@@ -226,7 +226,7 @@ export async function createEnvironmentApiKey(
     rbacController = rbac,
     telemetryRecorder = apiKeyTelemetry,
   }: {
-    prismaClient?: Pick<PrismaClient, "apiKey" | "runtimeEnvironment" | "taskIdentifier">;
+    prismaClient?: PrismaClient;
     rbacController?: Pick<HostRbacController, "prepareApiKeyPolicy">;
     telemetryRecorder?: ApiKeyTelemetry;
   } = {}
@@ -289,23 +289,54 @@ export async function createEnvironmentApiKey(
   const generated = generateAdditionalApiKey(environment.type);
   const apiKey = await (async () => {
     try {
-      return await prismaClient.apiKey.create({
-        data: {
-          name,
-          keyHash: generated.keyHash,
-          lastFour: generated.lastFour,
-          runtimeEnvironmentId: environment.id,
-          createdByUserId: userId,
-          expiresAt,
-          presetId: prepared.policy.presetId,
-          scopes: prepared.policy.scopes,
+      const create = (client: Pick<PrismaClient, "apiKey">) =>
+        client.apiKey.create({
+          data: {
+            name,
+            keyHash: generated.keyHash,
+            lastFour: generated.lastFour,
+            runtimeEnvironmentId: environment.id,
+            createdByUserId: userId,
+            expiresAt,
+            presetId: prepared.policy.presetId,
+            scopes: prepared.policy.scopes,
+          },
+        });
+      if (environment.type !== "DEVELOPMENT") {
+        return await create(prismaClient);
+      }
+      const created = await $transaction(
+        prismaClient,
+        "create development API key",
+        async (tx) => {
+          const members = await tx.$queryRaw<Array<{ id: string }>>`
+          SELECT m."id" FROM "OrgMember" m
+          JOIN "RuntimeEnvironment" e ON e."orgMemberId" = m."id"
+          WHERE e."id" = ${environment.id}
+            AND m."organizationId" = ${environment.organizationId}
+            AND m."userId" = ${userId}
+          FOR UPDATE OF m
+        `;
+          if (members.length === 0) {
+            return null;
+          }
+          return create(tx);
         },
-      });
+        { isolationLevel: "Serializable" }
+      );
+      if (created === undefined) {
+        throw new Error("Failed to create development API key");
+      }
+      return created;
     } catch (error) {
       telemetryRecorder.recordOperation("create", "error", "database_error");
       throw error;
     }
   })();
+  if (apiKey === null) {
+    telemetryRecorder.recordOperation("create", "rejected", "membership_removed");
+    throw new Error("Environment not found");
+  }
   telemetryRecorder.recordOperation("create", "success");
 
   return { apiKey, plaintext: generated.apiKey };
 
@@ -0,0 +1,35 @@
+import type { PrismaTransactionClient } from "@trigger.dev/database";
+import { generateRootApiKey } from "~/utils/apiKeys";
+
+export async function deleteOrgMember(
+  tx: PrismaTransactionClient,
+  member: { id: string; organizationId: string }
+) {
+  // Prevent new development environments from being provisioned during removal.
+  await tx.$queryRaw`
+    SELECT "id" FROM "OrgMember"
+    WHERE "id" = ${member.id} AND "organizationId" = ${member.organizationId}
+    FOR UPDATE
+  `;
+
+  const environments = await tx.runtimeEnvironment.findMany({
+    where: {
+      organizationId: member.organizationId,
+      orgMemberId: member.id,
+      type: "DEVELOPMENT",
+    },
+    select: { id: true },
+  });
+  for (const environment of environments) {
+    await tx.runtimeEnvironment.update({
+      where: { id: environment.id },
+      data: {
+        apiKey: generateRootApiKey("DEVELOPMENT").apiKey,
+        apiKeys: {
+          updateMany: { where: { revokedAt: null }, data: { revokedAt: new Date() } },
+        },
+      },
+    });
+  }
+  return tx.orgMember.delete({ where: { id: member.id, organizationId: member.organizationId } });
+}
@@ -1,4 +1,5 @@
-import { Prisma, prisma } from "~/db.server";
+import { $transaction, Prisma, prisma } from "~/db.server";
+import { deleteOrgMember } from "./deleteOrgMember.server";
 import type { MembershipSource } from "~/models/member.server";
 import { logger } from "~/services/logger.server";
 import { enqueueMemberDevelopmentEnvironments } from "~/services/memberDevEnvironments.server";
@@ -8,6 +9,15 @@ import {
   revokePersonalAccessToken,
 } from "~/services/personalAccessToken.server";
 
+async function deleteMembership(memberId: string, organizationId: string) {
+  const result = await $transaction(prisma, "delete org member", (tx) =>
+    deleteOrgMember(tx, { id: memberId, organizationId })
+  );
+  if (!result) {
+    throw new Error("Failed to delete organization member");
+  }
+}
+
 export type EnsureOrgMemberParams = {
   userId: string;
   organizationId: string;
@@ -150,7 +160,7 @@ export async function ensureOrgMember(
         roleId,
         error: result.error,
       });
-      await prisma.orgMember.delete({ where: { id: member.id } });
+      await deleteMembership(member.id, organizationId);
       throw new Error(`ensureOrgMember: failed to apply role ${roleId}: ${result.error}`);
     }
   }
@@ -257,7 +267,7 @@ export async function removeOrgMemberForDirectory(params: {
     }
   }
 
-  await prisma.orgMember.delete({ where: { id: member.id } });
+  await deleteMembership(member.id, organizationId);
   const removeRole = await rbac.removeUserRole({ userId, organizationId });
   if (!removeRole.ok) {
     logger.warn("removeOrgMemberForDirectory: failed to remove RBAC role", {
 
@@ -1,10 +1,7 @@
 import type { PrismaClient } from "@trigger.dev/database";
+import { $transaction } from "~/db.server";
 import { ServiceValidationError } from "~/v3/services/common.server";
-
-// Leaf module with a type-only Prisma import (caller passes the client) so it
-// can be unit-tested without importing `~/db.server`, which eagerly connects
-// the global prisma singleton. ServiceValidationError is a plain error class
-// with no imports, so it stays leaf-safe and lets callers map it to a status.
+import { deleteOrgMember } from "./deleteOrgMember.server";
 export async function removeTeamMember(
   {
     userId,
@@ -28,9 +25,10 @@ export async function removeTeamMember(
   // Serializable so the "keep at least one member" check and the delete are
   // atomic: at ReadCommitted two concurrent removals could each see >1 member
   // and both delete, orphaning the org. The guard lives here, not per-caller,
-  // so every surface (dashboard + management API) is TOCTOU-safe. Raw
-  // $transaction (not the ~/db.server helper) keeps this module leaf/testable.
-  return prismaClient.$transaction(
+  // so every surface (dashboard + management API) is TOCTOU-safe.
+  const result = await $transaction(
+    prismaClient,
+    "remove team member",
     async (tx) => {
       // Scope both the lookup and the delete to org.id, so the member id is
       // only ever resolved within the actor's organization.
@@ -48,9 +46,13 @@ export async function removeTeamMember(
         throw new ServiceValidationError("Cannot remove the last member of an organization", 400);
       }
 
-      await tx.orgMember.delete({ where: { id: target.id } });
+      await deleteOrgMember(tx, { id: target.id, organizationId: org.id });
       return target;
     },
     { isolationLevel: "Serializable" }
   );
+  if (!result) {
+    throw new Error("Failed to remove organization member");
+  }
+  return result;
 }
@@ -6,6 +6,7 @@ export type ApiKeyOperationResult = "success" | "rejected" | "error";
 export type ApiKeyOperationReason =
   | "none"
   | "database_error"
+  | "membership_removed"
   | "not_found_or_revoked"
   | "policy_rejected"
   | "policy_error";
 
@@ -4,10 +4,12 @@ import rbacPlugin, { type RoleBaseAccessController } from "@trigger.dev/rbac";
 import { expect, vi } from "vitest";
 import { MAX_API_KEY_TASK_IDENTIFIERS } from "~/consts";
 import { createEnvironmentApiKey, revokeEnvironmentApiKey } from "~/models/api-key.server";
+import { removeTeamMember } from "~/models/removeTeamMember.server";
 import type { ApiKeyTelemetry } from "~/services/apiKeyTelemetry.server";
 import {
   createRuntimeEnvironment,
   createTestOrgProjectWithMember,
+  createTestUser,
   uniqueId,
 } from "./fixtures/environmentVariablesFixtures";
 
@@ -68,6 +70,70 @@ containerTest("standalone fallback creates one explicit full-access key", async
   ).resolves.toBe(1);
 });
 
+containerTest("cannot create a development key after its member is removed", async ({ prisma }) => {
+  const { organization, project, user, orgMember } = await createTestOrgProjectWithMember(prisma);
+  const admin = await createTestUser(prisma);
+  await prisma.orgMember.create({
+    data: { userId: admin.id, organizationId: organization.id, role: "ADMIN" },
+  });
+  const environment = await createRuntimeEnvironment(prisma, {
+    projectId: project.id,
+    organizationId: organization.id,
+    orgMemberId: orgMember.id,
+    type: "DEVELOPMENT",
+  });
+  const fallback = rbacPlugin.create(prisma, { forceFallback: true });
+  let policyStarted!: () => void;
+  let resumePolicy!: () => void;
+  const started = new Promise<void>((resolve) => {
+    policyStarted = resolve;
+  });
+  const resume = new Promise<void>((resolve) => {
+    resumePolicy = resolve;
+  });
+  const telemetry = telemetryRecorder();
+  const creation = createEnvironmentApiKey(
+    {
+      environmentId: environment.id,
+      taskEnvironmentId: environment.id,
+      userId: user.id,
+      name: "Racing removal",
+      presetId: "FULL_ACCESS",
+    },
+    {
+      prismaClient: prisma,
+      telemetryRecorder: telemetry,
+      rbacController: {
+        async prepareApiKeyPolicy(input) {
+          policyStarted();
+          await resume;
+          return fallback.prepareApiKeyPolicy(input);
+        },
+      },
+    }
+  );
+  const rejected = expect(creation).rejects.toThrow("Environment not found");
+  await started;
+  try {
+    await removeTeamMember(
+      { userId: admin.id, slug: organization.slug, memberId: orgMember.id },
+      prisma
+    );
+  } finally {
+    resumePolicy();
+  }
+  await rejected;
+  expect(telemetry.recordOperation).toHaveBeenCalledWith(
+    "create",
+    "rejected",
+    "membership_removed"
+  );
+  expect(telemetry.recordOperation).not.toHaveBeenCalledWith("create", "error", "database_error");
+  await expect(
+    prisma.apiKey.findFirst({ where: { runtimeEnvironmentId: environment.id, revokedAt: null } })
+  ).resolves.toBeNull();
+});
+
 containerTest("records successful API key revocation", async ({ prisma }) => {
   const { user, environment } = await setup(prisma);
   const apiKey = await prisma.apiKey.create({
 
@@ -1,6 +1,6 @@
 import { randomBytes } from "node:crypto";
 import { beforeEach, describe, expect, vi } from "vitest";
-import type { PrismaClient } from "@trigger.dev/database";
+import type { PrismaClient, PrismaTransactionClient } from "@trigger.dev/database";
 
 const prismaHolder = vi.hoisted(() => ({
   client: null as PrismaClient | null,
@@ -37,6 +37,11 @@ vi.mock("~/db.server", async () => {
 
   return {
     Prisma,
+    $transaction: (
+      client: PrismaClient,
+      _name: string,
+      callback: (tx: PrismaTransactionClient) => Promise<unknown>
+    ) => client.$transaction(callback),
     get prisma() {
       if (!prismaHolder.client) {
         throw new Error("test prisma not set");
 
@@ -2,6 +2,9 @@ import { containerTest } from "@internal/testcontainers";
 import type { PrismaClient } from "@trigger.dev/database";
 import { describe, expect, vi } from "vitest";
 import { removeTeamMember } from "~/models/removeTeamMember.server";
+import rbacLoader from "@trigger.dev/rbac";
+import { generateAdditionalApiKey } from "~/utils/apiKeys";
+import { createRuntimeEnvironment, uniqueId } from "./fixtures/environmentVariablesFixtures";
 
 vi.setConfig({ testTimeout: 60_000 });
 
@@ -36,6 +39,59 @@ async function seedOrgWithMembers(prisma: PrismaClient, slugBase: string) {
 }
 
 describe("removeTeamMember", () => {
+  containerTest(
+    "rotates the removed member's root key and revokes additional development keys",
+    async ({ prisma }) => {
+      const a = await seedOrgWithMembers(prisma, "rotation");
+      const project = await prisma.project.create({
+        data: {
+          name: "Test project",
+          slug: uniqueId("project"),
+          externalRef: uniqueId("project-ref"),
+          organizationId: a.organization.id,
+        },
+      });
+      const environment = await createRuntimeEnvironment(prisma, {
+        projectId: project.id,
+        organizationId: a.organization.id,
+        orgMemberId: a.regularMember.id,
+        type: "DEVELOPMENT",
+      });
+      const additionalKey = generateAdditionalApiKey("DEVELOPMENT");
+      await prisma.apiKey.create({
+        data: {
+          name: "Development key",
+          runtimeEnvironmentId: environment.id,
+          keyHash: additionalKey.keyHash,
+          lastFour: additionalKey.lastFour,
+          scopes: ["admin"],
+        },
+      });
+      const controller = rbacLoader.create(prisma, { forceFallback: true });
+      const authenticate = (key: string) =>
+        controller.authenticateBearer(
+          new Request("https://example.com", {
+            headers: { Authorization: `Bearer ${key}` },
+          })
+        );
+      for (const key of [environment.apiKey, additionalKey.apiKey]) {
+        await expect(authenticate(key)).resolves.toMatchObject({ ok: true });
+      }
+
+      await removeTeamMember(
+        { userId: a.admin.id, slug: a.organization.slug, memberId: a.regularMember.id },
+        prisma
+      );
+
+      for (const key of [environment.apiKey, additionalKey.apiKey]) {
+        await expect(authenticate(key)).resolves.toMatchObject({ ok: false, status: 401 });
+      }
+      await expect(
+        prisma.runtimeEnvironment.findFirst({ where: { id: environment.id } })
+      ).resolves.toMatchObject({ id: environment.id, orgMemberId: null });
+    }
+  );
+
   containerTest(
     "refuses to delete an OrgMember that belongs to a different org",
     async ({ prisma }) => {