diff --git a/app/views/api/v1/models/_user.json.jbuilder b/app/views/api/v1/models/_user.json.jbuilder
index 058ec62ab..90c95914c 100644
--- a/app/views/api/v1/models/_user.json.jbuilder
+++ b/app/views/api/v1/models/_user.json.jbuilder
@@ -17,7 +17,10 @@ json.id resource.id
 json.inviter_id resource.active_account_user&.inviter_id
 json.name resource.name
 json.provider resource.provider
-json.pubsub_token resource.pubsub_token
+# Withhold the pubsub token from read-only token holders — it authenticates
+# RoomChannel without any API-token scope check, letting a caller write presence
+# and stream live account events (a write the read-only scope must not grant).
+json.pubsub_token resource.pubsub_token unless @access_token&.scope == 'read_only'
 json.custom_attributes resource.custom_attributes if resource.custom_attributes.present?
 json.role resource.active_account_user&.role
 json.ui_settings resource.ui_settings