diff --git a/packages/server/modules/auth/defaultApps.ts b/packages/server/modules/auth/defaultApps.ts
index abbe6d1e93..86dd4ef34a 100644
--- a/packages/server/modules/auth/defaultApps.ts
+++ b/packages/server/modules/auth/defaultApps.ts
@@ -1,5 +1,9 @@
 import { Scopes } from '@/modules/core/helpers/mainConstants'
-import { speckleAutomateUrl, getServerOrigin } from '@/modules/shared/helpers/envHelper'
+import {
+  speckleAutomateUrl,
+  getServerOrigin,
+  getFeatureFlags
+} from '@/modules/shared/helpers/envHelper'
 
 export enum DefaultAppIds {
   Web = 'spklwebapp',
@@ -123,7 +127,9 @@ const SpeckleAutomate = {
     Scopes.Tokens.Write,
     Scopes.Streams.Read,
     Scopes.Streams.Write,
-    Scopes.Automate.ReportResults
+    ...(getFeatureFlags().FF_AUTOMATE_MODULE_ENABLED
+      ? [Scopes.Automate.ReportResults]
+      : [])
   ]
 }
 
diff --git a/packages/server/modules/index.js b/packages/server/modules/index.js
index 394a3df8f1..b82ad87688 100644
--- a/packages/server/modules/index.js
+++ b/packages/server/modules/index.js
@@ -62,7 +62,16 @@ const getEnabledModuleNames = () => {
     'webhooks'
   ]
 
-  if (FF_AUTOMATE_MODULE_ENABLED) moduleNames.push('automate')
+  if (FF_AUTOMATE_MODULE_ENABLED) {
+    // Push in after 'auth', important for scope order?
+    const authIdx = moduleNames.indexOf('auth')
+    if (authIdx !== -1) {
+      moduleNames.splice(authIdx + 1, 0, 'automate')
+    } else {
+      moduleNames.push('automate')
+    }
+  }
+
   if (FF_GENDOAI_MODULE_ENABLED) moduleNames.push('gendo')
   return moduleNames
 }