diff --git a/app/routes/auth.py b/app/routes/auth.py
index 0ee5f7d..95a5c42 100644
--- a/app/routes/auth.py
+++ b/app/routes/auth.py
@@ -187,7 +187,7 @@ def login():
 
 
 @auth_bp.route('/register', methods=['GET', 'POST'])
-@limiter.limit("3 per hour")
+@limiter.limit("20 per hour")
 def register():
     """Handle new player registration with CAPTCHA and password policy.
 
diff --git a/app/routes/users.py b/app/routes/users.py
index 9a18a3e..7167c3a 100644
--- a/app/routes/users.py
+++ b/app/routes/users.py
@@ -112,10 +112,18 @@ def edit_user(user_id):
         discord_user_id = request.form.get('discord_user_id', '').strip()
         league_os_profile = request.form.get('league_os_profile', '').strip()
 
+        # Change role via raw SQL to avoid polymorphic identity corruption
+        if user.role != role:
+            db.session.execute(
+                db.text("UPDATE users SET role = :role WHERE id = :id"),
+                {"role": role, "id": user.id}
+            )
+            db.session.commit()
+            user = User.query.get(user_id)  # re-fetch with correct polymorphic class
+
         user.full_name = full_name
         user.email = email
         user.phone = phone
-        user.role = role
         user.is_active_account = is_active
         user.games = ','.join(selected_games) if selected_games else None
         user.discord_username = discord_username or None