diff --git a/server/src/services/adminService.ts b/server/src/services/adminService.ts
index 44caf186d..92b16807a 100644
--- a/server/src/services/adminService.ts
+++ b/server/src/services/adminService.ts
@@ -2,7 +2,10 @@ import { ADDON_IDS } from '../addons';
 import { readEnv } from '../app-config';
 import { updateJwtSecret } from '../config';
 import { db } from '../db/database';
-import { revokeUserSessions, revokeUserSessionsForClient } from '../mcp';
+// Import from sessionManager directly, NOT the ../mcp barrel: the barrel pulls
+// the whole tools fan-out (and via the domain bridges, the Nest services) into
+// every consumer of this module — a services→mcp→nest module cycle.
+import { revokeUserSessions, revokeUserSessionsForClient } from '../mcp/sessionManager';
 import { emitUserDeleted } from '../plugin-user-lifecycle';
 import { User, Addon } from '../types';
 import { maybe_encrypt_api_key, decrypt_api_key } from './apiKeyCrypto';
diff --git a/server/src/services/authService.ts b/server/src/services/authService.ts
index 1c9e59f19..10a2e79d4 100644
--- a/server/src/services/authService.ts
+++ b/server/src/services/authService.ts
@@ -14,7 +14,10 @@ import { encryptMfaSecret, decryptMfaSecret } from './mfaCrypto';
 import { getAllPermissions } from './permissions';
 import { decrypt_api_key, maybe_encrypt_api_key, encrypt_api_key } from './apiKeyCrypto';
 import { createEphemeralToken } from './ephemeralTokens';
-import { revokeUserSessions } from '../mcp';
+// Import from sessionManager directly, NOT the ../mcp barrel: the barrel pulls
+// the whole tools fan-out (and via the domain bridges, the Nest services) into
+// every consumer of this module — a services→mcp→nest module cycle.
+import { revokeUserSessions } from '../mcp/sessionManager';
 import { startTripReminders } from '../scheduler';
 import { deleteUserCompletely } from './userCleanupService';
 import { emitUserDeleted } from '../plugin-user-lifecycle';