diff --git a/backend/repository/user.go b/backend/repository/user.go
index 6a81143..cb27914 100644
--- a/backend/repository/user.go
+++ b/backend/repository/user.go
@@ -419,7 +419,10 @@ func (r *User) GetByUsername(
 	return ToUser(dbUser)
 }
 
-// GetByEmail gets a user by email
+// GetByEmail gets a user by a case insensitive email match. the address is
+// compared with LOWER() on both sides so differently cased addresses such as
+// Alice@corp.com and alice@corp.com resolve to the same user. this keeps SSO
+// login matching and the email uniqueness checks robust to casing.
 func (r *User) GetByEmail(
 	ctx context.Context,
 	email *vo.Email,
@@ -429,7 +432,7 @@ func (r *User) GetByEmail(
 	result := r.with(options, r.DB).
 		Where(
 			fmt.Sprintf(
-				"%s = ?",
+				"LOWER(%s) = LOWER(?)",
 				TableColumn(database.USER_TABLE, "email"),
 			),
 			email.String(),