diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql
index f1979ae7..9ac54bfb 100644
--- a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql
+++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/down.sql
@@ -1,3 +1,6 @@
+-- Convert Custom members back to Manager, the representation older server versions
+-- expect (they masquerade Manager as Custom in API responses and cannot load type 4).
+UPDATE users_organizations SET atype = 3 WHERE atype = 4;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;
diff --git a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql
index 11094951..6ffdca13 100644
--- a/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql
+++ b/migrations/mysql/2026-06-30-120000_add_custom_role_permissions/up.sql
@@ -1,3 +1,9 @@
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE;
+-- Previously the server stored members created with the Custom role as Manager (3) and
+-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted
+-- type, convert those members so clients (which no longer know the Manager role) keep
+-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE,
+-- which matches the capabilities these members had.
+UPDATE users_organizations SET atype = 4 WHERE atype = 3;
diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql
index f1979ae7..9ac54bfb 100644
--- a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql
+++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/down.sql
@@ -1,3 +1,6 @@
+-- Convert Custom members back to Manager, the representation older server versions
+-- expect (they masquerade Manager as Custom in API responses and cannot load type 4).
+UPDATE users_organizations SET atype = 3 WHERE atype = 4;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;
diff --git a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql
index 11094951..6ffdca13 100644
--- a/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql
+++ b/migrations/postgresql/2026-06-30-120000_add_custom_role_permissions/up.sql
@@ -1,3 +1,9 @@
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE;
+-- Previously the server stored members created with the Custom role as Manager (3) and
+-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted
+-- type, convert those members so clients (which no longer know the Manager role) keep
+-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE,
+-- which matches the capabilities these members had.
+UPDATE users_organizations SET atype = 4 WHERE atype = 3;
diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql
index f1979ae7..9ac54bfb 100644
--- a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql
+++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/down.sql
@@ -1,3 +1,6 @@
+-- Convert Custom members back to Manager, the representation older server versions
+-- expect (they masquerade Manager as Custom in API responses and cannot load type 4).
+UPDATE users_organizations SET atype = 3 WHERE atype = 4;
 ALTER TABLE users_organizations DROP COLUMN manage_users;
 ALTER TABLE users_organizations DROP COLUMN manage_groups;
 ALTER TABLE users_organizations DROP COLUMN manage_policies;
diff --git a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql
index 11094951..6ffdca13 100644
--- a/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql
+++ b/migrations/sqlite/2026-06-30-120000_add_custom_role_permissions/up.sql
@@ -1,3 +1,9 @@
 ALTER TABLE users_organizations ADD COLUMN manage_users BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_groups BOOLEAN NOT NULL DEFAULT FALSE;
 ALTER TABLE users_organizations ADD COLUMN manage_policies BOOLEAN NOT NULL DEFAULT FALSE;
+-- Previously the server stored members created with the Custom role as Manager (3) and
+-- masqueraded them as Custom (4) in all API responses. Now that Custom is a real, persisted
+-- type, convert those members so clients (which no longer know the Manager role) keep
+-- seeing exactly what they saw before. access_all is preserved; the new flags stay FALSE,
+-- which matches the capabilities these members had.
+UPDATE users_organizations SET atype = 4 WHERE atype = 3;