diff --git a/docs/source/reference/authenticators.md b/docs/source/reference/authenticators.md
index 34fb71c1..76656b14 100644
--- a/docs/source/reference/authenticators.md
+++ b/docs/source/reference/authenticators.md
@@ -345,7 +345,7 @@ can be loaded from role specifications returned by the {meth}`.Authenticator.loa
 
 The authenticator-manged roles and role assignment will be deleted after restart if:
 
-- {attr}`.Authenticator.reset_managed_roles_on_startup` is set to `True` (default), and
+- {attr}`.Authenticator.reset_managed_roles_on_startup` is set to `True`, and
 - the roles and role assignments are not included in the initial set of roles returned by the {meth}`.Authenticator.load_managed_roles()` method.
 
 ## pre_spawn_start and post_spawn_stop hooks
diff --git a/jupyterhub/auth.py b/jupyterhub/auth.py
index e851bd92..cb7fbda4 100644
--- a/jupyterhub/auth.py
+++ b/jupyterhub/auth.py
@@ -758,7 +758,7 @@ class Authenticator(LoggingConfigurable):
         """,
     )
     reset_managed_roles_on_startup = Bool(
-        True,
+        False,
         config=True,
         help="""Reset managed roles to result of `load_managed_roles()` on startup.