diff --git a/app/controllers/api/v1/enforce-paid-plan.js b/app/controllers/api/v1/enforce-paid-plan.js
index c23404b2c..4795278df 100644
--- a/app/controllers/api/v1/enforce-paid-plan.js
+++ b/app/controllers/api/v1/enforce-paid-plan.js
@@ -9,6 +9,10 @@ async function enforcePaidPlan(ctx, next) {
   if (!ctx.isAuthenticated())
     return ctx.throw(Boom.unauthorized(ctx.translateError('LOGIN_REQUIRED')));
 
+  // if the user is a member of a team plan and in the admin group, continue
+  if (ctx.state.domain.group === 'admin' && ctx.state.domain.plan === 'team')
+    return next();
+
   if (ctx.state.user.plan === 'free')
     return ctx.throw(
       Boom.paymentRequired(
diff --git a/app/controllers/web/my-account/ensure-upgraded-plan.js b/app/controllers/web/my-account/ensure-upgraded-plan.js
index 827670637..43413359f 100644
--- a/app/controllers/web/my-account/ensure-upgraded-plan.js
+++ b/app/controllers/web/my-account/ensure-upgraded-plan.js
@@ -15,7 +15,11 @@ function ensureUpgradedPlan(ctx, next) {
   )
     return next();
 
-  if (!ctx.state.domain && ctx.state.user.plan !== 'free') return next();
+  if (
+    (!ctx.state.domain && ctx.state.user.plan !== 'free') ||
+    ctx.state?.domain?.plan === 'team'
+  )
+    return next();
 
   const redirectTo = ctx.state.domain
     ? ctx.state.l(
diff --git a/app/controllers/web/my-account/retrieve-aliases.js b/app/controllers/web/my-account/retrieve-aliases.js
index 4b73b404c..092351fcf 100644
--- a/app/controllers/web/my-account/retrieve-aliases.js
+++ b/app/controllers/web/my-account/retrieve-aliases.js
@@ -162,7 +162,7 @@ async function retrieveAliases(ctx, next) {
         ? // eslint-disable-next-line unicorn/no-array-callback-reference
           Aliases.find(query)
             .limit(ctx.query.limit)
-            .skip(ctx.paginate.skip)
+            .skip(ctx.paginate?.skip)
             .sort(isSANB(ctx.query.sort) ? ctx.query.sort : 'created_at')
             .populate(
               'user',
diff --git a/routes/api/v1/index.js b/routes/api/v1/index.js
index b57508934..56e362f8d 100644
--- a/routes/api/v1/index.js
+++ b/routes/api/v1/index.js
@@ -168,7 +168,6 @@ router
     policies.ensureApiToken,
     policies.checkVerifiedEmail,
     web.myAccount.ensureNotBanned,
-    api.v1.enforcePaidPlan,
     web.myAccount.ensurePaidToDate,
     (ctx, next) => {
       //
@@ -200,34 +199,37 @@ router
     '/domains',
     web.myAccount.validateDomain,
     rateLimit(50, 'create domain'),
+    api.v1.enforcePaidPlan,
     web.myAccount.createDomain,
     api.v1.domains.retrieve
   )
   .get(
     '/domains/:domain_id',
     web.myAccount.retrieveDomain,
+    api.v1.enforcePaidPlan,
     api.v1.domains.retrieve
   )
   .get(
     '/domains/:domain_id/verify-records',
     web.myAccount.retrieveDomain,
+    api.v1.enforcePaidPlan,
     web.myAccount.verifyRecords
   )
   .put(
     '/domains/:domain_id',
     web.myAccount.retrieveDomain,
     web.myAccount.ensureDomainAdmin,
+    api.v1.enforcePaidPlan,
     web.myAccount.ensureUpgradedPlan,
     web.myAccount.updateDomain,
-    web.myAccount.retrieveDomains,
     api.v1.domains.retrieve
   )
   .delete(
     '/domains/:domain_id',
     web.myAccount.retrieveDomain,
     web.myAccount.ensureDomainAdmin,
+    api.v1.enforcePaidPlan,
     web.myAccount.removeDomain,
-    web.myAccount.retrieveDomains,
     api.v1.domains.retrieve
   )
 
@@ -238,10 +240,10 @@ router
     web.myAccount.retrieveDomain,
     web.myAccount.ensureDomainAdmin,
     web.myAccount.ensureTeamPlan,
+    api.v1.enforcePaidPlan,
     web.myAccount.ensureUpgradedPlan,
     rateLimit(10, 'create invite'),
     web.myAccount.createInvite,
-    web.myAccount.retrieveDomains,
     web.myAccount.retrieveDomain,
     api.v1.domains.retrieve
   )
@@ -250,9 +252,9 @@ router
     web.myAccount.retrieveDomain,
     web.myAccount.ensureDomainAdmin,
     web.myAccount.ensureTeamPlan,
+    api.v1.enforcePaidPlan,
     web.myAccount.ensureUpgradedPlan,
     web.myAccount.removeInvite,
-    web.myAccount.retrieveDomains,
     web.myAccount.retrieveDomain,
     api.v1.domains.retrieve
   )
@@ -264,9 +266,9 @@ router
     web.myAccount.ensureDomainAdmin,
     web.myAccount.ensureTeamPlan,
     web.myAccount.ensureUpgradedPlan,
+    api.v1.enforcePaidPlan,
     web.myAccount.retrieveAliases,
     web.myAccount.updateMember,
-    web.myAccount.retrieveDomains,
     web.myAccount.retrieveDomain,
     api.v1.domains.retrieve
   )
@@ -276,9 +278,9 @@ router
     web.myAccount.ensureDomainAdmin,
     web.myAccount.ensureTeamPlan,
     web.myAccount.ensureUpgradedPlan,
+    api.v1.enforcePaidPlan,
     web.myAccount.retrieveAliases,
     web.myAccount.removeMember,
-    web.myAccount.retrieveDomains,
     web.myAccount.retrieveDomain,
     api.v1.domains.retrieve
   );