diff --git a/views/two_factor_challenge.php b/views/two_factor_challenge.php
index 1e5e3b0..be0a5e7 100644
--- a/views/two_factor_challenge.php
+++ b/views/two_factor_challenge.php
@@ -48,8 +48,8 @@ if (!isset($twofaQr)) {
         <img src="<?= h((string) $twofaQr['qr_url']) ?>" width="160" height="160" alt="QR code — scan with phone camera to approve sign-in" class="twofa-qr">
         <figcaption class="muted" data-i18n="twofa.qr_caption">
           Phone camera → tap link → Approve
-          <?php if (!empty($twofaQr['short_url'])): ?>
-            · <a href="<?= h((string) $twofaQr['short_url']) ?>" rel="noopener"><?= h((string) $twofaQr['short_url']) ?></a>
+          <?php if (!empty($twofaQr['scan_url']) || !empty($twofaQr['short_url'])): ?>
+            · <a href="<?= h((string) ($twofaQr['scan_url'] ?? $twofaQr['short_url'])) ?>" rel="noopener"><?= h((string) ($twofaQr['short_url'] ?? '')) ?></a>
           <?php endif; ?>
         </figcaption>
       </figure>