Disable Account Management but allow password reset by admin

I’d like to disable the Account Management Console for users so that they can’t update their own details. I’ve tried to do so by disabling the “account” client, but unfortunately this means admin users are unable to send password reset emails or email verification emails from the Credential Reset section of user management (Users > Credentials tab > Credential Reset).

I can see in org.keycloak.services.resources.admin.UserResource.executeActionsEmail that client id is set by default to ACCOUNT_MANAGEMENT_CLIENT_ID.

I’m inclined to think that this is a bug as the “account” client is for the self-service account console for end users, and disabling it should not prevent admin users from applying credential reset actions.