diff --git a/internal/app/teams.go b/internal/app/teams.go
index adc412f9..48217868 100644
--- a/internal/app/teams.go
+++ b/internal/app/teams.go
@@ -415,6 +415,9 @@ $ tea team edit acme/developers --name devs --description "Core developers"`,
 			if err != nil {
 				return err
 			}
+			if opts.Units != nil && !opts.ReplaceUnits && (team.Permission == "admin" || team.Permission == "owner") {
+				return clierr.Wrap(clierr.Usage, fmt.Errorf("--unit cannot restrict the %s access of team %s; pass --permission read or write, or --unit-replace", team.Permission, team.Slug()))
+			}
 			edited, err := service.Edit(cmd.Context(), team.ID, opts)
 			if err != nil {
 				return err
diff --git a/internal/services/teams.go b/internal/services/teams.go
index 3a4debf1..9be986fd 100644
--- a/internal/services/teams.go
+++ b/internal/services/teams.go
@@ -250,6 +250,10 @@ func (s Teams) Edit(ctx context.Context, id int64, opts TeamOptions) (Team, erro
 			opts.Units = current.Units
 		case !opts.ReplaceUnits:
 			units := maps.Clone(current.Units)
+			if len(units) == 0 && (current.Permission == "read" || current.Permission == "write") {
+				// The team grants its permission to every unit and has no unit policy yet.
+				units = UnitPolicy(current.Permission)
+			}
 			maps.Copy(units, opts.Units)
 			opts.Units = units
 		}