diff --git a/packages/plugins/plugin-auth/src/auth-manager.test.ts b/packages/plugins/plugin-auth/src/auth-manager.test.ts
index 8db4c64313..65a684ede7 100644
--- a/packages/plugins/plugin-auth/src/auth-manager.test.ts
+++ b/packages/plugins/plugin-auth/src/auth-manager.test.ts
@@ -1942,8 +1942,9 @@ describe('AuthManager', () => {
     // Rethrowing that envelope as a plain `Error` made better-call answer
     // **500 with a null body**: its router maps only `APIError`
     // (`isAPIError = err instanceof APIError || err?.name === 'APIError'`,
-    // better-call@1.3.7 `dist/utils.mjs:57`, consumed at `dist/router.mjs:93`),
-    // and everything else takes the `console.error` + 500 branch. Meanwhile the
+    // better-call@1.4.0 `dist/utils.mjs:55-56`, consumed at `dist/router.mjs:92`;
+    // re-measured 2026-08-23 against the installed copy), and everything
+    // else takes the `console.error` + 500 branch (`:93-97`). Meanwhile the
     // per-number wall on the SAME endpoint (`assertPhoneOtpSendAllowed`, in the
     // admission hook) throws a real `APIError('TOO_MANY_REQUESTS')` and answers
     // 429 — so one endpoint spoke with two voices, which is the reverse of what
diff --git a/packages/plugins/plugin-auth/src/auth-manager.ts b/packages/plugins/plugin-auth/src/auth-manager.ts
index d6bdba962a..643ad10106 100644
--- a/packages/plugins/plugin-auth/src/auth-manager.ts
+++ b/packages/plugins/plugin-auth/src/auth-manager.ts
@@ -918,8 +918,9 @@ export function normalizeAuthEmailLocale(raw: string | undefined): string | unde
  *
  * better-call (better-auth's router) maps ONLY `APIError` to a real HTTP status:
  * `isAPIError(err) = err instanceof APIError || err?.name === 'APIError'`
- * (better-call@1.3.7 `dist/utils.mjs:57`), consumed at `dist/router.mjs:93`,
- * where everything else takes the `console.error` + `500 / null body` branch.
+ * (better-call@1.4.0 `dist/utils.mjs:55-56`), consumed at `dist/router.mjs:92`,
+ * where everything else takes the `console.error` + `500 / null body` branch
+ * (`:93-97`; re-measured 2026-08-23 against the installed copy).
  * A plain `Error` therefore buried `TOO_MANY_REQUESTS` in a server log while the
  * per-number wall on the same endpoint ({@link AuthManager.assertPhoneOtpSendAllowed})
  * answered 429 — one endpoint, two voices.
diff --git a/packages/plugins/plugin-auth/src/auth-plugin.ts b/packages/plugins/plugin-auth/src/auth-plugin.ts
index d334fc9536..9f2f9be7ba 100644
--- a/packages/plugins/plugin-auth/src/auth-plugin.ts
+++ b/packages/plugins/plugin-auth/src/auth-plugin.ts
@@ -1754,12 +1754,18 @@ export class AuthPlugin implements Plugin {
     // OAuth admin: toggle the `disabled` flag on a registered OAuth client.
     //
     // Why this lives here (and not as a plain data-layer UPDATE on
-    // sys_oauth_application): better-auth 1.6.11's stock admin update
-    // endpoint (`/admin/oauth2/update-client`) does NOT accept `disabled`
-    // in its Zod body schema, so the field gets silently stripped before
-    // it reaches `updateClientEndpoint`. The column exists, the runtime
-    // honours it everywhere (introspect, token, authorize, public-client
-    // lookup), but no client-facing API can flip it.
+    // sys_oauth_application): the stock admin update endpoint
+    // (`/admin/oauth2/update-client`) does NOT accept `disabled` in its
+    // Zod body schema, so the field gets silently stripped before it
+    // reaches `updateClientEndpoint`. Re-measured 2026-08-23 against the
+    // installed @better-auth/oauth-provider 1.7.1 (the package that
+    // carries the endpoint at 1.7.x): `adminUpdateOAuthClient`
+    // (`dist/authorize-Crqw4_bR.mjs:2860`) declares its body schema at
+    // `:2862-2889`, and `disabled` occurs zero times in that block —
+    // while matching 35 other lines of the same file (`grep -c`), so the
+    // search reaches the text. The column exists, the runtime honours it
+    // everywhere (introspect, token, authorize, public-client lookup),
+    // but no client-facing API can flip it.
     //
     // We close the gap by writing through better-auth's own adapter under
     // the `/api/v1/auth/*` namespace so all OAuth-application mutations