diff --git a/backend/src/config.rs b/backend/src/config.rs
index e62986e..39b6dc8 100644
--- a/backend/src/config.rs
+++ b/backend/src/config.rs
@@ -54,8 +54,6 @@ pub struct AppConfig {
     pub quickwit_endpoint: Option<String>,
     #[serde(default)]
     pub quickwit_index: Option<String>,
-    #[serde(default = "default_tenant_name")]
-    pub default_tenant_name: String,
     #[serde(default = "default_worker_max_document_bytes")]
     pub worker_max_document_bytes: u64,
     #[serde(default)]
@@ -171,10 +169,6 @@ fn default_aws_region() -> String {
     "us-east-1".to_string()
 }
 
-fn default_tenant_name() -> String {
-    "admin".to_string()
-}
-
 fn default_worker_max_document_bytes() -> u64 {
     200 * 1024 * 1024
 }
diff --git a/backend/src/tenants.rs b/backend/src/tenants.rs
index edd107a..c756cd3 100644
--- a/backend/src/tenants.rs
+++ b/backend/src/tenants.rs
@@ -1,4 +1,3 @@
-use axum::{async_trait, extract::FromRequestParts, http::request::Parts};
 use diesel::{
     dsl::{exists, select},
     pg::PgConnection,
@@ -14,7 +13,6 @@ use crate::{
     jobs::{enqueue_job, JOB_PROVISION_TENANT},
     models::{Tenant, TenantStatus},
     schema::tenants::dsl,
-    state::AppState,
 };
 
 pub struct TenantRepository;
@@ -136,25 +134,6 @@ pub fn apply_tenant_guc(conn: &mut PgConnection, tenant_id: Uuid) -> AppResult<(
         .map_err(AppError::from)
 }
 
-pub struct TenantContext {
-    pub tenant: Tenant,
-}
-
-#[async_trait]
-impl FromRequestParts<AppState> for TenantContext {
-    type Rejection = AppError;
-
-    async fn from_request_parts(
-        _parts: &mut Parts,
-        state: &AppState,
-    ) -> Result<Self, Self::Rejection> {
-        let tenant = state
-            .tenants
-            .get_by_name(&state.config.default_tenant_name)?;
-        Ok(Self { tenant })
-    }
-}
-
 fn normalize_storage_root(raw: Option<&str>, tenant_id: Uuid) -> String {
     match raw.map(str::trim) {
         Some(root) if !root.is_empty() => {
diff --git a/backend/tests/common/mod.rs b/backend/tests/common/mod.rs
index 4db13f8..1f19efc 100644
--- a/backend/tests/common/mod.rs
+++ b/backend/tests/common/mod.rs
@@ -33,6 +33,8 @@ const MIGRATIONS: EmbeddedMigrations = embed_migrations!("migrations");
 
 static DB_LOCK: Lazy<Mutex<()>> = Lazy::new(|| Mutex::new(()));
 
+const TEST_TENANT_NAME: &str = "test_tenant";
+
 #[allow(dead_code)]
 #[derive(Clone)]
 pub struct StoredObject {
@@ -140,7 +142,6 @@ impl TestApp {
             s3_bucket: "test-bucket".to_string(),
             quickwit_endpoint: None,
             quickwit_index: None,
-            default_tenant_name: "admin".to_string(),
             worker_max_document_bytes: 200 * 1024 * 1024,
             webauthn_rp_id: Some("localhost".to_string()),
             webauthn_origin: Some("http://localhost".to_string()),
@@ -190,10 +191,11 @@ impl TestApp {
 
     #[allow(dead_code)]
     pub async fn storage_key_for(&self, key: &str) -> Result<String> {
+        self.ensure_default_tenant().await?;
         let tenant = self
             .state
             .tenants
-            .get_by_name(&self.state.config.default_tenant_name)
+            .get_by_name(TEST_TENANT_NAME)
             .map_err(|err| anyhow!("default tenant not found: {:?}", err))?;
         let root = tenant
             .storage_root
@@ -205,11 +207,7 @@ impl TestApp {
     pub async fn insert_user(&self, username: &str, password: &str, _role: &str) -> Result<Uuid> {
         let username = username.to_string();
         let password = password.to_string();
-        let tenant_id = self
-            .state
-            .tenants
-            .tenant_id_for_name(&self.state.config.default_tenant_name)
-            .map_err(|err| anyhow!("default tenant not found: {:?}", err))?;
+        let tenant_id = self.ensure_default_tenant().await?;
         self.with_conn(move |conn| {
             let password_hash = hash_password(&password)?;
             let user = NewUser {
@@ -264,7 +262,7 @@ impl TestApp {
     }
 
     async fn ensure_default_tenant(&self) -> Result<Uuid> {
-        let name_value = self.state.config.default_tenant_name.clone();
+        let name_value = TEST_TENANT_NAME.to_string();
         let quickwit_enabled = self.state.config.quickwit_endpoint.is_some();
         self.with_conn(move |conn| {
             use backend::schema::tenants::dsl as tenants_dsl;
diff --git a/docker-compose.test.yml b/docker-compose.test.yml
index d9cd0f4..6bbde16 100644
--- a/docker-compose.test.yml
+++ b/docker-compose.test.yml
@@ -45,7 +45,6 @@ services:
       S3_BUCKET: documents
       JWT_SECRET: change-me-super-secret
       QUICKWIT_ENDPOINT: http://quickwit-test:7280
-      DEFAULT_TENANT_SLUG: admin
     entrypoint: []
     command: >
       /bin/sh -c "
diff --git a/docker-compose.yml b/docker-compose.yml
index 29bb5f8..9b2d399 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -80,7 +80,6 @@ services:
       S3_BUCKET: documents
       JWT_SECRET: change-me-super-secret
       QUICKWIT_ENDPOINT: http://quickwit:7280
-      DEFAULT_TENANT_SLUG: admin
     entrypoint: []
     command: >
       /bin/sh -c "
diff --git a/frontend/src/index.jsx b/frontend/src/index.jsx
index b5eff7b..5b76c66 100644
--- a/frontend/src/index.jsx
+++ b/frontend/src/index.jsx
@@ -925,12 +925,19 @@ const AppLayout = () => {
         .map((doc) => resolveDocumentRowKey(doc.id))
         .filter(Boolean);
       const availableDocKeySet = new Set(availableDocKeys);
+      const availableFolderKeys = new Set(
+        subfolders
+          .map((folder) => resolveFolderRowKey(folder.id))
+          .filter(Boolean),
+      );
 
       let nextDocKeys = [];
       let mergedSelection = [];
 
       setSelectedRowKeys((previous) => {
-        const previousFolderKeys = previous.filter(isFolderRowKey);
+        const previousFolderKeys = previous
+          .filter(isFolderRowKey)
+          .filter((key) => availableFolderKeys.has(key));
         const previousDocKeys = previous.filter(isDocumentRowKey);
 
         if (selectionInitializedRef.current) {