diff --git a/federation/service/node.go b/federation/service/node.go
index 1a663f566..2e3cafc56 100644
--- a/federation/service/node.go
+++ b/federation/service/node.go
@@ -478,7 +478,7 @@ func (svc node) fetchFederatedUser(ctx context.Context, n *types.Node) (*sysType
 		AddFederationLabel(user, "federation", n.BaseURL)
 
 		// Create a user to service this node
-		r, err := service.DefaultRole.With(ctx).FindByName("federation")
+		r, err := service.DefaultRole.With(ctx).FindByHandle("federation")
 
 		if err != nil {
 			return nil, err
diff --git a/provision/000_base/roles.yaml b/provision/000_base/roles.yaml
index 4b8b76c9b..fe829e3cd 100644
--- a/provision/000_base/roles.yaml
+++ b/provision/000_base/roles.yaml
@@ -1,8 +1,10 @@
 roles:
-  # placeholder, everyone role is created programmatically
-  # with a fixed ID before configs are processed
-  - everyone
-  # placeholder, admin role is created programmatically
-  # with a fixed ID before configs are processed
-  - admins
-  - federation
+  # Placeholders for programmatically created roles.
+  # These are created in provision/roles.go
+  admins:
+    name: Administrators
+  everyone:
+    name: Everyone
+
+  federation:
+    name: Federation
diff --git a/tests/federation/node_pairing_test.go b/tests/federation/node_pairing_test.go
index d49a00086..726777ab0 100644
--- a/tests/federation/node_pairing_test.go
+++ b/tests/federation/node_pairing_test.go
@@ -43,8 +43,9 @@ func (h helper) prepareRBAC() {
 	h.allow("federation:node:*", rbac.Operation("manage"))
 
 	h.noError(service.DefaultStore.CreateRole(context.Background(), &st.Role{
-		ID:   h.roleID,
-		Name: "federation",
+		ID:     h.roleID,
+		Name:   "Federation",
+		Handle: "federation",
 	}))
 
 	h.noError(service.DefaultStore.CreateUser(context.Background(), h.cUser))