diff --git a/app/Domains/Auth/Controllers/ScannerLoginController.php b/app/Domains/Auth/Controllers/ScannerLoginController.php
index 3a6b446..95cec5c 100644
--- a/app/Domains/Auth/Controllers/ScannerLoginController.php
+++ b/app/Domains/Auth/Controllers/ScannerLoginController.php
@@ -5,6 +5,7 @@ namespace App\Domains\Auth\Controllers;
 use App\Domains\Auth\Requests\ScannerLoginRequest;
 use App\Domains\Auth\Resources\UserResource;
 use App\Domains\Auth\Services\PasswordLoginService;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Http\Controllers\Controller;
 use Illuminate\Http\JsonResponse;
 
@@ -22,6 +23,7 @@ class ScannerLoginController extends Controller
             $credentials['password'],
             $request->ip(),
             $request->userAgent(),
+            RoleCode::from($credentials['rol_codigo'] ?? RoleCode::Scanner->value),
         );
 
         $expirationMinutes = (int) config('sanctum.expiration');
diff --git a/app/Domains/Auth/Requests/ScannerLoginRequest.php b/app/Domains/Auth/Requests/ScannerLoginRequest.php
index c699282..3e4c80b 100644
--- a/app/Domains/Auth/Requests/ScannerLoginRequest.php
+++ b/app/Domains/Auth/Requests/ScannerLoginRequest.php
@@ -2,4 +2,16 @@
 
 namespace App\Domains\Auth\Requests;
 
-class ScannerLoginRequest extends AdminAppLoginRequest {}
+use App\Domains\Authorization\Enums\RoleCode;
+use Illuminate\Validation\Rule;
+
+class ScannerLoginRequest extends AdminAppLoginRequest
+{
+    public function rules(): array
+    {
+        return [
+            ...parent::rules(),
+            'rol_codigo' => ['sometimes', Rule::in([RoleCode::Scanner->value, RoleCode::AdminApp->value])],
+        ];
+    }
+}
diff --git a/app/Domains/Auth/Services/AdminCredentialVerifier.php b/app/Domains/Auth/Services/AdminCredentialVerifier.php
index 0d5a2f8..95619f1 100644
--- a/app/Domains/Auth/Services/AdminCredentialVerifier.php
+++ b/app/Domains/Auth/Services/AdminCredentialVerifier.php
@@ -11,7 +11,7 @@ class AdminCredentialVerifier
     public function verify(string $email, string $password): bool
     {
         $admin = User::query()
-            ->where('email', mb_strtolower(trim($email)))
+            ->where('active_email', mb_strtolower(trim($email)))
             ->where('rol_codigo', RoleCode::Admin->value)
             ->first();
 
diff --git a/app/Domains/Auth/Services/GoogleAuthService.php b/app/Domains/Auth/Services/GoogleAuthService.php
index 6f9bb3f..7b58c36 100644
--- a/app/Domains/Auth/Services/GoogleAuthService.php
+++ b/app/Domains/Auth/Services/GoogleAuthService.php
@@ -3,6 +3,7 @@
 namespace App\Domains\Auth\Services;
 
 use App\Domains\Auth\Models\User;
+use App\Domains\Authorization\Enums\RoleCode;
 use App\Domains\Notification\Events\UserRegistered;
 use App\Domains\Tenant\Models\Tenant;
 use App\Domains\Tenant\Support\TenantDomainNormalizer;
@@ -124,12 +125,12 @@ class GoogleAuthService
             ]);
         }
 
-        $user = User::query()->where('google_id', $googleId)->first();
+        $user = User::query()->where('rol_codigo', RoleCode::User->value)->where('google_id', $googleId)->first();
         if ($user) {
             return $user;
         }
 
-        $user = User::query()->where('email', $email)->first();
+        $user = User::query()->where('rol_codigo', RoleCode::User->value)->where('active_email', mb_strtolower(trim($email)))->first();
         if ($user) {
             $user->forceFill(['google_id' => $googleId])->save();
 
diff --git a/app/Domains/Auth/Services/PasswordLoginService.php b/app/Domains/Auth/Services/PasswordLoginService.php
index 4f79943..fdb2b86 100644
--- a/app/Domains/Auth/Services/PasswordLoginService.php
+++ b/app/Domains/Auth/Services/PasswordLoginService.php
@@ -78,6 +78,7 @@ class PasswordLoginService
         string $password,
         ?string $ipAddress,
         ?string $userAgent,
+        RoleCode $role = RoleCode::Scanner,
     ): User {
         return $this->authenticateUser(
             $email,
@@ -85,10 +86,12 @@ class PasswordLoginService
             null,
             $ipAddress,
             $userAgent,
-            null,
+            $role,
             true,
             PermissionCode::ScanTickets->value,
-            PasswordResetRequested::CHANNEL_SCANNER,
+            $role === RoleCode::AdminApp
+                ? PasswordResetRequested::CHANNEL_ADMINAPP
+                : PasswordResetRequested::CHANNEL_SCANNER,
         );
     }
 
@@ -120,7 +123,7 @@ class PasswordLoginService
             $passwordResetChannel,
         ): array {
             $user = User::query()
-                ->where('email', $normalizedEmail)
+                ->where('active_email', $normalizedEmail)
                 ->when(
                     $requiredRole !== null,
                     fn ($query) => $query->where('rol_codigo', $requiredRole->value),
diff --git a/app/Domains/Desfile/Services/InvitationPurchaseProvisioner.php b/app/Domains/Desfile/Services/InvitationPurchaseProvisioner.php
index c30015c..ad16d37 100644
--- a/app/Domains/Desfile/Services/InvitationPurchaseProvisioner.php
+++ b/app/Domains/Desfile/Services/InvitationPurchaseProvisioner.php
@@ -105,7 +105,8 @@ class InvitationPurchaseProvisioner
     private function userId(DateTimeInterface $now): int
     {
         $user = DB::table('users')
-            ->where('email', self::USER_EMAIL)
+            ->where('active_email', self::USER_EMAIL)
+            ->where('rol_codigo', 'user')
             ->whereNull('deleted_at')
             ->first();
 
diff --git a/tests/Feature/Auth/ScannerLoginControllerTest.php b/tests/Feature/Auth/ScannerLoginControllerTest.php
index d6032ee..ab29952 100644
--- a/tests/Feature/Auth/ScannerLoginControllerTest.php
+++ b/tests/Feature/Auth/ScannerLoginControllerTest.php
@@ -46,6 +46,7 @@ class ScannerLoginControllerTest extends TestCase
         $response = $this->postJson('/api/v1/scanner/login', [
             'email' => ' SCANNER@EXAMPLE.COM ',
             'password' => 'secret123',
+            'rol_codigo' => RoleCode::AdminApp->value,
         ]);
 
         $response