diff --git a/nodejs/routes/user.js b/nodejs/routes/user.js
index 452e1f8..bfa3586 100755
--- a/nodejs/routes/user.js
+++ b/nodejs/routes/user.js
@@ -95,7 +95,7 @@ router.get('/me', async function(req, res, next){
 		// legacy app_sso_admin/app_super_admin during migration.
 		user.isAdmin = groups.some((g) =>
 			g === 'app_sso_admin' || g === 'app_super_admin' ||
-			g === permission.SUPER_ADMIN_GROUP ||
+			g === 'god_admin' || g === permission.SUPER_ADMIN_GROUP ||
 			g.endsWith('_super_admin') || g.endsWith('_app_sso_admin'));
 
 		return res.json(user);
diff --git a/nodejs/utils/permission.js b/nodejs/utils/permission.js
index a5280c5..68e7d19 100644
--- a/nodejs/utils/permission.js
+++ b/nodejs/utils/permission.js
@@ -3,12 +3,18 @@
 const {Group} = require('../models/group_ldap');
 const groups = require('./groups');
 
-// The global god-admin group (everything, everywhere). During migration the
-// legacy `app_super_admin` is recognized as an alias (docs/GROUPS.md §10).
-const SUPER_ADMIN_GROUP = groups.GOD_ADMIN;
+// The group nested into every resource's _admin group by api_directory_admin
+// (cross-resource super-admin administration). KEEP the legacy `app_super_admin`
+// here: it is the group that actually exists and gets nested. The new schema's
+// global `god_admin` is recognized in isSuperAdmin() below, and api_directory_admin
+// nests SUPER_ADMIN_GROUP -- so until `god_admin` is created during bootstrap, this
+// must stay `app_super_admin` or resource auto-provisioning's nesting silently
+// no-ops (leaving only the creator as the group's sole member).
+const SUPER_ADMIN_GROUP = 'app_super_admin';
 const LEGACY_SUPER_ADMIN_ALIASES = ['app_super_admin'];
 
 // True if the user (by resolved member cns) is a global god/super admin.
+// Recognizes BOTH the new schema's `god_admin` and the legacy `app_super_admin`.
 async function isSuperAdmin(memberOfCns) {
 	return memberOfCns.includes(groups.GOD_ADMIN) ||
 		memberOfCns.some((cn) => LEGACY_SUPER_ADMIN_ALIASES.includes(cn));