diff --git a/dock/index.html b/dock/index.html
index 5eeeb55..b49fbfd 100644
--- a/dock/index.html
+++ b/dock/index.html
@@ -212,7 +212,9 @@ $("signout").onclick = async e => {
   // Authentik's sign-out redirects to the site root (copyparty); do it in the background, then reload the dock,
   // which sends us through the Discord login and back here.
   try { await fetch("/outpost.goauthentik.io/sign_out", {credentials:"same-origin", mode:"no-cors", redirect:"follow"}); } catch(e){}
-  setTimeout(() => location.replace("/dock/"), 500);
+  // also end the Authentik login itself (otherwise the next visit re-authorises silently); the flow returns to this host
+  const auth = "https://" + location.hostname.replace(/^[^.]+\./, "auth.") + "/if/flow/default-invalidation-flow/?next=" + encodeURIComponent(location.origin + "/dock/");
+  setTimeout(() => location.replace(auth), 400);
 };
 whoami(); renderPreview();
 </script>