diff --git a/api/agent_server.go b/api/agent_server.go
index 1339ae3..7a2ac6a 100644
--- a/api/agent_server.go
+++ b/api/agent_server.go
@@ -82,14 +82,6 @@ func (h *handler) listAgentUsers(c *gin.Context) {
 			continue
 		}
 
-		// Default behavior: only sync eligible (active, verified, non-expired) users.
-		if !u.EmailVerified {
-			continue
-		}
-		if u.ProxyUUIDExpiresAt != nil && now.After(*u.ProxyUUIDExpiresAt) {
-			continue
-		}
-
 		id := strings.TrimSpace(u.ProxyUUID)
 		if id == "" {
 			id = strings.TrimSpace(u.ID)
diff --git a/api/api_test.go b/api/api_test.go
index 2760df4..3724e6d 100644
--- a/api/api_test.go
+++ b/api/api_test.go
@@ -140,11 +140,11 @@ func TestAgentServerUsers_DefaultSyncIncludesSandboxAndRegularUsers(t *testing.T
 		t.Fatalf("create sandbox user: %v", err)
 	}
 
-	// normal user
+	// normal user (not verified + expired) should still be synced by default.
 	if err := st.CreateUser(ctx, &store.User{
 		Name:          "User",
 		Email:         "user@example.com",
-		EmailVerified: true,
+		EmailVerified: false,
 		Role:          store.RoleUser,
 		Level:         store.LevelUser,
 		Active:        true,
@@ -152,12 +152,12 @@ func TestAgentServerUsers_DefaultSyncIncludesSandboxAndRegularUsers(t *testing.T
 		t.Fatalf("create normal user: %v", err)
 	}
 
-	// Ensure normal user has a non-expired proxy UUID.
+	// Ensure normal user is "expired" per proxy UUID expiry metadata.
 	normal, err := st.GetUserByEmail(ctx, "user@example.com")
 	if err != nil {
 		t.Fatalf("get normal user: %v", err)
 	}
-	exp := time.Now().UTC().Add(24 * time.Hour)
+	exp := time.Now().UTC().Add(-24 * time.Hour)
 	normal.ProxyUUIDExpiresAt = &exp
 	if err := st.UpdateUser(ctx, normal); err != nil {
 		t.Fatalf("update normal user: %v", err)