diff --git a/src/lib/auth-config.ts b/src/lib/auth-config.ts
index d34d77c..f5838eb 100644
--- a/src/lib/auth-config.ts
+++ b/src/lib/auth-config.ts
@@ -17,7 +17,14 @@ export function createBaseAuthConfig() {
       },
     },
     plugins: [
-      organization(),
+      // Block user-initiated org creation: each org is its own Autumn customer
+      // with its own onboarding-plan credit grant, so an authenticated user
+      // hitting POST /api/auth/organization/create could mint unlimited fresh
+      // grants. The app gives every user exactly one workspace, created
+      // server-side at signup via `auth.api.createOrganization({ body: { userId }})`
+      // — that's a "system action" (no session + userId in body) which better-auth
+      // exempts from this flag, so the bootstrap keeps working.
+      organization({ allowUserToCreateOrganization: false }),
       genericOAuth({
         config: [
           {