diff --git a/pages/api/users/[userId]/_patch.ts b/pages/api/users/[userId]/_patch.ts
index 1d823f067f..59d8b76f94 100644
--- a/pages/api/users/[userId]/_patch.ts
+++ b/pages/api/users/[userId]/_patch.ts
@@ -94,6 +94,11 @@ export async function patchHandler(req: NextApiRequest) {
   if (!isAdmin && query.userId !== req.userId) throw new HttpError({ statusCode: 403, message: "Forbidden" });
 
   const body = await schemaUserEditBodyParams.parseAsync(req.body);
+  // disable role changes unless admin.
+  if (!isAdmin && body.role) {
+    body.role = undefined;
+  }
+
   const userSchedules = await prisma.schedule.findMany({
     where: { userId: query.userId },
   });