diff --git a/lib/Http/IntendedUrlService.php b/lib/Http/IntendedUrlService.php
index 236900f..4631674 100644
--- a/lib/Http/IntendedUrlService.php
+++ b/lib/Http/IntendedUrlService.php
@@ -47,12 +47,22 @@ class IntendedUrlService
     /**
      * Retrieve the intended URL and remove it from the session.
      * Returns the fallback ('admin') if no valid URL is stored.
+     *
+     * The stored URL is a full REQUEST_URI (e.g. /de/admin/users?page=2)
+     * but Router::redirect() expects a route path without leading slash
+     * and without locale prefix (e.g. admin/users?page=2), because it
+     * prepends getBaseUrl() which already includes the base path.
      */
     public function retrieveAndForget(SessionStoreInterface $session): string
     {
         $value = $this->retrieve($session);
         $session->remove(self::SESSION_KEY);
-        return $value ?? self::FALLBACK;
+
+        if ($value === null) {
+            return self::FALLBACK;
+        }
+
+        return $this->toRoutePath($value);
     }
 
     /**
@@ -103,6 +113,25 @@ class IntendedUrlService
         return $url;
     }
 
+    /**
+     * Convert a full REQUEST_URI into a Router::redirect()-compatible route path.
+     *
+     * /de/admin/users?page=2 → admin/users?page=2
+     * /admin/users            → admin/users
+     */
+    public function toRoutePath(string $url): string
+    {
+        // Remove leading slash
+        $path = ltrim($url, '/');
+
+        // Remove locale prefix (2-letter code followed by /)
+        if (preg_match('#^[a-z]{2}/#', $path)) {
+            $path = substr($path, 3);
+        }
+
+        return $path !== '' ? $path : self::FALLBACK;
+    }
+
     /**
      * Extract the path portion without query string and without locale prefix.
      */
diff --git a/lib/Support/helpers/app.php b/lib/Support/helpers/app.php
index 8f352f0..7fb0d7d 100644
--- a/lib/Support/helpers/app.php
+++ b/lib/Support/helpers/app.php
@@ -450,6 +450,24 @@ function appLogoUrl(?int $size = null): string
     return asset('brand/logo.svg');
 }
 
+/**
+ * Resolve logo for auth pages: tenant avatar → global logo → default SVG.
+ *
+ * After logout the tenant context (`$_SESSION['current_tenant']`) is preserved,
+ * so the login page can show the tenant avatar instead of the generic app logo.
+ */
+function appAuthLogoUrl(?int $size = null): string
+{
+    $tenantUuid = $_SESSION['current_tenant']['uuid'] ?? '';
+    if ($tenantUuid !== '' && class_exists('MintyPHP\\Service\\Tenant\\TenantAvatarService')) {
+        if (app(\MintyPHP\Service\Tenant\TenantAvatarService::class)->hasAvatar($tenantUuid)) {
+            $query = $size ? '&size=' . (int) $size : '';
+            return lurl('auth/tenant-avatar-file?uuid=' . rawurlencode($tenantUuid) . $query);
+        }
+    }
+    return appLogoUrl($size);
+}
+
 /**
  * Resolve favicon path (tenant favicon with global fallback).
  */
diff --git a/pages/auth/login().php b/pages/auth/login().php
index e36a5ee..68e2c7b 100644
--- a/pages/auth/login().php
+++ b/pages/auth/login().php
@@ -15,12 +15,21 @@ $requestRuntime = app(RequestRuntimeInterface::class);
 $sessionStore = app(SessionStoreInterface::class);
 $intendedUrlService = app(IntendedUrlService::class);
 
-// Store return_to from query parameter (set by session timeout or auth guard redirect).
+// Store return_to from query parameter (set by session timeout or auth guard redirect)
+// or from hidden form field (preserved through multi-stage login POST flow).
 $returnTo = trim((string) (requestInput()->queryAll()['return_to'] ?? ''));
+if ($returnTo === '') {
+    $returnTo = trim((string) (requestInput()->bodyAll()['return_to'] ?? ''));
+}
+
 if ($returnTo !== '') {
     $intendedUrlService->store($returnTo, $sessionStore);
 }
 
+// Expose sanitized return_to for hidden form fields so it survives across
+// POST stages even if the query string or session is lost.
+$returnToSanitized = $intendedUrlService->sanitize($returnTo !== '' ? $returnTo : ($intendedUrlService->retrieve($sessionStore) ?? ''));
+
 $session = $sessionStore->all();
 
 if (!empty($session['user']['id'])) {
diff --git a/pages/auth/login(login).phtml b/pages/auth/login(login).phtml
index ca384be..5befa9c 100644
--- a/pages/auth/login(login).phtml
+++ b/pages/auth/login(login).phtml
@@ -58,6 +58,7 @@ $authLogoHref = lurl('login');
 if ($tenantHint !== '') {
     $authLogoHref .= '?tenant=' . rawurlencode($tenantHint);
 }
+$returnToSanitized = (string) ($returnToSanitized ?? '');
 
 ?>
 
@@ -85,6 +86,7 @@ if ($tenantHint !== '') {
         <form method="post" data-login-submit-lock="1">
             <input type="hidden" name="stage" value="resolve_email">
             <input type="hidden" name="tenant_hint" value="<?php e($tenantHint); ?>">
+            <?php if ($returnToSanitized !== ''): ?><input type="hidden" name="return_to" value="<?php e($returnToSanitized); ?>"><?php endif; ?>
             <label for="email">
                 <span><?php e(t('Email')); ?></span>
                 <input required type="email" name="email" id="email" value="<?php e($email); ?>" autocomplete="email" autofocus <?php if ($errors): ?>aria-invalid="true" aria-describedby="<?php e($errorNoticeId); ?>"<?php endif; ?> />
@@ -99,6 +101,7 @@ if ($tenantHint !== '') {
             <input type="hidden" name="stage" value="choose_tenant">
             <input type="hidden" name="email" value="<?php e($email); ?>">
             <input type="hidden" name="tenant_hint" value="<?php e($tenantHint); ?>">
+            <?php if ($returnToSanitized !== ''): ?><input type="hidden" name="return_to" value="<?php e($returnToSanitized); ?>"><?php endif; ?>
             <fieldset class="login-tenant-fieldset">
                 <legend class="login-tenant-select-label"><?php e(t('Select tenant')); ?></legend>
                 <div class="login-tenant-choice-grid">
@@ -139,6 +142,7 @@ if ($tenantHint !== '') {
         </form>
         <form method="post">
             <input type="hidden" name="stage" value="reset">
+            <?php if ($returnToSanitized !== ''): ?><input type="hidden" name="return_to" value="<?php e($returnToSanitized); ?>"><?php endif; ?>
             <p>
                 <button type="submit" class="secondary outline"><?php e(t('Use different email')); ?></button>
             </p>
@@ -164,6 +168,7 @@ if ($tenantHint !== '') {
                     <input type="hidden" name="stage" value="resolve_email">
                     <input type="hidden" name="email" value="<?php e($email); ?>">
                     <input type="hidden" name="tenant_hint" value="<?php e($tenantHint); ?>">
+                    <?php if ($returnToSanitized !== ''): ?><input type="hidden" name="return_to" value="<?php e($returnToSanitized); ?>"><?php endif; ?>
                     <button type="submit" class="secondary outline small"><?php e(t('Switch tenant')); ?></button>
                     <?php Session::getCsrfInput(); ?>
                 </form>
@@ -190,6 +195,7 @@ if ($tenantHint !== '') {
                     <input type="hidden" name="email" value="<?php e($email); ?>">
                     <input type="hidden" name="tenant_hint" value="<?php e($tenantHint); ?>">
                     <input type="hidden" name="tenant_id" value="<?php e((string) $selectedTenantId); ?>">
+                    <?php if ($returnToSanitized !== ''): ?><input type="hidden" name="return_to" value="<?php e($returnToSanitized); ?>"><?php endif; ?>
                     <label for="password">
                         <span><?php e(t('Password')); ?></span>
                         <input required type="password" name="password" id="password" autocomplete="current-password" <?php if ($errors): ?>aria-invalid="true" aria-describedby="<?php e($errorNoticeId); ?>"<?php endif; ?> />
diff --git a/templates/default.phtml b/templates/default.phtml
index 3afd8bd..3f49df5 100644
--- a/templates/default.phtml
+++ b/templates/default.phtml
@@ -39,14 +39,12 @@ if ($bufferTitle !== '') {
   data-telemetry-enabled="<?php e($telemetryEnabled ? '1' : '0'); ?>"
   data-telemetry-sample-rate="<?php e((string) $telemetrySampleRate); ?>"
   data-telemetry-allowed-events="<?php e($telemetryAllowedEvents); ?>"
-  data-telemetry-csrf-key="<?php e($csrfKey); ?>"
-  data-telemetry-csrf-token="<?php e($csrfToken); ?>"
+  data-csrf-key="<?php e($csrfKey); ?>"
+  data-csrf-token="<?php e($csrfToken); ?>"
   <?php if ($isLoggedIn): ?>
   data-session-idle-seconds="<?php e((string) $sessionIdleSeconds); ?>"
   data-session-ping-url="<?php e(lurl('admin/session-ping/data')); ?>"
   data-session-logout-url="<?php e(lurl('logout')); ?>"
-  data-session-csrf-key="<?php e($csrfKey); ?>"
-  data-session-csrf-token="<?php e($csrfToken); ?>"
   <?php endif; ?>
   class="no-js"
   <?php if ($primaryVars !== ''): ?>style="<?php e($primaryVars); ?>" <?php endif; ?>
diff --git a/templates/partials/auth-logo.phtml b/templates/partials/auth-logo.phtml
index 9e5badd..4e292e8 100644
--- a/templates/partials/auth-logo.phtml
+++ b/templates/partials/auth-logo.phtml
@@ -1,6 +1,6 @@
 <?php
 
-$authLogoUrl = appLogoUrl();
+$authLogoUrl = appAuthLogoUrl();
 if ($authLogoUrl === '') {
     return;
 }
diff --git a/tests/Http/IntendedUrlServiceTest.php b/tests/Http/IntendedUrlServiceTest.php
index 5bad774..6b406dd 100644
--- a/tests/Http/IntendedUrlServiceTest.php
+++ b/tests/Http/IntendedUrlServiceTest.php
@@ -186,7 +186,7 @@ class IntendedUrlServiceTest extends TestCase
 
     // ── retrieveAndForget ─────────────────────────────────────
 
-    public function testRetrieveAndForgetReturnsStoredUrlAndRemovesIt(): void
+    public function testRetrieveAndForgetReturnsRoutePathAndRemovesIt(): void
     {
         $this->session->expects($this->any())
             ->method('get')
@@ -197,7 +197,35 @@ class IntendedUrlServiceTest extends TestCase
             ->method('remove')
             ->with('intended_url');
 
-        $this->assertSame('/admin/users', $this->service->retrieveAndForget($this->session));
+        $this->assertSame('admin/users', $this->service->retrieveAndForget($this->session));
+    }
+
+    public function testRetrieveAndForgetStripsLocalePrefix(): void
+    {
+        $this->session->expects($this->any())
+            ->method('get')
+            ->with('intended_url')
+            ->willReturn('/de/admin/users/edit/5');
+
+        $this->session->expects($this->once())
+            ->method('remove')
+            ->with('intended_url');
+
+        $this->assertSame('admin/users/edit/5', $this->service->retrieveAndForget($this->session));
+    }
+
+    public function testRetrieveAndForgetPreservesQueryString(): void
+    {
+        $this->session->expects($this->any())
+            ->method('get')
+            ->with('intended_url')
+            ->willReturn('/de/admin/users?page=2&sort=name');
+
+        $this->session->expects($this->once())
+            ->method('remove')
+            ->with('intended_url');
+
+        $this->assertSame('admin/users?page=2&sort=name', $this->service->retrieveAndForget($this->session));
     }
 
     public function testRetrieveAndForgetReturnsFallbackWhenNoUrlStored(): void
diff --git a/web/index.php b/web/index.php
index 3eb3e37..81ef5af 100644
--- a/web/index.php
+++ b/web/index.php
@@ -53,7 +53,20 @@ if ($defaultLocale !== null) {
 
 // Auto-login from remember-me cookie
 if (empty($_SESSION['user']['id'])) {
-    $rememberMeService->autoLoginFromCookie();
+    $autoLoginResult = $rememberMeService->autoLoginFromCookie();
+    if ($autoLoginResult) {
+        // After auto-login (e.g. session timeout with active remember-me cookie),
+        // honour ?return_to= so the user lands on the page they were on.
+        $returnToParam = trim((string) ($_GET['return_to'] ?? ''));
+        if ($returnToParam !== '') {
+            $intendedUrlService = app(IntendedUrlService::class);
+            $sanitized = $intendedUrlService->sanitize($returnToParam);
+            if ($sanitized !== '') {
+                $routePath = $intendedUrlService->toRoutePath($sanitized);
+                Router::redirect($routePath);
+            }
+        }
+    }
 }
 
 // Session timeout enforcement (idle + absolute)
diff --git a/web/js/components/app-session-warning.js b/web/js/components/app-session-warning.js
index 0385847..c038838 100644
--- a/web/js/components/app-session-warning.js
+++ b/web/js/components/app-session-warning.js
@@ -29,8 +29,8 @@ const readConfig = () => {
 
   const pingUrl = root.dataset.sessionPingUrl || '';
   const logoutUrl = root.dataset.sessionLogoutUrl || '';
-  const csrfKey = root.dataset.sessionCsrfKey || '';
-  const csrfToken = root.dataset.sessionCsrfToken || '';
+  const csrfKey = root.dataset.csrfKey || '';
+  const csrfToken = root.dataset.csrfToken || '';
 
   if (!pingUrl || !logoutUrl || !csrfKey || !csrfToken) {
     return null;
diff --git a/web/js/core/app-telemetry.js b/web/js/core/app-telemetry.js
index f6815ea..2023c5b 100644
--- a/web/js/core/app-telemetry.js
+++ b/web/js/core/app-telemetry.js
@@ -244,8 +244,8 @@ const resolveConfig = () => {
   return {
     enabled,
     endpoint: normalizeWhitespace(root.dataset.telemetryUrl || ''),
-    csrfKey: normalizeWhitespace(root.dataset.telemetryCsrfKey || ''),
-    csrfToken: normalizeWhitespace(root.dataset.telemetryCsrfToken || ''),
+    csrfKey: normalizeWhitespace(root.dataset.csrfKey || ''),
+    csrfToken: normalizeWhitespace(root.dataset.csrfToken || ''),
     sampleRate: clampRate(root.dataset.telemetrySampleRate || DEFAULT_SAMPLE_RATE, DEFAULT_SAMPLE_RATE),
     maxEventsPerMinute: clampPositiveInt(
       root.dataset.telemetryMaxEventsPerMinute || DEFAULT_MAX_EVENTS_PER_MINUTE,