diff --git a/packages/shared/src/config/schema.test.ts b/packages/shared/src/config/schema.test.ts
index 7a058e143..077442d1b 100644
--- a/packages/shared/src/config/schema.test.ts
+++ b/packages/shared/src/config/schema.test.ts
@@ -19,6 +19,7 @@ test("agent-auth stays explicitly enableable", () => {
     },
   });
 
-  expect(defaults.apps.installed["agent-auth"].enabled).toBe(true);
+  expect(defaults.apps.installed["agent-auth"]).toBeDefined();
+  expect(defaults.apps.installed["agent-auth"]?.enabled).toBe(true);
   expect(ALL_APPS["agent-auth"].independentlyEnableable).toBe(true);
 });
diff --git a/packages/shared/src/config/schema.ts b/packages/shared/src/config/schema.ts
index c5e0eaa67..7e42a5439 100644
--- a/packages/shared/src/config/schema.ts
+++ b/packages/shared/src/config/schema.ts
@@ -752,7 +752,7 @@ const organizationConfigDefaults = {
   },
 
   apps: {
-    installed: typedFromEntries(installedAppIdsByDefault.map((appId) => [appId, { enabled: false }])),
+    installed: typedFromEntries(installedAppIdsByDefault.map((appId) => [appId, { enabled: false }])) as Record<string, { enabled: boolean } | undefined>,
   },
 
   teams: {