diff --git a/app/pages/login.vue b/app/pages/login.vue
new file mode 100644
index 0000000..ecc1674
--- /dev/null
+++ b/app/pages/login.vue
@@ -0,0 +1,28 @@
+<script setup lang="ts">
+import { buildIssuerLoginUrl } from '~~/shared/utils/ssoHandoff'
+
+/**
+ * Not a login page — the app has none by design, identity comes from the
+ * issuer. This only exists because /login is where the code still sends people
+ * (logout, the live-atc session guard, the bridge pairing screen), and in the
+ * monorepo that path resolved to the website's login form. Since the split it
+ * resolved to nothing, so signing out dropped the user on a 404.
+ */
+const route = useRoute()
+const config = useRuntimeConfig()
+
+definePageMeta({ layout: false })
+
+const issuer = String(config.public.authIssuer || '').replace(/\/+$/, '')
+const raw = String(route.query.redirect || '/')
+// Only same-origin paths — never bounce onward to an absolute URL from the query.
+const target = raw.startsWith('/') && !raw.startsWith('//') ? raw : '/'
+
+if (issuer) {
+  await navigateTo(buildIssuerLoginUrl(issuer, window.location.origin, target), { external: true })
+}
+else {
+  // AUTH_MODE=open: no login exists at all, every request is the local identity.
+  await navigateTo(target, { replace: true })
+}
+</script>
diff --git a/app/pages/logout.vue b/app/pages/logout.vue
index 31b28bd..99061d4 100644
--- a/app/pages/logout.vue
+++ b/app/pages/logout.vue
@@ -21,6 +21,7 @@ import { useAuthStore } from '~/stores/auth'
 
 const router = useRouter()
 const auth = useAuthStore()
+const config = useRuntimeConfig()
 
 useHead({
   title: 'Logout – OpenSquawk',
@@ -31,7 +32,17 @@ useHead({
 
 onMounted(async () => {
   await auth.logout()
-  router.replace('/login')
+
+  // Sign out at the issuer too. Sending the user to the app's own /login would
+  // only forward them back to an issuer where they are still signed in — they
+  // would be handed a fresh code and land straight back inside, which is not
+  // what "log out" means.
+  const issuer = String(config.public.authIssuer || '').replace(/\/+$/, '')
+  if (issuer) {
+    return navigateTo(`${issuer}/logout`, { external: true })
+  }
+
+  router.replace('/')
 })
 </script>