diff --git a/coderd/httpmw/workspaceagent.go b/coderd/httpmw/workspaceagent.go
index 47867e17b2..2a44131161 100644
--- a/coderd/httpmw/workspaceagent.go
+++ b/coderd/httpmw/workspaceagent.go
@@ -109,7 +109,7 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
 				return
 			}
 
-			subject, _, err := UserRBACSubject(
+			subject, userStatus, err := UserRBACSubject(
 				ctx,
 				opts.DB,
 				row.WorkspaceTable.OwnerID,
@@ -129,6 +129,12 @@ func ExtractWorkspaceAgentAndLatestBuild(opts ExtractWorkspaceAgentAndLatestBuil
 				})
 				return
 			}
+			if userStatus != database.UserStatusActive {
+				httpapi.Write(ctx, rw, http.StatusUnauthorized, codersdk.Response{
+					Message: fmt.Sprintf("User has status %q. Contact an admin to reactivate your account.", userStatus),
+				})
+				return
+			}
 
 			ctx = context.WithValue(ctx, workspaceAgentContextKey{}, row.WorkspaceAgent)
 			ctx = context.WithValue(ctx, latestBuildContextKey{}, row.WorkspaceBuild)
diff --git a/coderd/httpmw/workspaceagent_test.go b/coderd/httpmw/workspaceagent_test.go
index ad9bd5f1e5..b7768ebc6d 100644
--- a/coderd/httpmw/workspaceagent_test.go
+++ b/coderd/httpmw/workspaceagent_test.go
@@ -102,7 +102,7 @@ func TestWorkspaceAgent(t *testing.T) {
 				err = json.NewDecoder(res.Body).Decode(&resp)
 				require.NoError(t, err)
 				require.Equal(t,
-					fmt.Sprintf("User is not active (status = %q). Contact an admin to reactivate your account.", status),
+					fmt.Sprintf("User has status %q. Contact an admin to reactivate your account.", status),
 					resp.Message,
 				)
 			})