diff --git a/heicode/controller/heicode_agnet_session.go b/heicode/controller/heicode_agnet_session.go
index e34a6a6..81e02e7 100644
--- a/heicode/controller/heicode_agnet_session.go
+++ b/heicode/controller/heicode_agnet_session.go
@@ -281,10 +281,18 @@ func syncLocalUserFromAgnet(me agnetMeEnvelope) (*model.User, error) {
 		user.DisplayName = name
 		changed = true
 	}
-	if ch := strings.TrimSpace(me.Data.ChannelID); ch != "" && user.Group != ch {
-		user.Group = ch
-		changed = true
-	}
+	// Don't overwrite the existing user's group with the Agnet channelId on
+	// every login: NewAPI's `users.group` is the **local model-access bucket**
+	// (must match a row in the `abilities` / `channels` group column to expose
+	// any models). The Agnet channelId is a cross-platform identity that
+	// rarely matches a NewAPI-side group, so overwriting strands the user
+	// with zero models. mcp-server side already tracks channelId separately
+	// (see markBillingProviderNewapi), so we don't need it duplicated here.
+	//
+	// Only seed the group on the JIT-create path above (when the user record
+	// is new and has no admin-set group yet). After that, NewAPI admins own
+	// the group via the dashboard.
+	_ = me.Data.ChannelID
 	// Promote role from Agnet / email whitelist on every login (never demote).
 	desiredRole := roleFromAgnetWithEmail(me.Data.Role, email)
 	if desiredRole > user.Role {