diff --git a/packages/twenty-server/src/engine/core-modules/api-key/api-key.module.ts b/packages/twenty-server/src/engine/core-modules/api-key/api-key.module.ts
index e4e245ebec8..73f55feb8c7 100644
--- a/packages/twenty-server/src/engine/core-modules/api-key/api-key.module.ts
+++ b/packages/twenty-server/src/engine/core-modules/api-key/api-key.module.ts
@@ -44,6 +44,8 @@ import { ApiKeyController } from './controllers/api-key.controller';
     WorkspaceApiKeyMapCacheService,
     GenerateApiKeyCommand,
     provideWorkspaceScopedRepository(ApiKeyEntity),
+    provideWorkspaceScopedRepository(RoleEntity),
+    provideWorkspaceScopedRepository(RoleTargetEntity),
   ],
   controllers: [ApiKeyController],
   exports: [
diff --git a/packages/twenty-server/src/engine/core-modules/api-key/commands/generate-api-key.command.ts b/packages/twenty-server/src/engine/core-modules/api-key/commands/generate-api-key.command.ts
index 29d08c88620..f52e2784886 100644
--- a/packages/twenty-server/src/engine/core-modules/api-key/commands/generate-api-key.command.ts
+++ b/packages/twenty-server/src/engine/core-modules/api-key/commands/generate-api-key.command.ts
@@ -13,6 +13,8 @@ import { ApiKeyService } from 'src/engine/core-modules/api-key/services/api-key.
 import { TwentyConfigService } from 'src/engine/core-modules/twenty-config/twenty-config.service';
 import { WorkspaceEntity } from 'src/engine/core-modules/workspace/workspace.entity';
 import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
+import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
 import { STANDARD_ROLE } from 'src/engine/workspace-manager/twenty-standard-application/constants/standard-role.constant';
 
 type GenerateApiKeyCommandOptions = {
@@ -33,8 +35,8 @@ export class GenerateApiKeyCommand extends CommandRunner {
   constructor(
     @InjectRepository(WorkspaceEntity)
     private readonly workspaceRepository: Repository<WorkspaceEntity>,
-    @InjectRepository(RoleEntity)
-    private readonly roleRepository: Repository<RoleEntity>,
+    @InjectWorkspaceScopedRepository(RoleEntity)
+    private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
     private readonly apiKeyService: ApiKeyService,
     private readonly twentyConfigService: TwentyConfigService,
   ) {
@@ -104,9 +106,8 @@ export class GenerateApiKeyCommand extends CommandRunner {
       return;
     }
 
-    const adminRole = await this.roleRepository.findOne({
+    const adminRole = await this.roleRepository.findOne(workspace.id, {
       where: {
-        workspaceId: workspace.id,
         universalIdentifier: STANDARD_ROLE.admin.universalIdentifier,
       },
     });
diff --git a/packages/twenty-server/src/engine/core-modules/api-key/services/api-key-role.service.ts b/packages/twenty-server/src/engine/core-modules/api-key/services/api-key-role.service.ts
index 52f9506b691..314a7bddae2 100644
--- a/packages/twenty-server/src/engine/core-modules/api-key/services/api-key-role.service.ts
+++ b/packages/twenty-server/src/engine/core-modules/api-key/services/api-key-role.service.ts
@@ -1,8 +1,7 @@
 import { Injectable } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
 
 import { isDefined } from 'twenty-shared/utils';
-import { In, IsNull, Not, Repository } from 'typeorm';
+import { In, IsNull, Not } from 'typeorm';
 
 import { ApiKeyEntity } from 'src/engine/core-modules/api-key/api-key.entity';
 import {
@@ -23,10 +22,10 @@ import { WorkspaceCacheService } from 'src/engine/workspace-cache/services/works
 @Injectable()
 export class ApiKeyRoleService {
   constructor(
-    @InjectRepository(RoleTargetEntity)
-    private readonly roleTargetRepository: Repository<RoleTargetEntity>,
-    @InjectRepository(RoleEntity)
-    private readonly roleRepository: Repository<RoleEntity>,
+    @InjectWorkspaceScopedRepository(RoleTargetEntity)
+    private readonly roleTargetRepository: WorkspaceScopedRepository<RoleTargetEntity>,
+    @InjectWorkspaceScopedRepository(RoleEntity)
+    private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
 
     @InjectWorkspaceScopedRepository(ApiKeyEntity)
     private readonly apiKeyRepository: WorkspaceScopedRepository<ApiKeyEntity>,
@@ -141,8 +140,8 @@ export class ApiKeyRoleService {
       );
     }
 
-    const role = await this.roleRepository.findOne({
-      where: { id: roleId, workspaceId },
+    const role = await this.roleRepository.findOne(workspaceId, {
+      where: { id: roleId },
     });
 
     if (!role) {
@@ -159,13 +158,15 @@ export class ApiKeyRoleService {
       );
     }
 
-    const existingRoleTarget = await this.roleTargetRepository.findOne({
-      where: {
-        apiKeyId,
-        roleId,
-        workspaceId,
+    const existingRoleTarget = await this.roleTargetRepository.findOne(
+      workspaceId,
+      {
+        where: {
+          apiKeyId,
+          roleId,
+        },
       },
-    });
+    );
 
     return {
       roleToAssignIsSameAsCurrentRole: Boolean(existingRoleTarget),
@@ -183,10 +184,9 @@ export class ApiKeyRoleService {
       return new Map();
     }
 
-    const roleTargets = await this.roleTargetRepository.find({
+    const roleTargets = await this.roleTargetRepository.find(workspaceId, {
       where: {
         apiKeyId: In(apiKeyIds),
-        workspaceId,
       },
       relations: ['role'],
     });
@@ -209,10 +209,9 @@ export class ApiKeyRoleService {
     roleId: string,
     workspaceId: string,
   ): Promise<ApiKeyEntity[]> {
-    const roleTargets = await this.roleTargetRepository.find({
+    const roleTargets = await this.roleTargetRepository.find(workspaceId, {
       where: {
         roleId,
-        workspaceId,
         apiKeyId: Not(IsNull()),
       },
     });
diff --git a/packages/twenty-server/src/engine/metadata-modules/flat-role-permission-flag/services/workspace-flat-role-permission-flag-map-cache.service.ts b/packages/twenty-server/src/engine/metadata-modules/flat-role-permission-flag/services/workspace-flat-role-permission-flag-map-cache.service.ts
index e41bf9da016..adb4a390758 100644
--- a/packages/twenty-server/src/engine/metadata-modules/flat-role-permission-flag/services/workspace-flat-role-permission-flag-map-cache.service.ts
+++ b/packages/twenty-server/src/engine/metadata-modules/flat-role-permission-flag/services/workspace-flat-role-permission-flag-map-cache.service.ts
@@ -25,8 +25,8 @@ export class WorkspaceFlatRolePermissionFlagMapCacheService extends WorkspaceCac
     private readonly rolePermissionFlagRepository: Repository<RolePermissionFlagEntity>,
     @InjectRepository(ApplicationEntity)
     private readonly applicationRepository: Repository<ApplicationEntity>,
-    @InjectRepository(RoleEntity)
-    private readonly roleRepository: Repository<RoleEntity>,
+    @InjectWorkspaceScopedRepository(RoleEntity)
+    private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
     @InjectWorkspaceScopedRepository(PermissionFlagEntity)
     private readonly permissionFlagRepository: WorkspaceScopedRepository<PermissionFlagEntity>,
   ) {
@@ -47,8 +47,7 @@ export class WorkspaceFlatRolePermissionFlagMapCacheService extends WorkspaceCac
           select: ['id', 'universalIdentifier'],
           withDeleted: true,
         }),
-        this.roleRepository.find({
-          where: { workspaceId },
+        this.roleRepository.find(workspaceId, {
           select: ['id', 'universalIdentifier'],
           withDeleted: true,
         }),
diff --git a/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.module.ts b/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.module.ts
index 975b00d6cdc..4241f20c1b2 100644
--- a/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.module.ts
+++ b/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.module.ts
@@ -32,6 +32,8 @@ import { WorkspaceCacheModule } from 'src/engine/workspace-cache/workspace-cache
     ApiKeyRoleService,
     PermissionsService,
     provideWorkspaceScopedRepository(ApiKeyEntity),
+    provideWorkspaceScopedRepository(RoleEntity),
+    provideWorkspaceScopedRepository(RoleTargetEntity),
   ],
   exports: [PermissionsService, ApiKeyRoleService],
 })
diff --git a/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts b/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts
index 05b1154eec4..14b8cb9c0e6 100644
--- a/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts
+++ b/packages/twenty-server/src/engine/metadata-modules/permissions/permissions.service.ts
@@ -25,6 +25,8 @@ import { type UserWorkspacePermissions } from 'src/engine/metadata-modules/permi
 import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
 import { UserRoleService } from 'src/engine/metadata-modules/user-role/user-role.service';
 import { type RolePermissionConfig } from 'src/engine/twenty-orm/types/role-permission-config';
+import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
+import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
 import { WorkspaceCacheService } from 'src/engine/workspace-cache/services/workspace-cache.service';
 
 @Injectable()
@@ -33,8 +35,8 @@ export class PermissionsService {
     private readonly userRoleService: UserRoleService,
     private readonly workspaceCacheService: WorkspaceCacheService,
     private readonly apiKeyRoleService: ApiKeyRoleService,
-    @InjectRepository(RoleEntity)
-    private readonly roleRepository: Repository<RoleEntity>,
+    @InjectWorkspaceScopedRepository(RoleEntity)
+    private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
     @InjectRepository(ApplicationEntity)
     private readonly applicationRepository: Repository<ApplicationEntity>,
   ) {}
@@ -149,8 +151,8 @@ export class PermissionsService {
         workspaceId,
       );
 
-      const role = await this.roleRepository.findOne({
-        where: { id: roleId, workspaceId },
+      const role = await this.roleRepository.findOne(workspaceId, {
+        where: { id: roleId },
         relations: [
           'rolePermissionFlags',
           'rolePermissionFlags.permissionFlag',
@@ -205,8 +207,8 @@ export class PermissionsService {
 
       const applicationRoleId = application.defaultRoleId;
 
-      const role = await this.roleRepository.findOne({
-        where: { id: applicationRoleId, workspaceId },
+      const role = await this.roleRepository.findOne(workspaceId, {
+        where: { id: applicationRoleId },
         relations: [
           'rolePermissionFlags',
           'rolePermissionFlags.permissionFlag',
@@ -289,8 +291,8 @@ export class PermissionsService {
       throw new Error('No role IDs provided');
     }
 
-    const roles = await this.roleRepository.find({
-      where: { id: In(roleIds), workspaceId },
+    const roles = await this.roleRepository.find(workspaceId, {
+      where: { id: In(roleIds) },
       relations,
     });
 
diff --git a/packages/twenty-server/src/engine/metadata-modules/role-validation/role-validation.module.ts b/packages/twenty-server/src/engine/metadata-modules/role-validation/role-validation.module.ts
index 53bf67aef83..2b83e2054c9 100644
--- a/packages/twenty-server/src/engine/metadata-modules/role-validation/role-validation.module.ts
+++ b/packages/twenty-server/src/engine/metadata-modules/role-validation/role-validation.module.ts
@@ -3,10 +3,14 @@ import { TypeOrmModule } from '@nestjs/typeorm';
 
 import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
 import { RoleValidationService } from 'src/engine/metadata-modules/role-validation/services/role-validation.service';
+import { provideWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/provide-workspace-scoped-repository';
 
 @Module({
   imports: [TypeOrmModule.forFeature([RoleEntity])],
-  providers: [RoleValidationService],
+  providers: [
+    RoleValidationService,
+    provideWorkspaceScopedRepository(RoleEntity),
+  ],
   exports: [RoleValidationService],
 })
 export class RoleValidationModule {}
diff --git a/packages/twenty-server/src/engine/metadata-modules/role-validation/services/role-validation.service.ts b/packages/twenty-server/src/engine/metadata-modules/role-validation/services/role-validation.service.ts
index a9d11b7031b..e32cf4bfd60 100644
--- a/packages/twenty-server/src/engine/metadata-modules/role-validation/services/role-validation.service.ts
+++ b/packages/twenty-server/src/engine/metadata-modules/role-validation/services/role-validation.service.ts
@@ -1,7 +1,4 @@
 import { Injectable } from '@nestjs/common';
-import { InjectRepository } from '@nestjs/typeorm';
-
-import { Repository } from 'typeorm';
 
 import {
   PermissionsException,
@@ -9,22 +6,23 @@ import {
   PermissionsExceptionMessage,
 } from 'src/engine/metadata-modules/permissions/permissions.exception';
 import { RoleEntity } from 'src/engine/metadata-modules/role/role.entity';
+import { InjectWorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/inject-workspace-scoped-repository.decorator';
+import { WorkspaceScopedRepository } from 'src/engine/twenty-orm/workspace-scoped-repository/workspace-scoped-repository';
 
 @Injectable()
 export class RoleValidationService {
   constructor(
-    @InjectRepository(RoleEntity)
-    private readonly roleRepository: Repository<RoleEntity>,
+    @InjectWorkspaceScopedRepository(RoleEntity)
+    private readonly roleRepository: WorkspaceScopedRepository<RoleEntity>,
   ) {}
 
   async validateRoleAssignableToUsersOrThrow(
     roleId: string,
     workspaceId: string,
   ): Promise<void> {
-    const role = await this.roleRepository.findOne({
+    const role = await this.roleRepository.findOne(workspaceId, {
       where: {
         id: roleId,
-        workspaceId,
       },
     });