diff --git a/app/models/demo/data_cleaner.rb b/app/models/demo/data_cleaner.rb
index fbcf08e20..726ceb9e8 100644
--- a/app/models/demo/data_cleaner.rb
+++ b/app/models/demo/data_cleaner.rb
@@ -8,6 +8,9 @@ class Demo::DataCleaner
 
   # Main entry point for destroying all demo data
   def destroy_everything!
+    # Clear SSO audit logs first (they reference users)
+    SsoAuditLog.destroy_all
+
     Family.destroy_all
     Setting.destroy_all
     InviteCode.destroy_all
diff --git a/app/models/user.rb b/app/models/user.rb
index 569cafd2b..c38debf17 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -13,6 +13,7 @@ class User < ApplicationRecord
   has_many :impersonator_support_sessions, class_name: "ImpersonationSession", foreign_key: :impersonator_id, dependent: :destroy
   has_many :impersonated_support_sessions, class_name: "ImpersonationSession", foreign_key: :impersonated_id, dependent: :destroy
   has_many :oidc_identities, dependent: :destroy
+  has_many :sso_audit_logs, dependent: :nullify
   accepts_nested_attributes_for :family, update_only: true
 
   validates :email, presence: true, uniqueness: true, format: { with: URI::MailTo::EMAIL_REGEXP }