diff --git a/app/controllers/registrations_controller.rb b/app/controllers/registrations_controller.rb
index 05c0841d7..24a7a1efb 100644
--- a/app/controllers/registrations_controller.rb
+++ b/app/controllers/registrations_controller.rb
@@ -2,53 +2,40 @@ class RegistrationsController < Devise::RegistrationsController
   prepend_before_action :require_no_authentication, only: []
 
   def new
-    if user_signed_in?
-      redirect_to root_path(signin: "true")
-    else
-      if URI(request.referer || "").host == URI(request.base_url).host
-        store_location_for(:user, request.referer)
-      end
-      super
+    return redirect_to root_path(signin: "true") if user_signed_in?
+
+    if URI(request.referer || "").host == URI(request.base_url).host
+      store_location_for(:user, request.referer)
     end
+
+    super
   end
 
-  # rubocop:disable Metrics/CyclomaticComplexity
-  # rubocop:disable Metrics/PerceivedComplexity
   def create
-    not_authorized unless Settings::Authentication.allow_email_password_registration ||
-      Settings::General.waiting_on_first_user
-    not_authorized if Settings::General.waiting_on_first_user && ENV["FOREM_OWNER_SECRET"].present? &&
-      ENV["FOREM_OWNER_SECRET"] != params[:user][:forem_owner_secret]
+    authorize(params, policy_class: RegistrationPolicy)
 
     resolve_profile_field_issues
-    if !ReCaptcha::CheckRegistrationEnabled.call || recaptcha_verified?
-      build_resource(sign_up_params)
-      resource.saw_onboarding = false
-      resource.registered = true
-      resource.registered_at = Time.current
-      resource.editor_version = "v2"
-      resource.remote_profile_image_url = Users::ProfileImageGenerator.call if resource.remote_profile_image_url.blank?
-      check_allowed_email(resource) if resource.email.present?
-      resource.save if resource.email.present?
-      yield resource if block_given?
-      if resource.persisted?
-        update_first_user_permissions(resource)
-        if ForemInstance.smtp_enabled?
-          redirect_to confirm_email_path(email: resource.email)
-        else
-          sign_in(resource)
-          redirect_to root_path
-        end
+
+    unless recaptcha_verified?
+      flash[:notice] = "You must complete the recaptcha ✅"
+      return redirect_to new_user_registration_path(state: "email_signup")
+    end
+
+    build_devise_resource
+
+    if resource.persisted?
+      update_first_user_permissions(resource)
+
+      if ForemInstance.smtp_enabled?
+        redirect_to confirm_email_path(email: resource.email)
       else
-        render action: "by_email"
+        sign_in(resource)
+        redirect_to root_path
       end
     else
-      redirect_to new_user_registration_path(state: "email_signup")
-      flash[:notice] = "You must complete the recaptcha ✅"
+      render action: "by_email"
     end
   end
-  # rubocop:enable Metrics/CyclomaticComplexity
-  # rubocop:enable Metrics/PerceivedComplexity
 
   private
 
@@ -62,17 +49,12 @@ class RegistrationsController < Devise::RegistrationsController
   end
 
   def recaptcha_verified?
-    recaptcha_params = { secret_key: Settings::Authentication.recaptcha_secret_key }
-    params["g-recaptcha-response"] && verify_recaptcha(recaptcha_params)
-  end
-
-  def check_allowed_email(resource)
-    domain = resource.email.split("@").last
-    allow_list = Settings::Authentication.allowed_registration_email_domains
-    return if allow_list.empty? || allow_list.include?(domain)
-
-    resource.email = nil
-    resource.errors.add(:email, "is not included in allowed domains.")
+    if ReCaptcha::CheckRegistrationEnabled.call
+      recaptcha_params = { secret_key: Settings::Authentication.recaptcha_secret_key }
+      params["g-recaptcha-response"] && verify_recaptcha(recaptcha_params)
+    else
+      true
+    end
   end
 
   def resolve_profile_field_issues
@@ -84,4 +66,23 @@ class RegistrationsController < Devise::RegistrationsController
     csv = Rails.root.join("lib/data/dev_profile_fields.csv")
     ProfileFields::ImportFromCsv.call(csv)
   end
+
+  def check_allowed_email(resource)
+    domain = resource.email.split("@").last
+    allow_list = Settings::Authentication.allowed_registration_email_domains
+    return if allow_list.empty? || allow_list.include?(domain)
+
+    resource.email = nil
+    resource.errors.add(:email, "is not included in allowed domains.")
+  end
+
+  def build_devise_resource
+    build_resource(sign_up_params)
+    resource.saw_onboarding = false
+    resource.registered_at = Time.current
+    resource.editor_version = "v2"
+    resource.remote_profile_image_url = Users::ProfileImageGenerator.call if resource.remote_profile_image_url.blank?
+    check_allowed_email(resource) if resource.email.present?
+    resource.save if resource.email.present?
+  end
 end
diff --git a/app/policies/registration_policy.rb b/app/policies/registration_policy.rb
new file mode 100644
index 000000000..decd73b58
--- /dev/null
+++ b/app/policies/registration_policy.rb
@@ -0,0 +1,24 @@
+class RegistrationPolicy
+  def initialize(user, params)
+    @user = user
+    @params = params
+  end
+
+  def create?
+    email_registrable?
+  end
+
+  private
+
+  def email_registrable?
+    if Settings::General.waiting_on_first_user
+      if ENV["FOREM_OWNER_SECRET"].present?
+        ENV["FOREM_OWNER_SECRET"] == @params.dig(:user, :forem_owner_secret)
+      else
+        true
+      end
+    elsif Settings::Authentication.allow_email_password_registration
+      true
+    end
+  end
+end