diff --git a/apps/api/src/services/userService.js b/apps/api/src/services/userService.js
index 187ede1cb4..f3362107b6 100644
--- a/apps/api/src/services/userService.js
+++ b/apps/api/src/services/userService.js
@@ -5,7 +5,7 @@ export async function listUsers() {
 }
 
 export async function createUser(payload) {
-  const user = { id: `usr_${Date.now()}`, ...payload };
+  const user = { id: `usr_${Date.now()}`, ...payload, createdAt: new Date().toISOString() };
   users.push(user);
   return user;
 }
diff --git a/apps/api/src/tests/userService.test.js b/apps/api/src/tests/userService.test.js
new file mode 100644
index 0000000000..a6fce92d0a
--- /dev/null
+++ b/apps/api/src/tests/userService.test.js
@@ -0,0 +1,25 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createUser, listUsers } from "../services/userService.js";
+
+test("createUser adds a server-owned createdAt timestamp", async () => {
+  const beforeCreate = Date.now();
+  const user = await createUser({
+    email: "created-at-user@example.com",
+    fullName: "Created At User",
+    role: "client",
+    createdAt: "2000-01-01T00:00:00.000Z"
+  });
+  const afterCreate = Date.now();
+
+  assert.equal(typeof user.createdAt, "string");
+
+  const createdAtTime = Date.parse(user.createdAt);
+  assert.ok(Number.isFinite(createdAtTime));
+  assert.ok(createdAtTime >= beforeCreate);
+  assert.ok(createdAtTime <= afterCreate);
+  assert.notEqual(user.createdAt, "2000-01-01T00:00:00.000Z");
+
+  const users = await listUsers();
+  assert.equal(users.at(-1).createdAt, user.createdAt);
+});