diff --git a/lib/livebook/teams.ex b/lib/livebook/teams.ex
index ab82bb4a1..717903dd3 100644
--- a/lib/livebook/teams.ex
+++ b/lib/livebook/teams.ex
@@ -258,6 +258,9 @@ defmodule Livebook.Teams do
         })
 
       {:ok, hub}
+    else
+      {:error, %{"errors" => %{"detail" => error_message}}} -> {:error, error_message}
+      api_result -> api_result
     end
   end
 
diff --git a/lib/livebook/teams/requests.ex b/lib/livebook/teams/requests.ex
index 121911155..b2ceb9031 100644
--- a/lib/livebook/teams/requests.ex
+++ b/lib/livebook/teams/requests.ex
@@ -346,7 +346,7 @@ defmodule Livebook.Teams.Requests do
       {:ok, %{status: status} = response} when status in 200..299 ->
         {:ok, response.body}
 
-      {:ok, %{status: status} = response} when status in [410, 422] ->
+      {:ok, %{status: status} = response} when status in [403, 410, 422] ->
         return_error(response)
 
       {:ok, %{status: 401, private: %{livebook_app_deployment: true}}} ->
diff --git a/lib/livebook_cli/deploy.ex b/lib/livebook_cli/deploy.ex
index 80bcfa347..d28845c3e 100644
--- a/lib/livebook_cli/deploy.ex
+++ b/lib/livebook_cli/deploy.ex
@@ -121,9 +121,14 @@ defmodule LivebookCLI.Deploy do
     log_debug("Authenticating CLI...")
 
     case Teams.fetch_cli_session(config) do
-      {:ok, team} -> team
-      {:error, error} -> raise LivebookCLI.Error, error
-      {:transport_error, error} -> raise LivebookCLI.Error, error
+      {:ok, team} ->
+        team
+
+      {:error, error} ->
+        raise LivebookCLI.Error, error
+
+      {:transport_error, error} ->
+        raise LivebookCLI.Error, error
     end
   end
 
diff --git a/test/livebook_teams/cli/deploy_test.exs b/test/livebook_teams/cli/deploy_test.exs
index 181bbf088..85c7536a8 100644
--- a/test/livebook_teams/cli/deploy_test.exs
+++ b/test/livebook_teams/cli/deploy_test.exs
@@ -376,6 +376,44 @@ defmodule LivebookCLI.Integration.DeployTest do
       assert output =~
                "Deployment for notebook #{invalid_app_filename} failed"
     end
+
+    test "fails when org does not have an active subscription",
+         %{team: team, node: node, org: org, tmp_dir: tmp_dir} do
+      {key, _} = TeamsRPC.create_org_token(node, org: org)
+      deployment_group = TeamsRPC.create_deployment_group(node, org: org, url: @url)
+
+      hub_id = team.id
+      app_path = Path.join(tmp_dir, "some-slug.livemd")
+
+      stamp_notebook(app_path, """
+      <!-- livebook:{"app_settings":{"access_type":"public","slug":"some-slug"},"hub_id":"#{hub_id}"} -->
+
+      # Some title
+
+      ## Section name
+
+      ```elixir
+      IO.puts("Hello from CLI deployed app!")
+      ```
+      """)
+
+      TeamsRPC.update_org(node, org, %{
+        trial_ends_on: Date.add(Date.utc_today(), -1)
+      })
+
+      TeamsRPC.delete_subscription(node, org)
+
+      ExUnit.CaptureIO.capture_io(fn ->
+        assert_raise(LivebookCLI.Error, ~r/Teams subscription not active/s, fn ->
+          deploy(
+            key,
+            team.teams_key,
+            deployment_group.id,
+            app_path
+          )
+        end)
+      end)
+    end
   end
 
   defp deploy(org_token, teams_key, deployment_group_id, path) do
diff --git a/test/support/integration/teams_rpc.ex b/test/support/integration/teams_rpc.ex
index d6e5dc136..cc16b59ba 100644
--- a/test/support/integration/teams_rpc.ex
+++ b/test/support/integration/teams_rpc.ex
@@ -59,6 +59,14 @@ defmodule Livebook.TeamsRPC do
     :erpc.call(node, TeamsRPC, :create_org, [attrs])
   end
 
+  def update_org(node, org, attrs \\ []) do
+    :erpc.call(node, TeamsRPC, :update_org, [org, attrs])
+  end
+
+  def delete_subscription(node, org) do
+    :erpc.call(node, TeamsRPC, :delete_subscription, [org])
+  end
+
   def create_org_key(node, attrs \\ []) do
     :erpc.call(node, TeamsRPC, :create_org_key, [attrs])
   end