diff --git a/docs/architecture.md b/docs/architecture.md
index 6db3581..bc08be0 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -20,6 +20,11 @@ failures do not invalidate a successfully verified session.
 Restored sessions retain the server's mandatory credential-replacement state.
 An omitted replacement flag is treated conservatively as requiring setup rather
 than silently allowing the dashboard to consider setup complete.
+Dashboard loading and realtime connection wait until credential setup is complete;
+the server independently enforces the same operational-access restriction.
+The setup form includes a current-password field because restored keyring
+sessions intentionally do not restore the user's password. This lets setup
+continue after a client restart without storing the password on disk.
 
 Run `node --test src/session-recovery.test.js` for response classification and
 retry-schedule coverage. This is not a substitute for native AppImage acceptance.
diff --git a/src/App.svelte b/src/App.svelte
index 8a35754..f4fd702 100644
--- a/src/App.svelte
+++ b/src/App.svelte
@@ -51,6 +51,7 @@
   }
 
   async function loadAuthenticatedData() {
+    if (mustReplaceCredentials) return;
     await loadActivity();
     await loadNotifications();
     await loadDiagnostics();
@@ -1643,6 +1644,7 @@
           <div class="panel-header"><span>FIRST-RUN SETUP</span></div>
           <div class="auth-gate-body credential-form">
             <strong>Replace the generated administrator credentials</strong>
+            <label for="setup-current-password" class="micro">CURRENT PASSWORD</label><input id="setup-current-password" class="control" type="password" bind:value={password} autocomplete="current-password" />
             <label for="new-username" class="micro">NEW USERNAME</label><input id="new-username" class="control" bind:value={newUsername} autocomplete="username" />
             <label for="new-password" class="micro">NEW PASSWORD</label><input id="new-password" class="control" type="password" bind:value={newPassword} autocomplete="new-password" />
             <button class="primary" onclick={replaceCredentials} disabled={authBusy}>SAVE AND CONTINUE</button>