diff --git a/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs b/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs
index 269664c7b..d721eea59 100644
--- a/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs
+++ b/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs
@@ -51,14 +51,15 @@ public sealed class DefaultIdentityProviderConnectionRegistry(
             var shadowedReferences = hasInheritedScopeCollision
                 ? []
                 : candidatesForKey
-                    .Where(candidate => !ReferenceEquals(candidate, preferred))
+                    .Where(candidate => !ReferenceEquals(candidate, preferred) && !candidate.Connection.ArchivedAt.HasValue)
                     .Select(ToReference)
                     .ToArray();
 
             for (var index = 0; index < candidatesForKey.Length; index++)
             {
                 var candidate = candidatesForKey[index];
-                var isShadowed = !hasInheritedScopeCollision && !ReferenceEquals(candidate, preferred);
+                var isArchived = candidate.Connection.ArchivedAt.HasValue;
+                var isShadowed = !isArchived && !hasInheritedScopeCollision && !ReferenceEquals(candidate, preferred);
                 connections.Add(new EffectiveIdentityProviderConnection(
                     candidate.Connection,
                     candidate.Source.Ownership,
@@ -68,7 +69,7 @@ public sealed class DefaultIdentityProviderConnectionRegistry(
                     candidate.Source.Name)
                 {
                     ShadowedBy = isShadowed ? preferredReference : null,
-                    Shadows = isShadowed ? [] : shadowedReferences
+                    Shadows = isShadowed || isArchived ? [] : shadowedReferences
                 });
             }
         }
diff --git a/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs b/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs
index 19977b2b9..0cad80123 100644
--- a/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs
+++ b/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs
@@ -47,7 +47,7 @@ public class DefaultIdentityProviderConnectionRegistryTests
     }
 
     [Fact]
-    public async Task ArchivedDatabaseOverrideDoesNotAppearInTheEffectiveConnectionShadows()
+    public async Task ArchivedDatabaseOverrideDoesNotParticipateInActiveShadowRelationships()
     {
         var configuration = ExternalAuthenticationTestData.CreateConnection("configuration-oidc", ConnectionScope.HostTenantId, "oidc");
         var archivedOverride = ExternalAuthenticationTestData.CreateConnection("database-oidc", ConnectionScope.HostTenantId, "OIDC");
@@ -59,10 +59,14 @@ public class DefaultIdentityProviderConnectionRegistryTests
 
         var result = await registry.GetAsync("tenant-a");
 
-        var effective = Assert.Single(result.Connections, x => !x.IsShadowed);
+        var effective = Assert.Single(result.Connections, x => !x.Connection.ArchivedAt.HasValue && !x.IsShadowed);
         Assert.Equal("configuration-oidc", effective.Connection.Id);
         Assert.Empty(effective.Shadows);
-        Assert.Contains(result.Connections, x => x.Connection.Id == "database-oidc" && x.Connection.ArchivedAt.HasValue);
+        var archived = Assert.Single(result.Connections, x => x.Connection.Id == "database-oidc");
+        Assert.True(archived.Connection.ArchivedAt.HasValue);
+        Assert.False(archived.IsShadowed);
+        Assert.Null(archived.ShadowedBy);
+        Assert.Empty(archived.Shadows);
     }
 
     [Fact]