diff --git a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
index feffc09405..8d175e57ea 100644
--- a/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
+++ b/frontend/src/lib/components/sessions/WorkspaceFamilyPicker.svelte
@@ -19,6 +19,7 @@
 	} from '$lib/utils/workspaceHierarchy'
 	import { useForkableWorkspaces } from '$lib/utils/useForkableWorkspaces.svelte'
 	import { canCreateFork } from '$lib/utils/editInFork'
+	import { capabilitiesIn, isRestricted } from '$lib/roleCapabilities'
 	import { forkAccentStyle } from '$lib/utils/forkColor'
 	import { WorkspaceService } from '$lib/gen'
 	import { useSessionReadOnly } from './sessionPermissions.svelte'
@@ -190,6 +191,13 @@
 				? forksOf !== 'admins' &&
 					!rootRulesetsResource.loading &&
 					!rootUserInfoResource.loading &&
+					// A restricted role would get the default role in the fork it creates.
+					!isRestricted(
+						capabilitiesIn(
+							rootUserInfo,
+							$userWorkspaces.find((w) => w.id === forksOf)
+						)
+					) &&
 					(!isRuleActiveInRulesets(rootRulesets, 'DisableWorkspaceForking') ||
 						canUserBypassRuleKindInRulesets(rootRulesets, 'DisableWorkspaceForking', rootUserInfo))
 				: $workspaceStore !== 'admins' &&