diff --git a/pkg/coredata/migrations/20251006T220024Z.sql b/pkg/coredata/migrations/20251006T220024Z.sql
index 5722f31f2..575611518 100644
--- a/pkg/coredata/migrations/20251006T220024Z.sql
+++ b/pkg/coredata/migrations/20251006T220024Z.sql
@@ -34,7 +34,7 @@ CREATE TABLE authz_invitations (
 INSERT INTO authz_memberships (tenant_id, id, user_id, organization_id, role, created_at, updated_at)
 SELECT
     organizations.tenant_id,
-    generate_gid(decode_base64_unpadded(organizations.tenant_id), 38) as id,
+    generate_gid(decode_base64_unpadded(organizations.tenant_id), 39) as id,
     users_organizations.user_id,
     users_organizations.organization_id,
     'MEMBER'::authz_role as role,  -- Default role for existing memberships
diff --git a/pkg/coredata/migrations/20260119T182800.sql b/pkg/coredata/migrations/20260119T182800.sql
new file mode 100644
index 000000000..bcbfb595a
--- /dev/null
+++ b/pkg/coredata/migrations/20260119T182800.sql
@@ -0,0 +1,9 @@
+UPDATE
+    iam_memberships m
+SET
+    id = generate_gid(decode_base64_unpadded(o.tenant_id), 39)
+FROM
+    organizations o
+WHERE
+    o.id = m.organization_id
+    AND extract_entity_type(parse_gid(m.id)) = 38;
diff --git a/pkg/iam/iam_policies.go b/pkg/iam/iam_policies.go
index 6fb3b080a..c3297a4ef 100644
--- a/pkg/iam/iam_policies.go
+++ b/pkg/iam/iam_policies.go
@@ -135,7 +135,10 @@ var IAMOwnerPolicy = policy.NewPolicy(
 		ActionMembershipDelete,
 	).
 		WithSID("membership-deletion-owner-access").
-		When(policy.NotEquals("resource.source", "SCIM")),
+		When(
+			policy.Equals("principal.organization_id", "resource.organization_id"),
+			policy.NotEquals("resource.source", "SCIM"),
+		),
 
 	// Can set other members OWNER
 	policy.Allow(ActionMembershipRoleSetOwner).