diff --git a/pkg/coredata/membership.go b/pkg/coredata/membership.go
index 93571e025..4eb2700cf 100644
--- a/pkg/coredata/membership.go
+++ b/pkg/coredata/membership.go
@@ -52,7 +52,13 @@ func (m Membership) CursorKey(orderBy MembershipOrderField) page.CursorKey {
 	panic(fmt.Sprintf("unsupported order by: %s", orderBy))
 }
 
-func (m *Membership) LoadByIdentityInOrganization(ctx context.Context, conn pg.Conn, identityID gid.GID, organizationID gid.GID) error {
+func (m *Membership) LoadByIdentityIDAndOrganizationID(
+	ctx context.Context,
+	conn pg.Conn,
+	scope Scoper,
+	identityID gid.GID,
+	organizationID gid.GID,
+) error {
 	q := `
 SELECT
     id,
@@ -66,14 +72,19 @@ FROM
 WHERE
     identity_id = @identity_id
     AND organization_id = @organization_id
+    AND %s
 `
 
+	q = fmt.Sprintf(q, scope.SQLFragment())
+
 	args := pgx.StrictNamedArgs{
 		"identity_id":     identityID,
 		"organization_id": organizationID,
 	}
+	maps.Copy(args, scope.SQLArguments())
 
-	rows, err := conn.Query(ctx, q, args)
+	rows,
+		err := conn.Query(ctx, q, args)
 	if err != nil {
 		return fmt.Errorf("cannot query membership: %w", err)
 	}
diff --git a/pkg/iam/account_service.go b/pkg/iam/account_service.go
index 01ea96915..6688c6f1c 100644
--- a/pkg/iam/account_service.go
+++ b/pkg/iam/account_service.go
@@ -268,7 +268,7 @@ func (s *AccountService) AcceptInvitation(
 			}
 
 			existingMembership := &coredata.Membership{}
-			if err := existingMembership.LoadByIdentityAndOrg(
+			if err := existingMembership.LoadByIdentityIDAndOrganizationID(
 				ctx,
 				tx,
 				scope,
@@ -775,7 +775,13 @@ func (s AccountService) GetMembershipForOrganization(
 				return fmt.Errorf("cannot load identity %q: %w", identityID, err)
 			}
 
-			if err := membership.LoadByIdentityInOrganization(ctx, tx, identityID, organizationID); err != nil {
+			if err := membership.LoadByIdentityIDAndOrganizationID(
+				ctx,
+				tx,
+				coredata.NewScopeFromObjectID(organizationID),
+				identityID,
+				organizationID,
+			); err != nil {
 				return fmt.Errorf("cannot load membership: %w", err)
 			}
 
diff --git a/pkg/iam/organization_service.go b/pkg/iam/organization_service.go
index 77a536575..6a23f8543 100644
--- a/pkg/iam/organization_service.go
+++ b/pkg/iam/organization_service.go
@@ -281,7 +281,7 @@ func (s *OrganizationService) RemoveMember(
 			}
 
 			membership := &coredata.Membership{}
-			if err := membership.LoadByIdentityAndOrg(ctx, tx, scope, profile.IdentityID, profile.OrganizationID); err != nil {
+			if err := membership.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, profile.IdentityID, profile.OrganizationID); err != nil {
 				return fmt.Errorf("cannot load membership: %w", err)
 			}
 
diff --git a/pkg/iam/saml/service.go b/pkg/iam/saml/service.go
index 3cb555c19..3100c99ea 100644
--- a/pkg/iam/saml/service.go
+++ b/pkg/iam/saml/service.go
@@ -328,7 +328,7 @@ func (s *Service) HandleAssertion(
 				}
 			}
 
-			if err := membership.LoadByIdentityAndOrg(
+			if err := membership.LoadByIdentityIDAndOrganizationID(
 				ctx,
 				tx,
 				scope,
diff --git a/pkg/iam/scim/service.go b/pkg/iam/scim/service.go
index 7c4ab08ed..0deaf1f92 100644
--- a/pkg/iam/scim/service.go
+++ b/pkg/iam/scim/service.go
@@ -213,7 +213,7 @@ func (s *Service) CreateUser(
 
 		// Check if membership exists
 		membership = &coredata.Membership{}
-		if err := membership.LoadByIdentityAndOrg(
+		if err := membership.LoadByIdentityIDAndOrganizationID(
 			ctx,
 			tx,
 			scope,
@@ -294,7 +294,7 @@ func (s *Service) GetUser(
 			}
 
 			membership = &coredata.Membership{}
-			if err := membership.LoadByIdentityAndOrg(
+			if err := membership.LoadByIdentityIDAndOrganizationID(
 				ctx,
 				conn,
 				scope,
@@ -437,7 +437,7 @@ func (s *Service) updateUser(
 			}
 
 			membership = &coredata.Membership{}
-			if err := membership.LoadByIdentityAndOrg(ctx, tx, scope, profile.IdentityID, profile.OrganizationID); err != nil {
+			if err := membership.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, profile.IdentityID, profile.OrganizationID); err != nil {
 				return fmt.Errorf("cannot load membership: %w", err)
 			}
 
diff --git a/pkg/iam/session_service.go b/pkg/iam/session_service.go
index 1fe2761f1..eb60a81b8 100644
--- a/pkg/iam/session_service.go
+++ b/pkg/iam/session_service.go
@@ -366,7 +366,7 @@ func (s SessionService) OpenPasswordChildSessionForOrganization(
 				return NewUserInactiveError(profile.ID)
 			}
 
-			err = membership.LoadByIdentityInOrganization(ctx, tx, rootSession.IdentityID, organizationID)
+			err = membership.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, rootSession.IdentityID, organizationID)
 			if err != nil {
 				if err == coredata.ErrResourceNotFound {
 					return NewMembershipNotFoundError(organizationID)
@@ -468,7 +468,7 @@ func (s SessionService) OpenSAMLChildSessionForOrganization(
 				return NewUserInactiveError(profile.ID)
 			}
 
-			err = membership.LoadByIdentityInOrganization(ctx, tx, rootSession.IdentityID, organizationID)
+			err = membership.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, rootSession.IdentityID, organizationID)
 			if err != nil {
 				if err == coredata.ErrResourceNotFound {
 					return NewMembershipNotFoundError(organizationID)
@@ -554,7 +554,7 @@ func (s SessionService) AssumeOrganizationSession(
 				return NewUserInactiveError(profile.ID)
 			}
 
-			if err := membership.LoadByIdentityInOrganization(ctx, tx, rootSession.IdentityID, organizationID); err != nil {
+			if err := membership.LoadByIdentityIDAndOrganizationID(ctx, tx, scope, rootSession.IdentityID, organizationID); err != nil {
 				if err == coredata.ErrResourceNotFound {
 					return NewMembershipNotFoundError(organizationID)
 				}