diff --git a/sim/cluster0/lab-seeds/backend/public/index.php b/sim/cluster0/lab-seeds/backend/public/index.php
index 994ce9f..2a54f0d 100644
--- a/sim/cluster0/lab-seeds/backend/public/index.php
+++ b/sim/cluster0/lab-seeds/backend/public/index.php
@@ -274,6 +274,8 @@ if (
         echo json_encode(['status' => 'expired']);
         exit;
     }
+    // Keep the pending-2FA window alive while the desktop polls (5 min from last poll).
+    $_SESSION['pending_2fa_exp'] = time() + 300;
     $status = AuthApproval::pollStatus($rawToken);
     if ($status === 'approved') {
         // Attempt to complete the login server-side within this same request
diff --git a/sim/cluster0/nginx/apps-port80.conf b/sim/cluster0/nginx/apps-port80.conf
index 494b026..066ee17 100644
--- a/sim/cluster0/nginx/apps-port80.conf
+++ b/sim/cluster0/nginx/apps-port80.conf
@@ -51,7 +51,7 @@ server {
 
 	# Shared session auth at project root — composed ac/* backend
 	# Includes 2FA cross-device and polling endpoints
-	location ~ ^/app/androidcast_project/(login|logout|register|two-factor|verify-email|api/two-factor)(/|$) {
+	location ~ ^/app/androidcast_project/(login|logout|register|two-factor(?:/approve)?|verify-email|api/two-factor(?:/poll)?)(/|$) {
 		include fastcgi_params;
 		fastcgi_pass 127.0.0.1:9000;
 		fastcgi_param SCRIPT_FILENAME /var/www/ac/composed/backend/public/index.php;