diff --git a/backend/windmill-api/src/apps.rs b/backend/windmill-api/src/apps.rs
index 374ceba20a..afe569cba6 100644
--- a/backend/windmill-api/src/apps.rs
+++ b/backend/windmill-api/src/apps.rs
@@ -313,10 +313,13 @@ async fn create_app(
     Extension(user_db): Extension<UserDB>,
     Extension(webhook): Extension<WebhookShared>,
     Path(w_id): Path<String>,
-    Json(app): Json<CreateApp>,
+    Json(mut app): Json<CreateApp>,
 ) -> Result<(StatusCode, String)> {
     let mut tx = user_db.begin(&authed).await?;
 
+    app.policy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
+    app.policy.on_behalf_of_email = Some(authed.email);
+
     let id = sqlx::query_scalar!(
         "INSERT INTO app
             (workspace_id, path, summary, policy, versions)
@@ -463,7 +466,9 @@ async fn update_app(
             sqlb.set_str("summary", nsummary);
         }
 
-        if let Some(npolicy) = ns.policy {
+        if let Some(mut npolicy) = ns.policy {
+            npolicy.on_behalf_of = Some(username_to_permissioned_as(&authed.username));
+            npolicy.on_behalf_of_email = Some(authed.email);
             sqlb.set(
                 "policy",
                 &format!(
diff --git a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
index 336f3eeff8..04500d811e 100644
--- a/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
+++ b/frontend/src/lib/components/apps/editor/AppEditorHeader.svelte
@@ -168,13 +168,6 @@
 				)
 		)
 		policy.triggerables = Object.fromEntries(allTriggers.filter((x) => x.length > 0))
-
-		if (!$userStore?.username?.includes('@')) {
-			policy.on_behalf_of = `u/${$userStore?.username}`
-		} else {
-			policy.on_behalf_of = $userStore?.email
-		}
-		policy.on_behalf_of_email = $userStore?.email
 	}
 	async function createApp(path: string) {
 		await computeTriggerables()
diff --git a/frontend/src/routes/(root)/(logged)/apps/add/+page.svelte b/frontend/src/routes/(root)/(logged)/apps/add/+page.svelte
index 4e5c8e9609..f56313fd2d 100644
--- a/frontend/src/routes/(root)/(logged)/apps/add/+page.svelte
+++ b/frontend/src/routes/(root)/(logged)/apps/add/+page.svelte
@@ -36,7 +36,9 @@
 	loadApp()
 
 	let policy: Policy = {
-		on_behalf_of: `u/${$userStore?.username}`,
+		on_behalf_of: $userStore?.username.includes('@')
+			? $userStore?.username
+			: `u/${$userStore?.username}`,
 		on_behalf_of_email: $userStore?.email,
 		execution_mode: Policy.execution_mode.PUBLISHER
 	}