Username generation for pending worker converted to employee

Summary:

Below is the current setup of our User Name Generation Rule:

Currently, pending workers are completing their pre-onboarding tasks using the account created with firstname.lastname as user name. Once they are converted to employee, the username is not updated to their work email address. Their usernames have to be updated manually with their email address.

How are you handling this without manually updating the usernames in the Security Console? Is there a way that they get their emails are username automatically upon conversion to employee

Or is there a different, much better approach to do this?

Thanks.

Content (please ensure you mask any confidential information):