diff --git a/DBML.md b/DBML.md
index b6382e0..6887e2b 100644
--- a/DBML.md
+++ b/DBML.md
@@ -1,4 +1,5 @@
 Enum user_status {
+  INACTIVE
   ONBOARDING
   ACTIVE
   SUSPENDED
diff --git a/app/models/user.py b/app/models/user.py
index 2c6b92c..0a1d5b3 100644
--- a/app/models/user.py
+++ b/app/models/user.py
@@ -17,7 +17,7 @@ class User(Base):
     password: Mapped[str] = mapped_column(String(255))
     email_verified_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
     tenant_id: Mapped[str | None] = mapped_column(CHAR(36), nullable=True)
-    status: Mapped[str] = mapped_column(String(20), default="ONBOARDING")
+    status: Mapped[str] = mapped_column(String(20), default="INACTIVE")
     created_at: Mapped[datetime] = mapped_column(DateTime, default=datetime.now)
     updated_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True, onupdate=datetime.now)
     deleted_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
diff --git a/app/routers/auth.py b/app/routers/auth.py
index 539c71b..a3eb0ad 100644
--- a/app/routers/auth.py
+++ b/app/routers/auth.py
@@ -23,6 +23,12 @@ def login(data: LoginRequest, db: Session = Depends(get_db)):
             detail={"message": "Kredensial autentikasi tidak ada atau tidak valid."},
         )
 
+    if user.email_verified_at is None:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail={"message": "Email belum diverifikasi. Silakan verifikasi email terlebih dahulu."},
+        )
+
     access_token = create_access_token({"sub": user.id})
     return LoginResponse(
         access_token=access_token,
diff --git a/app/seeders/user_seeder.py b/app/seeders/user_seeder.py
index 06dfd35..8ba43f4 100644
--- a/app/seeders/user_seeder.py
+++ b/app/seeders/user_seeder.py
@@ -23,12 +23,15 @@ def seed_users(db, count: int = 5, tenant_ids: list[str] | None = None):
     admin = db.query(User).filter(
         (User.email == "project.pangestuyoga@gmail.com") | (User.username == "pangestu")
     ).first()
+    from datetime import datetime, timezone
+
     if not admin:
         admin = User(
             email="project.pangestuyoga@gmail.com",
             username="pangestu",
             password=hash_password("Minimal8@"),
             status="ACTIVE",
+            email_verified_at=datetime.now(timezone.utc),
         )
         db.add(admin)
         db.flush()