoleForm.tsx b/src/components/RoleForm.tsx
index ad3473f46..fdb21b8b1 100644
--- a/src/components/RoleForm.tsx
+++ b/src/components/RoleForm.tsx
@@ -506,20 +506,16 @@ export function RoleForm({
                                             <OptionSelect<"allow" | "disallow">
                                                 options={allowSshOptions}
                                                 value={
-                                                    sshDisabled
-                                                        ? "disallow"
-                                                        : field.value
-                                                          ? "allow"
-                                                          : "disallow"
+                                                    field.value
+                                                        ? "allow"
+                                                        : "disallow"
                                                 }
                                                 onChange={(v) => {
-                                                    if (sshDisabled) return;
                                                     field.onChange(
                                                         v === "allow"
                                                     );
                                                 }}
                                                 cols={2}
-                                                disabled={sshDisabled}
                                             />
                                             <FormDescription>
                                                 {t("roleAllowSshDescription")}