diff --git a/hive-c0re/src/forge.rs b/hive-c0re/src/forge.rs
index a4987bf8..0e63c2ca 100644
--- a/hive-c0re/src/forge.rs
+++ b/hive-c0re/src/forge.rs
@@ -257,6 +257,17 @@ async fn ensure_user_email(name: &str) {
         Ok(status) if status.is_success() => {
             tracing::debug!(%name, %email, "forge: user email aligned");
         }
+        Ok(status) if status == reqwest::StatusCode::FORBIDDEN => {
+            // Almost certainly an existing-deployment migration case:
+            // pre-#646 the core token was minted without admin scope, so
+            // /admin/users/* now returns 403 even though `core` is a
+            // site admin. Tell the operator how to fix it inline (#646).
+            tracing::warn!(
+                %name, %email, %status,
+                "forge: PATCH user email forbidden — core token likely missing admin scope. \
+                 Delete {CORE_TOKEN_PATH} and restart hive-c0re to re-mint with the new scopes (#646)."
+            );
+        }
         Ok(status) => {
             tracing::warn!(%name, %email, %status, "forge: PATCH user email returned non-success");
         }