diff --git a/web/oss/src/components/pages/settings/WorkspaceManage/cellRenderers.tsx b/web/oss/src/components/pages/settings/WorkspaceManage/cellRenderers.tsx
index 0bd19ebbdf..ccd95c1bf1 100644
--- a/web/oss/src/components/pages/settings/WorkspaceManage/cellRenderers.tsx
+++ b/web/oss/src/components/pages/settings/WorkspaceManage/cellRenderers.tsx
@@ -32,7 +32,7 @@ export const Actions: React.FC<{
 }> = ({member, hidden, organizationId, workspaceId, onResendInvite, selfMenu}) => {
     const {user} = member
     const isMember = user.status === "member"
-    const {canModifyRoles, canInviteMembers} = useWorkspacePermissions()
+    const {canInviteMembers, canRemoveMembers} = useWorkspacePermissions()
 
     const [resendLoading, setResendLoading] = useState(false)
     const {refetch} = useOrgData()
@@ -41,7 +41,7 @@ export const Actions: React.FC<{
     const [renameValue, setRenameValue] = useState(user.username || "")
 
     if (hidden && !selfMenu) return null
-    if (!selfMenu && !canInviteMembers && !canModifyRoles) return null
+    if (!selfMenu && !canInviteMembers && !canRemoveMembers) return null
 
     const handleResendInvite = () => {
         if (!organizationId || !user.email || !workspaceId) return
@@ -128,7 +128,7 @@ export const Actions: React.FC<{
                                         },
                                     ]
                                   : []),
-                              ...(canModifyRoles
+                              ...(canRemoveMembers
                                   ? [
                                         {
                                             key: "remove",
diff --git a/web/oss/src/hooks/useWorkspacePermissions.ts b/web/oss/src/hooks/useWorkspacePermissions.ts
index 2e3955d915..be36b86c3b 100644
--- a/web/oss/src/hooks/useWorkspacePermissions.ts
+++ b/web/oss/src/hooks/useWorkspacePermissions.ts
@@ -11,7 +11,7 @@ import {useProjectPermissions} from "./useProjectPermissions"
  */
 export const useWorkspacePermissions = () => {
     const {hasRBAC} = useEntitlements()
-    const {hasPermission, isOrgOwner} = useProjectPermissions()
+    const {hasPermission, hasRole, isOrgOwner} = useProjectPermissions()
 
     // OSS always enforces; EE only when RBAC-entitled.
     const rbacActive = !isEE() || hasRBAC
@@ -32,12 +32,22 @@ export const useWorkspacePermissions = () => {
         return hasPermission("modify_user_roles")
     }, [hasPermission, rbacActive])
 
+    /**
+     * Check if the current user can remove members from the workspace.
+     * Mirrors the backend gate on DELETE /workspaces/{id}/users (org owner or
+     * owner/admin role; allow-all for not-RBAC-entitled EE).
+     */
+    const canRemoveMembers = useMemo(() => {
+        return hasRole("owner") || hasRole("admin")
+    }, [hasRole])
+
     /**
      * Check if the current user is the organization owner.
      */
     return {
         canInviteMembers,
         canModifyRoles,
+        canRemoveMembers,
         isOrgOwner,
     }
 }