diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx
index c7cd6f626af..3e5d8f4e1d4 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/admin/admin.tsx
@@ -1,7 +1,20 @@
 'use client'
 
-import { useEffect, useMemo, useRef, useState } from 'react'
-import { Badge, Button, Chip, ChipInput, ChipSelect, cn, Label, Search, Switch } from '@sim/emcn'
+import { useEffect, useRef, useState } from 'react'
+import {
+  Badge,
+  Button,
+  Chip,
+  ChipConfirmModal,
+  ChipInput,
+  ChipModalError,
+  ChipModalField,
+  ChipSelect,
+  Label,
+  Search,
+  Switch,
+  toast,
+} from '@sim/emcn'
 import { getErrorMessage } from '@sim/utils/errors'
 import { useQueryStates } from 'nuqs'
 import type { MothershipEnvironment } from '@/lib/api/contracts'
@@ -12,6 +25,7 @@ import {
   adminUrlKeys,
 } from '@/app/workspace/[workspaceId]/settings/components/admin/search-params'
 import { useRecentImpersonations } from '@/app/workspace/[workspaceId]/settings/components/admin/use-recent-impersonations'
+import { RowActionsMenu } from '@/app/workspace/[workspaceId]/settings/components/row-actions-menu'
 import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import { SettingsPanel } from '@/app/workspace/[workspaceId]/settings/components/settings-panel'
 import { SettingsSection } from '@/app/workspace/[workspaceId]/settings/components/settings-section/settings-section'
@@ -37,10 +51,19 @@ const USER_TABLE_HEADER = (
     <span className='flex-1'>Email</span>
     <span className='w-[60px]'>Role</span>
     <span className='w-[55px]'>Status</span>
-    <span className='w-[300px] text-right'>Actions</span>
+    <span className='w-[150px] text-right'>Actions</span>
   </div>
 )
 
+/**
+ * The row action awaiting confirmation. Holds ids, never the user row, so a
+ * refetch while the modal is open refreshes the name it shows without
+ * redirecting the action the admin committed to.
+ */
+type PendingUserAction =
+  | { type: 'ban'; userId: string }
+  | { type: 'role'; userId: string; nextRole: 'admin' | 'user' }
+
 const MOTHERSHIP_ENV_OPTIONS: { value: MothershipEnvironment; label: string }[] = [
   { value: 'default', label: 'Default' },
   { value: 'dev', label: 'Dev' },
@@ -72,7 +95,7 @@ export function Admin() {
   )
 
   const [searchInput, setSearchInput] = useState(searchQuery)
-  const [banUserId, setBanUserId] = useState<string | null>(null)
+  const [pendingAction, setPendingAction] = useState<PendingUserAction | null>(null)
   const [banReason, setBanReason] = useState('')
   const [impersonatingUserId, setImpersonatingUserId] = useState<string | null>(null)
   const [impersonationGuardError, setImpersonationGuardError] = useState<string | null>(null)
@@ -155,163 +178,121 @@ export function Admin() {
     )
   }
 
-  const pendingUserIds = useMemo(() => {
-    const ids = new Set<string>()
-    if (setUserRole.isPending && (setUserRole.variables as { userId?: string })?.userId)
-      ids.add((setUserRole.variables as { userId: string }).userId)
-    if (banUser.isPending && (banUser.variables as { userId?: string })?.userId)
-      ids.add((banUser.variables as { userId: string }).userId)
-    if (unbanUser.isPending && (unbanUser.variables as { userId?: string })?.userId)
-      ids.add((unbanUser.variables as { userId: string }).userId)
-    if (impersonateUser.isPending && (impersonateUser.variables as { userId?: string })?.userId)
-      ids.add((impersonateUser.variables as { userId: string }).userId)
-    if (sendPasswordReset.isPending && sendPasswordReset.variables?.userId)
-      ids.add(sendPasswordReset.variables.userId)
-    if (impersonatingUserId) ids.add(impersonatingUserId)
-    return ids
-  }, [
-    setUserRole.isPending,
-    setUserRole.variables,
-    banUser.isPending,
-    banUser.variables,
-    unbanUser.isPending,
-    unbanUser.variables,
-    impersonateUser.isPending,
-    impersonateUser.variables,
-    sendPasswordReset.isPending,
-    sendPasswordReset.variables,
-    impersonatingUserId,
-  ])
-
-  /** Confirms the send in place, since nothing about the user row changes. */
-  const resetPasswordLabel = (userId: string) => {
-    if (sendPasswordReset.variables?.userId !== userId) return 'Reset password'
-    if (sendPasswordReset.isPending) return 'Sending...'
-    if (sendPasswordReset.isSuccess) return 'Reset sent'
-    return 'Reset password'
+  const pendingUser = pendingAction
+    ? (usersData?.users.find((u) => u.id === pendingAction.userId) ??
+      recentUsers?.find((u) => u.id === pendingAction.userId) ??
+      null)
+    : null
+  const isDemotion = pendingAction?.type === 'role' && pendingAction.nextRole === 'user'
+
+  const closePendingAction = () => {
+    setPendingAction(null)
+    setBanReason('')
+  }
+
+  const handleConfirmBan = () => {
+    if (pendingAction?.type !== 'ban') return
+    const trimmedReason = banReason.trim()
+    banUser.mutate(
+      {
+        userId: pendingAction.userId,
+        ...(trimmedReason ? { banReason: trimmedReason } : {}),
+      },
+      { onSuccess: closePendingAction }
+    )
+  }
+
+  const handleConfirmRoleChange = () => {
+    if (pendingAction?.type !== 'role') return
+    setUserRole.mutate(
+      { userId: pendingAction.userId, role: pendingAction.nextRole },
+      { onSuccess: closePendingAction }
+    )
+  }
+
+  const pendingUserIds = new Set<string>()
+  for (const mutation of [setUserRole, banUser, unbanUser, impersonateUser, sendPasswordReset]) {
+    if (mutation.isPending && mutation.variables?.userId)
+      pendingUserIds.add(mutation.variables.userId)
   }
+  if (impersonatingUserId) pendingUserIds.add(impersonatingUserId)
 
   const renderUserRow = (u: AdminUser) => (
-    <div key={u.id} className='flex flex-col gap-2 px-3 py-2 text-small'>
-      <div className='flex items-center gap-3'>
-        <span className='w-[170px] truncate text-[var(--text-primary)]'>{u.name || '—'}</span>
-        <span className='flex-1 truncate text-[var(--text-secondary)]'>{u.email}</span>
-        <span className='w-[60px]'>
-          <Badge variant={u.role === 'admin' ? 'blue' : 'gray'}>{u.role || 'user'}</Badge>
-        </span>
-        <span className='w-[55px]'>
-          {u.banned ? <Badge variant='red'>Banned</Badge> : <Badge variant='green'>Active</Badge>}
-        </span>
-        <span className='flex w-[300px] justify-end gap-1'>
-          {u.id !== session?.user?.id && (
-            <>
-              <Button
-                variant='active'
-                className='h-[28px] px-2 text-caption'
-                onClick={() => {
-                  setProvisionWarning(null)
-                  sendPasswordReset.reset()
-                  sendPasswordReset.mutate({ userId: u.id, email: u.email })
-                }}
-                disabled={pendingUserIds.has(u.id)}
-              >
-                {resetPasswordLabel(u.id)}
-              </Button>
-              <Button
-                variant='active'
-                className='h-[28px] px-2 text-caption'
-                onClick={() => handleImpersonate(u.id, u.email)}
-                disabled={pendingUserIds.has(u.id)}
-              >
-                {impersonatingUserId === u.id ||
-                (impersonateUser.isPending &&
-                  (impersonateUser.variables as { userId?: string } | undefined)?.userId === u.id)
-                  ? 'Switching...'
-                  : 'Impersonate'}
-              </Button>
-              <Button
-                variant='active'
-                className='h-[28px] px-2 text-caption'
-                onClick={() => {
-                  setUserRole.reset()
-                  setUserRole.mutate({
-                    userId: u.id,
-                    role: u.role === 'admin' ? 'user' : 'admin',
-                  })
-                }}
-                disabled={pendingUserIds.has(u.id)}
-              >
-                {u.role === 'admin' ? 'Demote' : 'Promote'}
-              </Button>
-              {u.banned ? (
-                <Button
-                  variant='active'
-                  className='h-[28px] px-2 text-caption'
-                  onClick={() => {
-                    unbanUser.reset()
-                    unbanUser.mutate({ userId: u.id })
-                  }}
-                  disabled={pendingUserIds.has(u.id)}
-                >
-                  Unban
-                </Button>
-              ) : (
-                <Button
-                  variant='active'
-                  className={cn(
-                    'h-[28px] px-2 text-caption',
-                    banUserId === u.id ? 'text-[var(--text-primary)]' : 'text-[var(--text-error)]'
-                  )}
-                  onClick={() => {
-                    if (banUserId === u.id) {
-                      setBanUserId(null)
-                      setBanReason('')
-                    } else {
-                      setBanUserId(u.id)
-                      setBanReason('')
-                    }
-                  }}
-                  disabled={pendingUserIds.has(u.id)}
-                >
-                  {banUserId === u.id ? 'Cancel' : 'Ban'}
-                </Button>
-              )}
-            </>
-          )}
-        </span>
-      </div>
-      {banUserId === u.id && !u.banned && (
-        <div className='flex items-center gap-2 pl-[170px]'>
-          <ChipInput
-            value={banReason}
-            onChange={(e) => setBanReason(e.target.value)}
-            placeholder='Reason (optional)'
-            className='flex-1'
-          />
-          <Button
-            variant='primary'
-            className='h-[28px] px-3 text-caption'
-            onClick={() => {
-              banUser.reset()
-              banUser.mutate(
+    <div key={u.id} className='flex items-center gap-3 px-3 py-2 text-small'>
+      <span className='w-[170px] truncate text-[var(--text-primary)]'>{u.name || '—'}</span>
+      <span className='flex-1 truncate text-[var(--text-secondary)]'>{u.email}</span>
+      <span className='w-[60px]'>
+        <Badge variant={u.role === 'admin' ? 'blue' : 'gray'}>{u.role || 'user'}</Badge>
+      </span>
+      <span className='w-[55px]'>
+        {u.banned ? <Badge variant='red'>Banned</Badge> : <Badge variant='green'>Active</Badge>}
+      </span>
+      <span className='flex w-[150px] items-center justify-end gap-1'>
+        {u.id !== session?.user?.id && (
+          <>
+            <Chip
+              aria-label={`Impersonate ${u.email}`}
+              onClick={() => handleImpersonate(u.id, u.email)}
+              disabled={pendingUserIds.has(u.id)}
+            >
+              {impersonatingUserId === u.id ? 'Switching...' : 'Impersonate'}
+            </Chip>
+            <RowActionsMenu
+              label={`${u.email} actions`}
+              actions={[
                 {
-                  userId: u.id,
-                  ...(banReason.trim() ? { banReason: banReason.trim() } : {}),
+                  label: 'Reset password',
+                  onSelect: () => {
+                    setProvisionWarning(null)
+                    sendPasswordReset.mutate(
+                      { userId: u.id, email: u.email },
+                      {
+                        onSuccess: () => toast.success(`Password reset email sent to ${u.email}`),
+                        onError: (error) =>
+                          toast.error(
+                            getErrorMessage(
+                              error,
+                              `Could not send a password reset email to ${u.email}`
+                            )
+                          ),
+                      }
+                    )
+                  },
+                  disabled: pendingUserIds.has(u.id),
                 },
                 {
-                  onSuccess: () => {
-                    setBanUserId(null)
-                    setBanReason('')
+                  label: u.role === 'admin' ? 'Demote' : 'Promote',
+                  onSelect: () => {
+                    setUserRole.reset()
+                    setPendingAction({
+                      type: 'role',
+                      userId: u.id,
+                      nextRole: u.role === 'admin' ? 'user' : 'admin',
+                    })
                   },
-                }
-              )
-            }}
-            disabled={pendingUserIds.has(u.id)}
-          >
-            Confirm Ban
-          </Button>
-        </div>
-      )}
+                  disabled: pendingUserIds.has(u.id),
+                },
+                u.banned
+                  ? {
+                      label: 'Unban',
+                      onSelect: () => unbanUser.mutate({ userId: u.id }),
+                      disabled: pendingUserIds.has(u.id),
+                    }
+                  : {
+                      label: 'Ban',
+                      onSelect: () => {
+                        banUser.reset()
+                        setBanReason('')
+                        setPendingAction({ type: 'ban', userId: u.id })
+                      },
+                      destructive: true,
+                      disabled: pendingUserIds.has(u.id),
+                    },
+              ]}
+            />
+          </>
+        )}
+      </span>
     </div>
   )
 
@@ -424,21 +405,10 @@ export function Admin() {
             </p>
           )}
 
-          {(setUserRole.error ||
-            banUser.error ||
-            unbanUser.error ||
-            impersonateUser.error ||
-            sendPasswordReset.error ||
-            impersonationGuardError) && (
+          {(unbanUser.error || impersonateUser.error || impersonationGuardError) && (
             <p className='text-[var(--text-error)] text-small'>
               {impersonationGuardError ||
-                (
-                  setUserRole.error ||
-                  banUser.error ||
-                  unbanUser.error ||
-                  impersonateUser.error ||
-                  sendPasswordReset.error
-                )?.message ||
+                (unbanUser.error || impersonateUser.error)?.message ||
                 'Action failed. Please try again.'}
             </p>
           )}
@@ -447,6 +417,12 @@ export function Admin() {
             <p className='text-[var(--text-error)] text-small'>{provisionWarning}</p>
           )}
 
+          {sendPasswordReset.isPending && sendPasswordReset.variables && (
+            <p className='text-[var(--text-secondary)] text-small'>
+              Sending a password reset email to {sendPasswordReset.variables.email}...
+            </p>
+          )}
+
           {searchQuery.length > 0 && usersData ? (
             <>
               <div className='flex flex-col gap-0.5'>
@@ -503,6 +479,67 @@ export function Admin() {
           )}
         </div>
       </SettingsSection>
+      <ChipConfirmModal
+        open={pendingAction?.type === 'ban'}
+        onOpenChange={(open) => {
+          if (!open) closePendingAction()
+        }}
+        srTitle='Ban user'
+        title='Ban user'
+        text={[
+          'Banning ',
+          { text: pendingUser?.email ?? 'this user', bold: true },
+          ' ',
+          {
+            text: 'signs them out everywhere and blocks them from signing back in.',
+            error: true,
+          },
+          ' You can unban them later.',
+        ]}
+        confirm={{
+          label: 'Ban',
+          onClick: handleConfirmBan,
+          pending: banUser.isPending,
+          pendingLabel: 'Banning...',
+        }}
+      >
+        <ChipModalField
+          type='input'
+          title='Reason'
+          value={banReason}
+          onChange={setBanReason}
+          placeholder='Optional'
+          disabled={banUser.isPending}
+        />
+        <ChipModalError>{banUser.error?.message}</ChipModalError>
+      </ChipConfirmModal>
+
+      <ChipConfirmModal
+        open={pendingAction?.type === 'role'}
+        onOpenChange={(open) => {
+          if (!open) closePendingAction()
+        }}
+        srTitle={isDemotion ? 'Demote user' : 'Promote user'}
+        title={isDemotion ? 'Demote user' : 'Promote user'}
+        text={[
+          isDemotion ? 'Demoting ' : 'Promoting ',
+          { text: pendingUser?.email ?? 'this user', bold: true },
+          ' ',
+          isDemotion
+            ? { text: 'revokes their platform admin access.', error: true }
+            : 'grants full platform admin access, including impersonating any user.',
+        ]}
+        confirm={{
+          label: isDemotion ? 'Demote' : 'Promote',
+          onClick: handleConfirmRoleChange,
+          variant: isDemotion ? 'destructive' : 'primary',
+          pending: setUserRole.isPending,
+          pendingLabel: isDemotion ? 'Demoting...' : 'Promoting...',
+        }}
+      >
+        <ChipModalError>{setUserRole.error?.message}</ChipModalError>
+      </ChipConfirmModal>
+
       <AddUserModal
         open={isAddUserOpen}
         onOpenChange={setIsAddUserOpen}
@@ -513,7 +550,7 @@ export function Admin() {
           setAdminParams({ q: user.email, offset: null })
           setProvisionWarning(
             resetEmailError
-              ? `Created ${user.email}, but the password reset email failed to send (${resetEmailError}). Use Reset password on their row to try again.`
+              ? `Created ${user.email}, but the password reset email failed to send (${resetEmailError}). Use Reset password in that row's actions menu to try again.`
               : null
           )
         }}