diff --git a/frontend/src/lib/utils/killLegacyServiceWorker.ts b/frontend/src/lib/utils/killLegacyServiceWorker.ts
new file mode 100644
index 00000000..40d84f0c
--- /dev/null
+++ b/frontend/src/lib/utils/killLegacyServiceWorker.ts
@@ -0,0 +1,28 @@
+export async function killLegacyServiceWorker(): Promise<void> {
+	if (typeof navigator === 'undefined' || !('serviceWorker' in navigator)) return;
+
+	try {
+		const registrations = await navigator.serviceWorker.getRegistrations();
+		const legacy = registrations.filter((r) => {
+			const url = r.active?.scriptURL ?? r.waiting?.scriptURL ?? r.installing?.scriptURL ?? '';
+			return url.endsWith('/sw.js');
+		});
+		if (legacy.length === 0) return;
+
+		await Promise.all(legacy.map((r) => r.unregister()));
+
+		if ('caches' in window) {
+			const keys = await caches.keys();
+			await Promise.all(
+				keys.filter((k) => k.startsWith('oxicloud-cache')).map((k) => caches.delete(k))
+			);
+		}
+
+		if (navigator.serviceWorker.controller && !sessionStorage.getItem('legacy-sw-killed')) {
+			sessionStorage.setItem('legacy-sw-killed', '1');
+			location.reload();
+		}
+	} catch {
+		/* best-effort cleanup */
+	}
+}
diff --git a/frontend/src/routes/+layout.svelte b/frontend/src/routes/+layout.svelte
index 56c5079b..597aa4c3 100644
--- a/frontend/src/routes/+layout.svelte
+++ b/frontend/src/routes/+layout.svelte
@@ -11,6 +11,7 @@
 	import { session } from '$lib/stores/session.svelte';
 	import { ui } from '$lib/stores/ui.svelte';
 	import { hashUrlToPath } from '$lib/utils/hashRedirect';
+	import { killLegacyServiceWorker } from '$lib/utils/killLegacyServiceWorker';
 
 	let { children } = $props();
 
@@ -35,6 +36,8 @@
 	let ready = $state(false);
 
 	onMount(async () => {
+		await killLegacyServiceWorker();
+
 		// The instant HTML boot splash has done its job — the app is mounted, so
 		// the route (login renders immediately; protected routes show their own
 		// loading state) is already in the DOM behind it.
diff --git a/src/application/services/auth_application_service.rs b/src/application/services/auth_application_service.rs
index 8f94bfd6..db619cdd 100644
--- a/src/application/services/auth_application_service.rs
+++ b/src/application/services/auth_application_service.rs
@@ -137,6 +137,7 @@ pub struct AuthApplicationService {
     /// Pending one-time token codes for secure token delivery after OIDC callback.
     /// Auto-expires after 60 seconds via moka TTL; max 10 000 entries for DoS protection.
     pending_oidc_tokens: Cache<String, PendingOidcToken>,
+    completed_oidc_logins: Cache<String, String>,
     /// Magic-link token repository — populated when the magic-link feature
     /// is enabled (PR 8+). `None` means redemption endpoints return 503.
     magic_link_repo: Option<Arc<dyn MagicLinkTokenRepository>>,
@@ -181,6 +182,10 @@ impl AuthApplicationService {
                 .max_capacity(10_000)
                 .time_to_live(Duration::from_secs(60))
                 .build(),
+            completed_oidc_logins: Cache::builder()
+                .max_capacity(10_000)
+                .time_to_live(Duration::from_secs(120))
+                .build(),
             magic_link_repo: None,
             user_flags_cache: Cache::builder()
                 .max_capacity(10_000)
@@ -2020,13 +2025,31 @@ impl AuthApplicationService {
     ) -> Result<OidcCallbackResult, DomainError> {
         // 0. Validate CSRF state and retrieve PKCE verifier + nonce + optional NC token
         //    (entry is auto-expired by moka TTL — remove returns None if expired)
-        let flow = self.pending_oidc_flows.remove(state).ok_or_else(|| {
-            tracing::warn!("OIDC callback with invalid/expired state token");
-            DomainError::new(
-                ErrorKind::AccessDenied, "OIDC",
-                "Invalid or expired OIDC state — possible CSRF attack. Please try logging in again.",
-            )
-        })?;
+        let flow = match self.pending_oidc_flows.remove(state) {
+            Some(flow) => flow,
+            None => {
+                if let Some(exchange_code) = self.completed_oidc_logins.get(state) {
+                    tracing::info!(
+                        target: "audit",
+                        event = "oidc.callback_replayed",
+                        reason = "duplicate_callback",
+                        "👮🏻‍♂️ Replayed a recently-completed OIDC login for a duplicate callback (consumed state)",
+                    );
+                    return Ok(OidcCallbackResult::WebLogin { exchange_code });
+                }
+                tracing::warn!(
+                    target: "audit",
+                    event = "oidc.callback_rejected",
+                    reason = "invalid_or_expired_state",
+                    "👮🏻‍♂️ OIDC callback with invalid/expired state token",
+                );
+                return Err(DomainError::new(
+                    ErrorKind::AccessDenied,
+                    "OIDC",
+                    "Invalid or expired OIDC state — possible CSRF attack. Please try logging in again.",
+                ));
+            }
+        };
         let (pkce_verifier, nonce, nc_flow_token) =
             (flow.pkce_verifier, flow.nonce, flow.nc_flow_token);
 
@@ -2324,6 +2347,9 @@ impl AuthApplicationService {
         self.pending_oidc_tokens
             .insert(exchange_code.clone(), PendingOidcToken { auth_response });
 
+        self.completed_oidc_logins
+            .insert(state.to_string(), exchange_code.clone());
+
         tracing::info!("OIDC login successful, one-time exchange code generated");
 
         Ok(OidcCallbackResult::WebLogin { exchange_code })