diff --git a/extensions/graph/pkg/middleware/auth.go b/extensions/graph/pkg/middleware/auth.go
index 8d64b70f2ad..98117b32b36 100644
--- a/extensions/graph/pkg/middleware/auth.go
+++ b/extensions/graph/pkg/middleware/auth.go
@@ -74,10 +74,8 @@ func Auth(opts ...account.Option) func(http.Handler) http.Handler {
 			ctx = revactx.ContextSetToken(ctx, t)
 			ctx = revactx.ContextSetUser(ctx, u)
 			ctx = gmmetadata.Set(ctx, opkgm.AccountID, u.Id.OpaqueId)
-			if u.Opaque != nil {
-				if roles, ok := u.Opaque.Map["roles"]; ok {
-					ctx = gmmetadata.Set(ctx, opkgm.RoleIDs, string(roles.Value))
-				}
+			if role := utils.ReadPlainFromOpaque(ctx, u.Opaque, "roles"); role != "" {
+				ctx = gmmetadata.Set(ctx, opkgm.RoleIDs, role)
 			}
 			ctx = metadata.AppendToOutgoingContext(ctx, revactx.TokenHeader, t)