diff --git a/packages/client/src/views/SysAdmin/Team/user/UserList.tsx b/packages/client/src/views/SysAdmin/Team/user/UserList.tsx
index 201a16ea7e..49b58eb2e6 100644
--- a/packages/client/src/views/SysAdmin/Team/user/UserList.tsx
+++ b/packages/client/src/views/SysAdmin/Team/user/UserList.tsx
@@ -507,9 +507,7 @@ function UserListComponent(props: IProps) {
 
           return {
             image: (
-              <AvatarSmall
-                name={name}
-                avatar={avatar || undefined}
+              <Link
                 onClick={() =>
                   navigate(
                     formatUrl(routes.USER_PROFILE, {
@@ -517,7 +515,10 @@ function UserListComponent(props: IProps) {
                     })
                   )
                 }
-              />
+                disabled={!canReadUser(user)}
+              >
+                <AvatarSmall name={name} avatar={avatar || undefined} />
+              </Link>
             ),
             label: (
               <Link
diff --git a/packages/gateway/src/features/user/root-resolvers.ts b/packages/gateway/src/features/user/root-resolvers.ts
index 87e60cdd4b..3aa98259f8 100644
--- a/packages/gateway/src/features/user/root-resolvers.ts
+++ b/packages/gateway/src/features/user/root-resolvers.ts
@@ -52,7 +52,9 @@ export const resolvers: GQLResolver = {
           !inScope(authHeader, [
             SCOPES.USER_READ,
             SCOPES.USER_READ_MY_OFFICE,
-            SCOPES.USER_READ_MY_JURISDICTION
+            SCOPES.USER_READ_MY_JURISDICTION,
+            SCOPES.USER_UPDATE,
+            SCOPES.USER_UPDATE_MY_JURISDICTION
           ]) &&
           !isTokenOwner(authHeader, userId!)
         ) {