diff --git a/components/control-plane/internal/gateway/console.go b/components/control-plane/internal/gateway/console.go
index 047c9c07..a883fee1 100644
--- a/components/control-plane/internal/gateway/console.go
+++ b/components/control-plane/internal/gateway/console.go
@@ -533,7 +533,7 @@ func buildConsoleDeployment(namespace, consoleImage, proxyImage, issuer, console
 		envVar("OAUTH2_PROXY_COOKIE_SECURE", "true"),
 		envVar("OAUTH2_PROXY_COOKIE_REFRESH", "2m"),
 		envVar("OAUTH2_PROXY_EMAIL_DOMAINS", "*"),
-		envVar("OAUTH2_PROXY_SCOPE", "openid profile email roles gateway-roles"),
+		envVar("OAUTH2_PROXY_SCOPE", "openid profile email roles"),
 	}
 	proxyVolumeMounts := []interface{}{
 		map[string]interface{}{"name": "tmp-proxy", "mountPath": "/tmp"},
diff --git a/components/control-plane/internal/keycloak/client.go b/components/control-plane/internal/keycloak/client.go
index ccbb9088..2d22f6ed 100644
--- a/components/control-plane/internal/keycloak/client.go
+++ b/components/control-plane/internal/keycloak/client.go
@@ -472,7 +472,7 @@ func (c *Client) updateConsoleClientRepresentation(ctx context.Context, consoleU
 	attrs["pkce.code.challenge.method"] = "S256"
 	rep["attributes"] = attrs
 	rep["defaultClientScopes"] = []string{
-		"openid", "profile", "email", "roles", "gateway-roles", "web-origins", "acr",
+		"profile", "email", "roles", "web-origins", "acr",
 	}
 
 	body, err := json.Marshal(rep)
@@ -744,7 +744,7 @@ func (c *Client) createConsoleClient(ctx context.Context, consoleClientID, gatew
 			"pkce.code.challenge.method": "S256",
 		},
 		"defaultClientScopes": []string{
-			"openid", "profile", "email", "roles", "gateway-roles", "web-origins", "acr",
+			"profile", "email", "roles", "web-origins", "acr",
 		},
 	}