diff --git a/src/admin.ts b/src/admin.ts
index 381484d..8d22421 100644
--- a/src/admin.ts
+++ b/src/admin.ts
@@ -358,7 +358,7 @@ export class AuthorizerAdmin {
       params as unknown as Record<string, unknown>,
     );
 
-  // deleteUser deletes a user (and associated OTP/verification data) by email.
+  // deleteUser deletes a user (and associated OTP/verification data) by id.
   // DESTRUCTIVE: the user and their auth artifacts are permanently removed.
   deleteUser = (
     params: Types.DeleteUserRequest,
diff --git a/src/types.ts b/src/types.ts
index 04d3173..888cb3e 100644
--- a/src/types.ts
+++ b/src/types.ts
@@ -372,8 +372,12 @@ export interface ResetPasswordRequest {
 export type ResetPasswordInput = ResetPasswordRequest;
 
 // DeleteUserRequest (admin only)
+//
+// BREAKING (server 2.4.0): this took `email` and now takes `id`. Email is not
+// an identifier every account has — a phone-only signup has none — so an
+// email-keyed delete could not reach those accounts at all.
 export interface DeleteUserRequest {
-  email: string;
+  id: string;
 }
 
 // Fine-grained authorization (FGA) types — the client-facing surface of