diff --git a/acceptance/bundle/generate/app_not_yet_deployed/output.txt b/acceptance/bundle/generate/app_not_yet_deployed/output.txt
index 5742aab1b58..8ac4f1220c5 100644
--- a/acceptance/bundle/generate/app_not_yet_deployed/output.txt
+++ b/acceptance/bundle/generate/app_not_yet_deployed/output.txt
@@ -10,6 +10,7 @@
     "message": "App compute is stopped.",
     "state": "STOPPED"
   },
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "my-app",
   "service_principal_client_id": "[UUID]",
diff --git a/acceptance/bundle/resources/apps/create_already_exists/output.txt b/acceptance/bundle/resources/apps/create_already_exists/output.txt
index 2e7f067fe1f..9619e49ef8a 100644
--- a/acceptance/bundle/resources/apps/create_already_exists/output.txt
+++ b/acceptance/bundle/resources/apps/create_already_exists/output.txt
@@ -19,6 +19,7 @@
     "state": "ACTIVE"
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-app-already-exists",
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "test-app-already-exists",
   "service_principal_client_id": "[UUID]",
diff --git a/acceptance/cmd/workspace/apps/output.txt b/acceptance/cmd/workspace/apps/output.txt
index 16da8b36097..7b8e7e4a2df 100644
--- a/acceptance/cmd/workspace/apps/output.txt
+++ b/acceptance/cmd/workspace/apps/output.txt
@@ -21,6 +21,7 @@
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name",
   "description": "My app description.",
+  "forward_user_access_token": true,
   "id": "1000",
   "name": "test-name",
   "resources": [
@@ -62,6 +63,7 @@
   },
   "default_source_code_path": "/Workspace/Users/[USERNAME]/test-name",
   "description": "My app description.",
+  "forward_user_access_token": true,
   "id": "1001",
   "name": "test-name",
   "resources": [
diff --git a/bundle/direct/dresources/resources.yml b/bundle/direct/dresources/resources.yml
index 0bc65b0a660..ce0564ddc8a 100644
--- a/bundle/direct/dresources/resources.yml
+++ b/bundle/direct/dresources/resources.yml
@@ -555,6 +555,10 @@ resources:
     backend_defaults:
       # Backend sets it "MEDIUM" when not specified in the config
       - field: compute_size
+      # Backend enables token forwarding and reports true even when the config omits it,
+      # so an omitted field would otherwise plan an update on every deploy. An explicit
+      # value in the config still diffs normally.
+      - field: forward_user_access_token
       # lifecycle.started is derived from remote compute status in RemapState, so the
       # remote side always has a value. When the user omits lifecycle from config,
       # both old and new are nil and backend_defaults correctly skips the remote value.
diff --git a/libs/testserver/apps.go b/libs/testserver/apps.go
index e767584e6ec..6b7b5d4190f 100644
--- a/libs/testserver/apps.go
+++ b/libs/testserver/apps.go
@@ -329,6 +329,10 @@ func (s *FakeWorkspace) AppsUpsert(req Request, name string) Response {
 		app.ComputeSize = "MEDIUM"
 	}
 
+	// The platform enables user access token forwarding regardless of what the
+	// request asked for, so the remote always reports true.
+	app.ForwardUserAccessToken = true
+
 	// Assign a service principal to the app, mimicking the real platform.
 	if app.ServicePrincipalClientId == "" {
 		app.ServicePrincipalClientId = nextUUID()