diff --git a/medcat-trainer/webapp/api/api/oidc_utils.py b/medcat-trainer/webapp/api/api/oidc_utils.py
index d510b7b36..a1b58e324 100644
--- a/medcat-trainer/webapp/api/api/oidc_utils.py
+++ b/medcat-trainer/webapp/api/api/oidc_utils.py
@@ -3,11 +3,20 @@
 
 def get_user_by_email(request, id_token):
     """
-    Resolve or create a Django user using the email claim from OIDC.
+    Resolve or create a Django user from OIDC claims.
+
+    Note: Some tokens (e.g. client-credentials / service-account tokens) may not
+    include an email claim. In that case, fall back to a stable identifier so
+    we don't violate DB NOT NULL constraints on the User model.
     """
     User = get_user_model()
-    email = id_token.get('email')
-    username = id_token.get('preferred_username')
+    username = (
+        id_token.get("preferred_username")
+        or id_token.get("sub")
+        or id_token.get("client_id")
+        or f"oidc-{secrets.token_urlsafe(8)}"
+    )
+    email = id_token.get("email") or username
     roles = id_token.get('roles', [])
     is_superuser = 'medcattrainer_superuser' in roles
     is_staff = 'medcattrainer_staff' in roles
@@ -16,6 +25,7 @@ def get_user_by_email(request, id_token):
         email=email,
         defaults={
             "username": username,
+            "email": email,
             "first_name": id_token.get("given_name", ""),
             "last_name": id_token.get("family_name", ""),
             "is_active": True,
@@ -24,6 +34,7 @@ def get_user_by_email(request, id_token):
     )
 
     user.username = username
+    user.email = email
     user.first_name = id_token.get("given_name", "")
     user.last_name = id_token.get("family_name", "")
     user.is_superuser = is_superuser