diff --git a/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs b/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs
index d721eea59..29236e4e4 100644
--- a/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs
+++ b/src/modules/Elsa.ExternalAuthentication/Services/DefaultIdentityProviderConnectionRegistry.cs
@@ -90,8 +90,7 @@ public sealed class DefaultIdentityProviderConnectionRegistry(
         var registry = await GetAsync(targetTenantId, cancellationToken);
         var normalizedKey = ConnectionRevisionCalculator.NormalizeKey(key);
         return registry.Connections.FirstOrDefault(x =>
-            !x.IsShadowed &&
-            x.Validity != ConnectionValidity.Invalid &&
+            IsAvailableForAuthentication(x) &&
             string.Equals(ConnectionRevisionCalculator.NormalizeKey(x.Connection.Key), normalizedKey, StringComparison.Ordinal));
     }
 
@@ -104,7 +103,7 @@ public sealed class DefaultIdentityProviderConnectionRegistry(
     private static IReadOnlyCollection<LoginMethod> CreateLoginMethods(IReadOnlyCollection<EffectiveIdentityProviderConnection> connections)
     {
         var available = connections
-            .Where(x => !x.IsShadowed && x.Validity != ConnectionValidity.Invalid && x.Connection.IsEnabled && !x.Connection.ArchivedAt.HasValue)
+            .Where(IsAvailableForAuthentication)
             .ToArray();
         var configuredPreferred = available
             .Where(x => x.Ownership == ConnectionSourceOwnership.Configuration && x.Connection.IsPreferred)
@@ -144,6 +143,11 @@ public sealed class DefaultIdentityProviderConnectionRegistry(
     private static IReadOnlyList<ConnectionScope> GetApplicableScopes() => [ConnectionScope.Host];
 
     private static bool IsInScope(IdentityProviderConnection connection, ConnectionScope scope) => string.Equals(connection.TenantId, scope.TenantId, StringComparison.Ordinal);
+    private static bool IsAvailableForAuthentication(EffectiveIdentityProviderConnection connection) =>
+        !connection.IsShadowed &&
+        connection.Validity != ConnectionValidity.Invalid &&
+        connection.Connection.IsEnabled &&
+        !connection.Connection.ArchivedAt.HasValue;
     private static int GetOwnershipPriority(ConnectionSourceOwnership ownership) => ownership == ConnectionSourceOwnership.Configuration ? 0 : 1;
     private static IdentityProviderConnectionReference ToReference(Candidate candidate) =>
         new(candidate.Connection.Id, candidate.Connection.DisplayName, candidate.Source.Ownership);
diff --git a/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs b/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs
index 0cad80123..1da20de7e 100644
--- a/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs
+++ b/test/unit/Elsa.ExternalAuthentication.UnitTests/Foundational/DefaultIdentityProviderConnectionRegistryTests.cs
@@ -49,8 +49,8 @@ public class DefaultIdentityProviderConnectionRegistryTests
     [Fact]
     public async Task ArchivedDatabaseOverrideDoesNotParticipateInActiveShadowRelationships()
     {
-        var configuration = ExternalAuthenticationTestData.CreateConnection("configuration-oidc", ConnectionScope.HostTenantId, "oidc");
-        var archivedOverride = ExternalAuthenticationTestData.CreateConnection("database-oidc", ConnectionScope.HostTenantId, "OIDC");
+        var configuration = ExternalAuthenticationTestData.CreateConnection("configuration-oidc", ConnectionScope.HostTenantId, "oidc", displayOrder: 10);
+        var archivedOverride = ExternalAuthenticationTestData.CreateConnection("database-oidc", ConnectionScope.HostTenantId, "OIDC", displayOrder: 0);
         archivedOverride.OverridesConfigurationConnection = true;
         archivedOverride.ArchivedAt = DateTimeOffset.UtcNow;
         var registry = CreateRegistry(
@@ -58,9 +58,11 @@ public class DefaultIdentityProviderConnectionRegistryTests
             new TestConnectionSource("configuration", ConnectionSourceOwnership.Configuration, [(ConnectionScope.Host, [configuration])]));
 
         var result = await registry.GetAsync("tenant-a");
+        var resolved = await registry.FindByKeyAsync("tenant-a", "oidc");
 
         var effective = Assert.Single(result.Connections, x => !x.Connection.ArchivedAt.HasValue && !x.IsShadowed);
         Assert.Equal("configuration-oidc", effective.Connection.Id);
+        Assert.Equal("configuration-oidc", Assert.IsType<EffectiveIdentityProviderConnection>(resolved).Connection.Id);
         Assert.Empty(effective.Shadows);
         var archived = Assert.Single(result.Connections, x => x.Connection.Id == "database-oidc");
         Assert.True(archived.Connection.ArchivedAt.HasValue);