diff --git a/internal/db/migrations/0003_reset_manual_username.sql b/internal/db/migrations/0003_reset_manual_username.sql
new file mode 100644
index 0000000..29b3028
--- /dev/null
+++ b/internal/db/migrations/0003_reset_manual_username.sql
@@ -0,0 +1,7 @@
+-- Reset manual_username for all users so the profile sync worker can
+-- re-evaluate every active user. Earlier admin Add calls always pinned the
+-- username at creation, which permanently excluded those rows from
+-- ListForSync. Going forward, only explicit username changes (admin Update
+-- via SetUsername) pin the row; sync will be a no-op when the kind:0
+-- profile already matches the stored handle.
+UPDATE users SET manual_username = 0 WHERE manual_username = 1;
diff --git a/internal/http/handlers/admin_users.go b/internal/http/handlers/admin_users.go
index 983dcc5..696f02d 100644
--- a/internal/http/handlers/admin_users.go
+++ b/internal/http/handlers/admin_users.go
@@ -66,7 +66,7 @@ func (h *AdminUsers) Add(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
-	u, err := h.Users.CreateOrActivate(r.Context(), hexpk, body.Username, sub, years, true)
+	u, err := h.Users.CreateOrActivate(r.Context(), hexpk, body.Username, sub, years, false)
 	if err != nil {
 		if errors.Is(err, user.ErrInvalidUsername) {
 			WriteError(w, http.StatusBadRequest, "ValidationError", "invalid username")