diff --git a/docker/ss-atlas/internal/handlers/subscription.go b/docker/ss-atlas/internal/handlers/subscription.go
index 9eb2788..4706753 100644
--- a/docker/ss-atlas/internal/handlers/subscription.go
+++ b/docker/ss-atlas/internal/handlers/subscription.go
@@ -149,6 +149,11 @@ func (a *App) handleSuccess(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// Grant active subscription: add to customers group so dashboard shows subscribed.
+	if err := a.ldap.AddToGroup(result.Username, "customers"); err != nil {
+		log.Printf("ldap add to customers failed for %s: %v", result.Username, err)
+	}
+
 	inGroup, _ := a.ldap.IsInGroup(result.Username, "customers")
 
 	if result.IsNew || !inGroup {
diff --git a/docker/ss-atlas/internal/handlers/webhook.go b/docker/ss-atlas/internal/handlers/webhook.go
index df06152..e69f0c4 100644
--- a/docker/ss-atlas/internal/handlers/webhook.go
+++ b/docker/ss-atlas/internal/handlers/webhook.go
@@ -73,6 +73,9 @@ func (a *App) onCheckoutCompleted(event stripego.Event) {
 	if err := a.ldap.EnsureUser(username, email, customerID, phone); err != nil {
 		log.Printf("webhook: ldap ensure user failed: %v", err)
 	}
+	if err := a.ldap.AddToGroup(username, "customers"); err != nil {
+		log.Printf("webhook: ldap add to customers failed for %s: %v", username, err)
+	}
 	if sess.Metadata != nil {
 		if d := sess.Metadata["customer_domain"]; d != "" {
 			if err := a.ldap.SetCustomerDomain(username, d); err != nil {