diff --git a/src/app/auth/resource/[resourceGuid]/page.tsx b/src/app/auth/resource/[resourceGuid]/page.tsx
index c78c277b6b..c683038cde 100644
--- a/src/app/auth/resource/[resourceGuid]/page.tsx
+++ b/src/app/auth/resource/[resourceGuid]/page.tsx
@@ -126,8 +126,13 @@ export default async function ResourceAuthPage(props: {
         } catch (e) {}
     }
 
+    // postAuthPath is a resource-level default landing path. Only apply it
+    // when no ?redirect= deep-path was supplied by the original request.
+    // If searchParams.redirect has already set a specific URL we must honour
+    // it — overriding it here is what caused users to be sent to the wrong
+    // page after SSO login when their Pangolin session had expired.
     const normalizedPostAuthPath = normalizePostAuthPath(authInfo.postAuthPath);
-    if (normalizedPostAuthPath) {
+    if (normalizedPostAuthPath && !searchParams.redirect) {
         redirectUrl = new URL(authInfo.url).origin + normalizedPostAuthPath;
     }
 
diff --git a/src/components/ResourceAuthPortal.tsx b/src/components/ResourceAuthPortal.tsx
index 5b6ee648c7..a2401e36cb 100644
--- a/src/components/ResourceAuthPortal.tsx
+++ b/src/components/ResourceAuthPortal.tsx
@@ -300,7 +300,6 @@ export default function ResourceAuthPortal(props: ResourceAuthPortalProps) {
         let isAllowed = false;
         try {
             const response = await resourceAccessProxy(props.resource.id);
-            console.log("response", response);
             if (response.error) {
                 setAccessDenied(true);
             } else {
@@ -311,8 +310,14 @@ export default function ResourceAuthPortal(props: ResourceAuthPortalProps) {
         }
 
         if (isAllowed) {
-            // window.location.href = props.redirect;
-            router.refresh();
+            // Use a full page reload so the browser issues a fresh request to
+            // this URL (which still carries the ?redirect= query parameter).
+            // The server then performs the SSO token exchange and issues a
+            // server-side redirect() to the original deep-path URL.
+            // router.refresh() alone does NOT reliably follow server-side
+            // redirect() calls in the Next.js App Router, causing users to
+            // land on the Pangolin panel instead of the desired resource.
+            window.location.reload();
         }
     }