diff --git a/cdk/lib/constructs/auth/index.ts b/cdk/lib/constructs/auth/index.ts
index 925ad72..e82500c 100644
--- a/cdk/lib/constructs/auth/index.ts
+++ b/cdk/lib/constructs/auth/index.ts
@@ -69,7 +69,9 @@ export class Auth extends Construct {
         requireDigits: true,
         minLength: 8,
       },
-      selfSignUpEnabled: true,
+      // Set to true to allow self sign-up.
+      // When false, administrators must create users via the Cognito console or API.
+      selfSignUpEnabled: false,
       signInAliases: {
         username: false,
         email: true,
diff --git a/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit-without-domain.test.ts.snap b/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit-without-domain.test.ts.snap
index 7b58331..3d54c92 100644
--- a/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit-without-domain.test.ts.snap
+++ b/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit-without-domain.test.ts.snap
@@ -1158,7 +1158,7 @@ exports[`Snapshot test 2`] = `
           ],
         },
         "AdminCreateUserConfig": {
-          "AllowAdminCreateUserOnly": false,
+          "AllowAdminCreateUserOnly": true,
         },
         "AutoVerifiedAttributes": [
           "email",
diff --git a/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit.test.ts.snap b/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit.test.ts.snap
index d02589b..43325df 100644
--- a/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit.test.ts.snap
+++ b/cdk/test/__snapshots__/serverless-fullstack-webapp-starter-kit.test.ts.snap
@@ -1069,7 +1069,7 @@ exports[`Snapshot test 2`] = `
           ],
         },
         "AdminCreateUserConfig": {
-          "AllowAdminCreateUserOnly": false,
+          "AllowAdminCreateUserOnly": true,
         },
         "AutoVerifiedAttributes": [
           "email",