diff --git a/views/login.php b/views/login.php
index 532bede..6e16ae7 100644
--- a/views/login.php
+++ b/views/login.php
@@ -12,6 +12,7 @@
  */
 $bp = Auth::basePath();
 $auth = Auth::authUrl();
+$loginRedirect = $loginRedirect ?? '';
 ?>
 <!DOCTYPE html>
 <html lang="en" data-theme="dark">
@@ -44,6 +45,9 @@ $auth = Auth::authUrl();
     </label>
   </div>
   <form class="login-card" method="post" action="<?= h($auth) ?>/login">
+    <?php if ($loginRedirect !== ''): ?>
+      <input type="hidden" name="redirect" value="<?= h($loginRedirect) ?>">
+    <?php endif; ?>
     <h1><?= h(cfg('app_name')) ?></h1>
     <p class="muted" data-i18n="login.sign_in_hint">Sign in to view anonymous issue reports</p>
     <?php if (!empty($loginError)): ?>
@@ -52,8 +56,7 @@ $auth = Auth::authUrl();
     <label><span data-i18n="login.username">Username</span><input name="username" autocomplete="username" required></label>
     <label><span data-i18n="login.password">Password</span><input name="password" type="password" autocomplete="current-password" required></label>
     <button type="submit" data-i18n="login.submit">Sign in</button>
-    <p class="hint" data-i18n="login.hint_default">Default: admin / admin</p>
-    <p class="hint"><a href="<?= h($auth) ?>/register" data-i18n="login.register">Register</a></p>
+    <p class="hint"><a href="<?= h($auth) ?>/register" data-i18n="login.register">Create account</a></p>
   </form>
   <?php platform_render_footer(); ?>
 </body>
diff --git a/views/two_factor_approve.php b/views/two_factor_approve.php
index e3a35c0..e0bfc22 100644
--- a/views/two_factor_approve.php
+++ b/views/two_factor_approve.php
@@ -3,6 +3,7 @@ $bp   = Auth::basePath();
 $auth = Auth::authUrl();
 $user = Auth::user();
 $rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');
+$needsTotp = !$user && $approvalInfo && empty($approveResult);
 ?>
 <!DOCTYPE html>
 <html lang="en" data-theme="dark">
@@ -38,7 +39,7 @@ $rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');
         </p>
         <p class="muted">Your other device should now be logged in automatically.</p>
       <?php else: ?>
-        <p class="alert">This approval link has expired or is invalid.</p>
+        <p class="alert">Invalid or expired code. Open the QR link again from your desktop, or enter the current 6-digit authenticator code.</p>
       <?php endif; ?>
       <p style="margin-top:1.5rem;">
         <a href="<?= h($auth) ?>/" class="button">Back to hub</a>
@@ -48,13 +49,27 @@ $rawToken = trim($_GET['token'] ?? $_POST['token'] ?? '');
 
       <p style="font-size:1.1rem;font-weight:600;">Approve sign-in on another device?</p>
       <p class="muted">
-        Tap <b>Approve</b> to log in the browser that showed you this QR code.<br>
+        <?php if ($user): ?>
+          Tap <b>Approve</b> to log in the browser that showed you this QR code.<br>
+        <?php else: ?>
+          Enter the 6-digit code from your authenticator app to approve the other device.<br>
+        <?php endif; ?>
         This link expires in a few minutes.
       </p>
-      <form method="post" action="<?= h($auth) ?>/two-factor/approve" style="margin-top:1.5rem;">
+      <form method="post" action="<?= h($auth) ?>/two-factor/approve" style="margin-top:1.5rem;text-align:left;">
         <input type="hidden" name="token" value="<?= h($rawToken) ?>">
-        <button type="submit" style="width:100%;font-size:1.1rem;">Approve</button>
+        <?php if ($needsTotp): ?>
+          <label><span>Authenticator code</span>
+            <input name="code" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" autocomplete="one-time-code" required autofocus></label>
+        <?php endif; ?>
+        <button type="submit" style="width:100%;font-size:1.1rem;margin-top:0.75rem;">Approve</button>
       </form>
+      <?php if (!$user): ?>
+        <p class="hint" style="margin-top:1rem;">
+          Already signed in on this phone?
+          <a href="<?= h($auth) ?>/login?redirect=<?= urlencode($auth . '/two-factor/approve?token=' . $rawToken) ?>">Sign in first</a>
+        </p>
+      <?php endif; ?>
       <p style="margin-top:1rem;">
         <a href="<?= h($auth) ?>/" class="muted" style="font-size:0.9rem;">Cancel</a>
       </p>
