diff --git a/frontend/src/components/AuthGate.tsx b/frontend/src/components/AuthGate.tsx
index 12dd399..14c9b9d 100644
--- a/frontend/src/components/AuthGate.tsx
+++ b/frontend/src/components/AuthGate.tsx
@@ -28,7 +28,9 @@ export default function AuthGate({ children }: { children: ReactNode }) {
         caps: data.caps ?? [],
       }))
       .catch(() => {
-        window.location.href = '/auth/login?redirect=' + encodeURIComponent(window.location.pathname)
+        // Redirect the top-level window, not the iframe, so the portal
+        // navigates to login rather than loading inside itself (EmbeddedFallback).
+        ;(window.top ?? window).location.href = '/login'
       })
       .finally(() => setChecking(false))
   }, [])