diff --git a/frontend/src/main.js b/frontend/src/main.js
index 739dcfe4..3de1e512 100644
--- a/frontend/src/main.js
+++ b/frontend/src/main.js
@@ -9,12 +9,24 @@ import '@fontsource-variable/inter'
 // Initialize theme on app load
 import './stores/theme'
 import { applyBranding } from './utils/siteSettings'
+import { useAuthStore } from './stores/auth'
 
 const app = createApp(App)
 
 app.use(createPinia())
 app.use(router)
 
+// Validate stored token on app startup. If a token exists in localStorage but
+// is expired or signed with a stale secret (backend restarted), this catches
+// it immediately rather than letting the user navigate and then get kicked on
+// the first API request. fetchUser() logs out on 401.
+const authStore = useAuthStore()
+if (authStore.isAuthenticated) {
+  authStore.fetchUser().catch(() => {
+    // fetchUser handles the logout on 401; ignore the promise rejection
+  })
+}
+
 app.mount('#app')
 
 // Apply per-site favicon + brand color once settings load (no-op on defaults).