diff --git a/terraform/provider/CHANGELOG.md b/terraform/provider/CHANGELOG.md
index d8c53e1432c..b948db2b231 100644
--- a/terraform/provider/CHANGELOG.md
+++ b/terraform/provider/CHANGELOG.md
@@ -49,6 +49,7 @@ longer signal it.
 
 ### Fixed
 
+- **user**: `litellm_user` updates no longer send `blocked`, which `/user/update` writes into the user table where no such column exists, so every update failed with a 400 (`Could not find field at upsertOneLiteLLM_UserTable.create.blocked`). Create still sends `blocked`, including `false`, so a `default_internal_user_params.blocked` on the proxy cannot block the auto-created key. Changing `blocked` after creation has no effect, since the proxy has no user-level block; use `litellm_key_block` instead
 - **model**: `litellm_model` refresh now reads the `{"data": [...]}` envelope `/model/info` returns, so `model_info` fields changed outside Terraform show up as drift instead of silently keeping the previous state
 - **key**: An update that changes `team_id` and fails because the key was already cascade-deleted along with its previous team now recovers by recreating the key under the new team, instead of aborting the apply. The key's absence is confirmed against the proxy first, so an unrelated failure still errors out, and a `team_id` change between two teams that both still exist stays a plain in-place update
 - **credential**: create now reports a `credential_name` collision as a clear error naming the `terraform import` command that adopts the existing credential, instead of surfacing the proxy's raw 500 with a Prisma `Unique constraint failed` message. New `adopt_existing` argument (default `false`) opts into taking the existing credential over during create, which makes `apply` idempotent again once state loses track of a credential that still exists on the proxy. Requires a proxy that answers 409 on the collision; older proxies are still detected by their 500 message
diff --git a/terraform/provider/docs/resources/user.md b/terraform/provider/docs/resources/user.md
index 9b537292d54..19fa8b68f14 100644
--- a/terraform/provider/docs/resources/user.md
+++ b/terraform/provider/docs/resources/user.md
@@ -50,7 +50,7 @@ resource "litellm_user" "alice" {
 - `permissions` (Optional) - Map of permission values for the user
 - `model_max_budget` (Optional) - JSON string of per-model budget config, e.g. `jsonencode({"gpt-4o" = {max_budget = 10.0}})`
 - `guardrails` (Optional) - List of guardrails applied to the user's requests
-- `blocked` (Optional, Default `false`) - Whether the user is blocked from making requests
+- `blocked` (Optional, Default `false`) - Whether to block the key auto-created with the user. Only sent on creation, so changing it afterwards has no effect. The proxy has no user-level block; use `litellm_key_block` to block keys
 
 ## Attribute Reference
 
diff --git a/terraform/provider/litellm/resource_user.go b/terraform/provider/litellm/resource_user.go
index c1aa9d7e9fa..76420d1f9bf 100644
--- a/terraform/provider/litellm/resource_user.go
+++ b/terraform/provider/litellm/resource_user.go
@@ -164,7 +164,7 @@ func resourceLiteLLMUser() *schema.Resource {
 				Type:        schema.TypeBool,
 				Optional:    true,
 				Default:     false,
-				Description: "Whether the user is blocked from making requests",
+				Description: "Whether to block the key auto-created with the user. Only sent on creation; use litellm_key_block to change it afterwards",
 			},
 			"key": {
 				Type:        schema.TypeString,
@@ -195,6 +195,7 @@ func resourceLiteLLMUserCreate(d *schema.ResourceData, m interface{}) error {
 	}
 	userData["auto_create_key"] = d.Get("auto_create_key").(bool)
 	userData["send_invite_email"] = d.Get("send_invite_email").(bool)
+	userData["blocked"] = d.Get("blocked").(bool)
 
 	log.Printf("[DEBUG] Create user request payload: %+v", userData)
 
@@ -337,9 +338,7 @@ func resourceLiteLLMUserDelete(d *schema.ResourceData, m interface{}) error {
 }
 
 func buildUserData(d *schema.ResourceData) map[string]interface{} {
-	userData := map[string]interface{}{
-		"blocked": d.Get("blocked").(bool),
-	}
+	userData := map[string]interface{}{}
 
 	for _, key := range []string{
 		"user_email", "user_alias", "user_role", "teams", "models", "max_budget",
diff --git a/terraform/provider/litellm/resource_user_test.go b/terraform/provider/litellm/resource_user_test.go
index c254c0c5929..046cef91954 100644
--- a/terraform/provider/litellm/resource_user_test.go
+++ b/terraform/provider/litellm/resource_user_test.go
@@ -239,3 +239,81 @@ func TestResourceUserDelete_SendsUserIDs(t *testing.T) {
 		t.Fatalf("expected ID to be cleared after delete, got %q", d.Id())
 	}
 }
+
+func TestResourceUserUpdate_NeverSendsBlocked(t *testing.T) {
+	for name, config := range map[string]map[string]interface{}{
+		"unset": {"user_role": "internal_user"},
+		"true":  {"user_role": "internal_user", "blocked": true},
+		"false": {"user_role": "internal_user", "blocked": false},
+	} {
+		t.Run(name, func(t *testing.T) {
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch r.URL.Path {
+				case "/user/update":
+					var payload map[string]interface{}
+					if err := json.NewDecoder(r.Body).Decode(&payload); err != nil {
+						t.Fatalf("failed to decode update payload: %v", err)
+					}
+					if _, ok := payload["blocked"]; ok {
+						w.WriteHeader(http.StatusBadRequest)
+						w.Write([]byte(`{"error": "Could not find field at upsertOneLiteLLM_UserTable.create.blocked"}`))
+						return
+					}
+					w.Write([]byte(`{"user_id": "u-7"}`))
+				case "/user/info":
+					w.Write(userInfoBody("u-7", map[string]interface{}{"user_role": "internal_user"}))
+				default:
+					t.Errorf("unexpected request to %s", r.URL.Path)
+					w.WriteHeader(http.StatusNotFound)
+				}
+			}))
+			defer srv.Close()
+
+			d := schema.TestResourceDataRaw(t, resourceLiteLLMUser().Schema, config)
+			d.SetId("u-7")
+
+			if err := resourceLiteLLMUserUpdate(d, NewClient(srv.URL, "test-key", true)); err != nil {
+				t.Fatalf("update failed: %v", err)
+			}
+		})
+	}
+}
+
+func TestResourceUserCreate_AlwaysSendsBlocked(t *testing.T) {
+	for name, tc := range map[string]struct {
+		config      map[string]interface{}
+		wantBlocked interface{}
+	}{
+		"unset": {config: map[string]interface{}{}, wantBlocked: false},
+		"false": {config: map[string]interface{}{"blocked": false}, wantBlocked: false},
+		"true":  {config: map[string]interface{}{"blocked": true}, wantBlocked: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			var createPayload map[string]interface{}
+			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch r.URL.Path {
+				case "/user/new":
+					if err := json.NewDecoder(r.Body).Decode(&createPayload); err != nil {
+						t.Fatalf("failed to decode create payload: %v", err)
+					}
+					w.Write([]byte(`{"user_id": "u-1", "key": "sk-generated"}`))
+				case "/user/info":
+					w.Write(userInfoBody("u-1", map[string]interface{}{"user_role": "internal_user"}))
+				default:
+					t.Errorf("unexpected request to %s", r.URL.Path)
+					w.WriteHeader(http.StatusNotFound)
+				}
+			}))
+			defer srv.Close()
+
+			d := schema.TestResourceDataRaw(t, resourceLiteLLMUser().Schema, tc.config)
+
+			if err := resourceLiteLLMUserCreate(d, NewClient(srv.URL, "test-key", true)); err != nil {
+				t.Fatalf("create failed: %v", err)
+			}
+			if got := createPayload["blocked"]; got != tc.wantBlocked {
+				t.Errorf("expected blocked %v in create payload, got %v", tc.wantBlocked, got)
+			}
+		})
+	}
+}