diff --git a/cli/start.go b/cli/start.go
index e4e2bd40f3..7949f30871 100644
--- a/cli/start.go
+++ b/cli/start.go
@@ -120,7 +120,7 @@ func (r *RootCmd) start() *serpent.Command {
 func buildWorkspaceStartRequest(inv *serpent.Invocation, client *codersdk.Client, workspace codersdk.Workspace, parameterFlags workspaceParameterFlags, buildFlags buildFlags, action WorkspaceCLIAction) (codersdk.CreateWorkspaceBuildRequest, error) {
 	version := workspace.LatestBuild.TemplateVersionID
 
-	if workspace.AutomaticUpdates == codersdk.AutomaticUpdatesAlways || action == WorkspaceUpdate {
+	if workspace.AutomaticUpdates == codersdk.AutomaticUpdatesAlways || workspace.TemplateRequireActiveVersion || action == WorkspaceUpdate {
 		version = workspace.TemplateActiveVersionID
 		if version != workspace.LatestBuild.TemplateVersionID {
 			action = WorkspaceUpdate
diff --git a/enterprise/cli/start_test.go b/enterprise/cli/start_test.go
index 2ef3b8cd80..3dfd277e3c 100644
--- a/enterprise/cli/start_test.go
+++ b/enterprise/cli/start_test.go
@@ -86,30 +86,32 @@ func TestStart(t *testing.T) {
 			ExpectedVersion uuid.UUID
 		}
 
+		// All users should be updated to the active version when
+		// require_active_version is set, matching web UI behavior.
 		cases := []testcase{
 			{
-				Name:            "OwnerUnchanged",
+				Name:            "OwnerUpdates",
 				Client:          ownerClient,
 				WorkspaceOwner:  owner.UserID,
-				ExpectedVersion: oldVersion.ID,
+				ExpectedVersion: activeVersion.ID,
 			},
 			{
-				Name:            "TemplateAdminUnchanged",
+				Name:            "TemplateAdminUpdates",
 				Client:          templateAdminClient,
 				WorkspaceOwner:  templateAdmin.ID,
-				ExpectedVersion: oldVersion.ID,
+				ExpectedVersion: activeVersion.ID,
 			},
 			{
-				Name:            "TemplateACLAdminUnchanged",
+				Name:            "TemplateACLAdminUpdates",
 				Client:          templateACLAdminClient,
 				WorkspaceOwner:  templateACLAdmin.ID,
-				ExpectedVersion: oldVersion.ID,
+				ExpectedVersion: activeVersion.ID,
 			},
 			{
-				Name:            "TemplateGroupACLAdminUnchanged",
+				Name:            "TemplateGroupACLAdminUpdates",
 				Client:          templateGroupACLAdminClient,
 				WorkspaceOwner:  templateGroupACLAdmin.ID,
-				ExpectedVersion: oldVersion.ID,
+				ExpectedVersion: activeVersion.ID,
 			},
 			{
 				Name:            "MemberUpdates",
@@ -156,16 +158,11 @@ func TestStart(t *testing.T) {
 
 						ws = coderdtest.MustWorkspace(t, c.Client, ws.ID)
 						require.Equal(t, c.ExpectedVersion, ws.LatestBuild.TemplateVersionID)
-						if initialTemplateVersion == ws.LatestBuild.TemplateVersionID {
-							return
-						}
-
-						if cmd == "start" {
-							require.Contains(t, buf.String(), "Unable to start the workspace with the template version from the last build")
-						}
-
-						if cmd == "restart" {
-							require.Contains(t, buf.String(), "Unable to restart the workspace with the template version from the last build")
+						// The CLI should proactively use the active version
+						// without hitting the 403→retry path.
+						if initialTemplateVersion != ws.LatestBuild.TemplateVersionID {
+							require.NotContains(t, buf.String(), "Unable to start the workspace with the template version from the last build")
+							require.NotContains(t, buf.String(), "Unable to restart the workspace with the template version from the last build")
 						}
 					})
 				}