diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3a087d0..15c90f45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,9 @@ product overview.
 
 ## Unreleased
 
+- Add an opt-in admin sign-in alternative using the admin password and a private, expiring Slack
+  verification code for existing administrators, including sensitive-action reauthentication.
+
 - Version login-page scripts with their HTML so cached pre-upgrade code cannot reference removed fields.
 
 - Use the existing Users list and admin role for dashboard passkeys and invitations. Existing
diff --git a/FEATURES.md b/FEATURES.md
index 61d61146..025ea3f7 100644
--- a/FEATURES.md
+++ b/FEATURES.md
@@ -10,6 +10,18 @@
 
 Slack’s native running/Stop label shows the resolved model and explicitly configured effort, plus compact live phases (Thinking, Using tools, Writing, Waiting, Queued, Coordinating agents). Engine fallback replaces both model and effort; unset effort is omitted rather than guessed.
 
+## Optional password and Slack code sign-in
+
+- Settings → Admin access can enable an alternative to passkeys: the configured admin password
+  followed by an eight-digit code delivered privately to an existing Slack administrator.
+  The option is off by default; password alone never grants dashboard access. Existing passkeys
+  remain available. A recently verified, identity-linked initial setup can enable this option
+  without first registering a passkey.
+- Codes expire after five minutes, are bound to the requesting browser, accept at most five
+  guesses and are single-use. Delivery failures, role revocation, password changes and disabling
+  the option invalidate pending authority. Sensitive actions can repeat password and Slack
+  verification. Sessions retain the normal idle/absolute expiry and current-role checks.
+
 ## User-linked dashboard passkeys
 
 - The existing **Users** directory and its admin role govern dashboard access. Each credential
@@ -27,7 +39,7 @@ Slack’s native running/Stop label shows the resolved model and explicitly conf
   session, with five attempts maximum. Matching names never assign ownership. Unlinked accounts
   can complete this verification but cannot use ordinary admin APIs once known admins exist.
   Initial password setup follows the same proof before enrollment; fresh installs without known
-  admins retain temporary operator setup. First enrollment permanently retires password login.
+  admins retain temporary operator setup. First enrollment retires the password-only bootstrap path; the optional password plus Slack code flow requires explicit enablement.
 - Host operators recover a known admin with `npm run admin:recover -- --user <user-id>`.
   Recovery revokes its keys/sessions and prints a short-lived registration-only link; it never
   restores password login. Private keys remain with authenticators; SQLite stores public keys
diff --git a/TEST-PLAN.md b/TEST-PLAN.md
index 3e7a46d5..20359524 100644
--- a/TEST-PLAN.md
+++ b/TEST-PLAN.md
@@ -1,5 +1,38 @@
 # ChannelGate — Test Plan
 
+## Optional password and Slack code authentication (2026-10-28)
+
+- Automated scratch HTTP fixture: `test/admin-password-slack.test.js` and
+  `test/admin-password-slack-race.test.js`. Use fake private delivery,
+  disposable passwords and existing Slack Admin/non-admin users. Verify disabled-by-default,
+  password-only denial, correct browser-bound code login after passkey enrollment, replay/expiry/
+  guess limits, private delivery failure, role and credential/settings revocation. Never send
+  fixture codes to deployed users.
+- Browser fixture: `test/admin-password-slack-browser.test.js` exercises Settings → Admin access enablement, alternate sign-in and sensitive
+  reauthentication and sign-out on disable without a WebAuthn device. Chromium verification:
+  all 15 combined passkey/initial-setup/alternate-login assertions passed, zero skips; the
+  extended disable/sign-out browser fixture also passed. Private delivery is simulated.
+- Live acceptance pending, engine-independent: this HTTP/browser authentication path never calls
+  either engine. On a disposable gateway with an existing Slack administrator and working bot DM
+  delivery, enable the checkbox using recent admin verification, sign out, enter the password
+  and own Slack member ID, then enter the privately received code. Pass only when the dashboard
+  opens as that exact existing user with no passkey prompt. Repeat a sensitive action with code
+  reauthentication. Confirm a wrong/replayed code and a non-admin are refused; disabling the
+  checkbox removes alternate login and invalidates its sessions. Check from the RustDesk browser
+  through a localhost SSH tunnel. Record screenshots/HTTP evidence without codes/passwords.
+- Local regression: `npm run test:coverage -- --test-concurrency=4` passed with 4,120
+  passed / 38 opt-in skipped / zero failed; coverage 93.91% lines, 86.55% branches, 90.27%
+  functions. An initial unconstrained run hit the container process limit and was terminated;
+  it is not counted as a passing run. Security-coverage, secret scan and production dependency
+  audit at the high severity threshold passed (three existing moderate advisories remain).
+- CI fixture isolation: `test/web-security.test.js` now initializes scratch paths before
+  importing security helpers. Its isolated 15-test run under a fresh HOME created no runtime
+  files there; this fixes the existing real-home leak without relaxing the guard.
+- Gate maintenance: linked-workspace authorization cases in `test/authorization.test.js`
+  restore the existing 95% branch floor (measured 96.81%); no production policy or floor changed.
+- Private QA registry update pending: the requesting user's personal Airtable connection is not
+  connected in this run. Do not treat the missing registry or unexecuted live case as passed.
+
 ## Linked working-folder setup acceptance
 
 Re-verification (2026-10-26): regression coverage now checks source `excludedUsers` and restricted-channel policy through linked DMs, explicit-unlink/source-departure section-skill retention, DM template preservation, established promoted-owner selection, and immediate follower SSH disconnection after source revocation (20-minute timer disabled as a fallback). `test/skills-workspace-sync.test.js` and `test/ssh-broker.test.js` cover these gaps. Updated full suite: 4,117 passed, 37 skipped, zero failures; Chromium linked-folder fixture passed. Actual Claude and Codex CLI smoke checks read a source-scoped skill from a generated linked workspace and returned its unique marker. Codex used the gateway's Worker/container mode; an initial nested read-only sandbox attempt failed with a bubblewrap capability error. These are CLI smoke checks, not a Slack end-to-end acceptance pass.
diff --git a/documentation/package-lock.json b/documentation/package-lock.json
index 4d4e49d4..3b85a640 100644
--- a/documentation/package-lock.json
+++ b/documentation/package-lock.json
@@ -4608,9 +4608,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.1.4",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz",
-      "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==",
+      "version": "6.1.5",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.5.tgz",
+      "integrity": "sha512-TEHFzb5KRDKaOgJ4TYE+0jyJtFbjLvkdVOu0fZ2b6MTWzoqZd4Le+61aEppWkvTlYePgOX4ATL1wsAIPMLTw6Q==",
       "license": "MIT",
       "dependencies": {
         "cssesc": "^3.0.0",
@@ -5068,9 +5068,9 @@
       "license": "MIT"
     },
     "node_modules/undici": {
-      "version": "8.11.2",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-8.11.2.tgz",
-      "integrity": "sha512-u4UB2/IrKdU6lFxumHmmo1a3fCQO5tzQllRorfoRS63txhrB7xTpSn1PftwC4qEHkOaqP95fCWW4lJzwErwzhQ==",
+      "version": "8.12.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.12.3.tgz",
+      "integrity": "sha512-+fdndUTwBP86cVjihTp21hZHo7d6oj1c/47XPA3lL8mM0XHs+C4EkcjmgRsFnFk2f/UONGDy9ItBItmXsLOQHw==",
       "license": "MIT",
       "engines": {
         "node": ">=22.19.0"
@@ -5472,9 +5472,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.6.5",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
-      "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "license": "MIT",
       "funding": {
         "url": "https://github.com/sponsors/colinhacks"
diff --git a/documentation/src/content/docs/controls.mdx b/documentation/src/content/docs/controls.mdx
index 5c44f2ce..e176e3a6 100644
--- a/documentation/src/content/docs/controls.mdx
+++ b/documentation/src/content/docs/controls.mdx
@@ -9,7 +9,7 @@ import { controlPages } from '../../data/control-reference.mjs';
 
 Ask the agent for an outcome in ordinary language. It can use the controls below when its current permissions, platform, and connections allow them. These reference pages explain the exact tool names, inputs, results, and restrictions for people building integrations or checking how an action works.
 
-The gateway defines **110 controls**. The separate [skills-library service](/docs/controls/skills-library) defines **10 more**. A run receives an authorized subset; a tool appearing here does not mean it is enabled in every conversation. The library endpoint uses its own access tokens.
+The gateway defines **121 controls**. The separate [skills-library service](/docs/controls/skills-library) defines **10 more**. A run receives an authorized subset; a tool appearing here does not mean it is enabled in every conversation. The library endpoint uses its own access tokens.
 
 For practical workflows, browse the [feature directory](/docs/features). For deployment and conversation defaults, open [configuration](/docs/configuration). The [functionality map](/docs/functionality) connects the broader product areas to their guides.
 
diff --git a/documentation/src/content/docs/controls/accounts-and-secrets.md b/documentation/src/content/docs/controls/accounts-and-secrets.md
index ef914bfe..c87c82f8 100644
--- a/documentation/src/content/docs/controls/accounts-and-secrets.md
+++ b/documentation/src/content/docs/controls/accounts-and-secrets.md
@@ -159,3 +159,55 @@ An email account is a mailbox's IMAP and SMTP settings entered once on one form
 ## Related guides
 
 [Accounts](/docs/features/connected-accounts), [environment configuration](/docs/configuration/environment-variables), [secrets](/docs/features/secrets), [Composio SDK](/docs/features/composio-sdk), and [Toolbox/Make](/docs/features/toolbox-and-make).
+
+## list_email_accounts
+
+**Inputs:** None.
+
+**Scope and result:** Lists this conversation's connected email accounts and the verified requester's personal accounts, with address, scope, server endpoints, and sending availability. Never returns passwords. Connect accounts through Settings → Email accounts (MCP page for the conversation, You page for personal accounts), not through chat. Personal mail read in a shared conversation appears in that shared thread. Untrusted API author attribution does not grant personal accounts.
+
+The email controls below accept optional `account`: a connected account name, `personal/<name>`, `channel/<name>`, or email address. Omit it only when exactly one account is available. Optional `mailbox` defaults to `INBOX`; message `uid` values are scoped to that mailbox.
+
+## email_mailboxes
+
+**Optional:** `account`.
+
+**Scope and result:** Lists selectable folders and their special roles (Inbox, Sent, Drafts, Archive, Trash, Junk) for the selected connected account.
+
+## email_search
+
+**Optional:** `account`, `mailbox`, `query`, `from`, `to`, `subject`, `since`, `before`, `unseen`, `flagged`, `limit` (integer 1–50; default 20).
+
+**Scope and result:** Lists matching messages newest first, including UID, date, sender, subject, unread/flag marks, and attachment count. Filters combine with AND; no filters lists newest messages. `since` and `before` are ISO dates. Results include the total match count. Use the returned UID with the message controls.
+
+## email_read
+
+**Required:** `uid` (positive integer). **Optional:** `account`, `mailbox`, `max_chars` (integer 500–100000; default 20000).
+
+**Scope and result:** Reads headers, text body (plain text preferred, HTML converted), and attachment part identifiers. Reports body truncation explicitly.
+
+## email_download_attachment
+
+**Required:** `uid` (positive integer), `part` (attachment part ID from `email_read`). **Optional:** `account`, `mailbox`.
+
+**Scope and result:** Downloads an attachment into this conversation's workspace under `uploads/email/<account>/` and returns its local path. Maximum attachment size is 50 MB. The path can be read locally or shared using the conversation's file controls.
+
+## email_move
+
+**Required:** `uid` (positive integer), `to` (destination mailbox path). **Optional:** `account`, `mailbox`.
+
+**Scope and result:** Moves a message into another folder, such as Archive or Trash. Returns the source/destination and new UID when supplied by the server. List valid destinations with `email_mailboxes`.
+
+## email_set_flag
+
+**Required:** `uid` (positive integer), `flag` (`seen`, `unseen`, `flagged`, `unflagged`, or `answered`). **Optional:** `account`, `mailbox`.
+
+**Scope and result:** Changes the selected message's read, flagged, or answered state and returns an acknowledgement.
+
+## email_send
+
+**Required:** `to` (nonempty array of recipient addresses), `subject` (string), `text` (plain-text body). **Optional:** `account`, `cc`, `bcc` (address arrays), `html` (HTML alternative), `attachments` (workspace-relative file paths), `in_reply_to` (original Message-ID), `reply_to` (address).
+
+**Scope and result:** Sends from the selected connected account's address and reports accepted/rejected recipients, Message-ID, and whether a Sent copy was saved. `in_reply_to` sets both In-Reply-To and References. Attachments are confined to the conversation workspace, at most ten files and 25 MB total.
+
+**Restrictions:** Sending must be enabled on the account. Confirm recipients and content unless the user already supplied them. Personal accounts send as that person. Mail credentials remain in the daemon, outside agent containers.
diff --git a/documentation/src/content/docs/controls/slack.md b/documentation/src/content/docs/controls/slack.md
index 9f398cfa..a60a7e35 100644
--- a/documentation/src/content/docs/controls/slack.md
+++ b/documentation/src/content/docs/controls/slack.md
@@ -235,3 +235,29 @@ These tools use the gateway’s Slack bot token and trusted current conversation
 **Scope and result:** Asks Slack for a file descriptor, proves sharing in the current conversation, and downloads into this thread’s uploads folder. Returns a local path, MIME type when available, and size. A existing confined download is reused.
 
 **Limits:** At most 500 MiB per attachment. The bot must have file access and Slack must report the file shared here. It returns no private URL/token. Download refusals and unavailable metadata do not count as content inspection.
+
+## open_code_channel
+
+**Required:** `task` (string, 3–2000 characters). **Optional:** `name` (string, up to 80 characters), `mode` (`auto`, `worktree`, or `in_place`; default `auto`), `private` (boolean; default inherits the origin channel).
+
+**Scope and result:** Requests a dedicated Slack code channel for an explicitly requested task. A human must approve the card before creation. The new channel inherits the origin workspace, access policy, secrets, and skills. `auto` creates a task branch and worktree when the workspace is a repository; otherwise it uses the channel's files. Returns the channel and workspace/branch outcome; the daemon starts the first turn when available.
+
+**Restrictions:** Requires an originating Slack message in a configured channel. Not available from a DM, another code channel, or a scheduled/background run without an originating message. Call only when the requester explicitly asks for a code channel.
+
+## update_code_channel
+
+**Optional:** `title` (string, up to 200 characters), `refresh_diff` (boolean), `context_items` (up to five objects with required `key` and `label`, optional `icon` and `url`), `view` (object).
+
+The `view` object requires `type` (`html`, `block_kit`, `canvas`, or `pull_request`) and accepts `key`, `name`, `content` (complete self-contained HTML), `blocks` (up to 50 Block Kit blocks), `canvas_id`, and `pr_url` as appropriate for the type. Reusing a stable `key` replaces that artifact tab.
+
+**Scope and result:** Updates the current code channel's title, context bar, artifact tab, or Code diff independently. Context items merge with defaults; the complete context bar holds up to five items. Returns an outcome for each requested change. The Code diff normally refreshes after each turn; `refresh_diff:true` forces a refresh.
+
+**Restrictions:** Only available inside an active Slack code channel. HTML previews render sandboxed. An archived code channel cannot be updated.
+
+## archive_code_channel
+
+**Optional:** `summary` (string, up to 3900 characters).
+
+**Scope and result:** Requests archival of the current Slack code channel after its task is done and the requester agrees. A human must approve the card. Posts the wrap-up, shares it into the origin thread, and archives the channel. History and artifact tabs remain readable and searchable; the task branch remains on disk.
+
+**Restrictions:** Only available inside a Slack code channel. Repeated archival reports that the channel is already archived.
diff --git a/documentation/src/content/docs/features/admin-dashboard.md b/documentation/src/content/docs/features/admin-dashboard.md
index 9e8cdb59..4b801da6 100644
--- a/documentation/src/content/docs/features/admin-dashboard.md
+++ b/documentation/src/content/docs/features/admin-dashboard.md
@@ -7,10 +7,18 @@ The admin website runs as part of your ChannelGate installation. It manages the
 
 ## Sign in
 
-By default, the daemon serves the interface on `http://localhost:4747`. An operator can change the port or put a trusted tunnel/reverse proxy in front of it. On first boot without a configured password, ChannelGate generates an admin password once and stores its hash. Use the password supplied by the installation's operator.
+By default, the daemon serves the interface on `http://localhost:4747`. An operator can change the port or put a trusted tunnel/reverse proxy in front of it. On first boot without a configured password, ChannelGate generates an admin password once and stores its hash. Use the password supplied by the installation's operator for initial setup, then verify and link your existing gateway administrator user. Normal sign-in uses a passkey, with optional password and Slack code sign-in as described below.
 
 A public deployment should set **Settings → Connection → Public URL** to its reachable HTTPS origin. This also gives approval links a reachable address. Setting Public URL does not create a tunnel or open a firewall.
 
+## Optional password and Slack code sign-in
+
+A linked Slack administrator can enable **Settings → Admin access → Password and Slack code** after a fresh sign-in. It is off by default. Keep the current shared admin password or set a new one of at least 12 characters. During initial setup, verify and link the administrator first, then use this option to complete setup without creating a passkey.
+
+On the sign-in page, choose **Sign in with password and Slack code**, enter the shared admin password and your Slack user ID, then enter the eight-digit code delivered privately by the gateway bot. Codes expire after five minutes, work only in the requesting browser, and allow at most five incorrect guesses. This option requires a current gateway Slack administrator and working private Slack delivery; approved members alone cannot use it. Passkeys remain available.
+
+Changing the shared password or disabling this option revokes existing password-and-code sessions. Removing the user's administrator role also revokes access. Disabling it while signed in this way signs out that browser; retain another usable sign-in method before disabling it.
+
 ## Choose the right page
 
 - **[Overview](/docs/features/usage-and-costs):** run, token, cost, model, user, conversation, and skill summaries.
@@ -31,7 +39,7 @@ Settings display inherited and explicit values where supported. Blank password/t
 
 Platform connections can be connected or reconnected without restarting the whole daemon. Runtime/image changes may affect future container starts; inspect the resulting status and verify a real task after a change.
 
-Chat admins and the password-authenticated web session are distinct ways of authorizing control actions. Being an approved chat user does not itself provide the admin website password.
+Dashboard sessions are linked to an existing gateway administrator user. Being an approved chat user alone does not grant dashboard access. The shared password alone cannot grant a full dashboard session.
 
 ## Related guides
 
diff --git a/public/admin-access.js b/public/admin-access.js
index e3a00466..4a210ec9 100644
--- a/public/admin-access.js
+++ b/public/admin-access.js
@@ -2,12 +2,89 @@ import { api } from "./admin-api.js";
 
 const passkeys = () => window.ChannelGatePasskeys;
 
+// Passwords and codes stay only in this temporary form; never browser storage.
+async function passwordSlackReauth(me) {
+  const previousFocus = document.activeElement;
+  const modal = document.createElement("div");
+  modal.className = "modal";
+  modal.innerHTML = `<form class="modal-card" role="dialog" aria-modal="true" aria-labelledby="password-slack-title">
+    <h3 id="password-slack-title">Verify your identity</h3>
+    <p data-auth="status">Enter the dashboard password to receive a private Slack code.</p>
+    <label class="field" data-auth="password-label"><span>Dashboard password</span><input data-auth="password" type="password" autocomplete="current-password" required /></label>
+    <label class="field" data-auth="code-label" hidden><span>8-digit code from Slack</span><input data-auth="code" type="text" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9]{8}" minlength="8" maxlength="8" /></label>
+    <p data-auth="error" role="alert"></p>
+    <div class="modal-foot"><button type="submit" data-auth="submit">Send Slack code</button><button type="button" class="ghost" data-auth="passkey">Use a passkey</button><button type="button" class="ghost" data-auth="cancel">Cancel</button></div>
+  </form>`;
+  document.body.append(modal);
+  const at = (name) => modal.querySelector(`[data-auth="${name}"]`);
+  at("passkey").hidden = !me.passkeys?.length;
+  let requestId = "";
+  let busy = false;
+  return new Promise((resolve, reject) => {
+    function finish(value, error) {
+      at("password").value = "";
+      at("code").value = "";
+      document.removeEventListener("keydown", onKey);
+      modal.remove();
+      previousFocus?.focus();
+      if (error) reject(error); else resolve(value);
+    }
+    function onKey(event) {
+      if (event.key === "Escape" && !busy) { event.preventDefault(); finish(false, new Error("Identity verification cancelled.")); }
+      if (event.key === "Tab") {
+        const controls = [...modal.querySelectorAll("input, button")].filter((item) => !item.disabled && !item.closest("[hidden]"));
+        const first = controls[0];
+        const last = controls.at(-1);
+        if (event.shiftKey && document.activeElement === first) { event.preventDefault(); last?.focus(); }
+        else if (!event.shiftKey && document.activeElement === last) { event.preventDefault(); first?.focus(); }
+      }
+    }
+    document.addEventListener("keydown", onKey);
+    at("cancel").addEventListener("click", () => finish(false, new Error("Identity verification cancelled.")));
+    at("passkey").addEventListener("click", () => finish(false));
+    modal.querySelector("form").addEventListener("submit", async (event) => {
+      event.preventDefault();
+      if (busy) return;
+      busy = true;
+      for (const button of modal.querySelectorAll("button")) button.disabled = true;
+      at("error").textContent = "";
+      try {
+        if (!requestId) {
+          let result;
+          try {
+            result = await api("/api/auth/password-slack/options", { method: "POST", body: JSON.stringify({ password: at("password").value, userId: me.account.userId }) });
+          } finally { at("password").value = ""; }
+          requestId = result.requestId;
+          at("password").required = false;
+          at("password-label").hidden = true;
+          at("code-label").hidden = false;
+          at("code").required = true;
+          at("status").textContent = "Check your private Slack messages. The code expires in 5 minutes.";
+          at("submit").textContent = "Verify code";
+          at("code").focus();
+        } else {
+          try {
+            await api("/api/auth/password-slack/verify", { method: "POST", body: JSON.stringify({ requestId, code: at("code").value.trim() }) });
+          } finally { at("code").value = ""; }
+          finish(true);
+        }
+      } catch (error) { at("error").textContent = error.message; }
+      finally {
+        busy = false;
+        for (const button of modal.querySelectorAll("button")) button.disabled = false;
+      }
+    });
+    at("password").focus();
+  });
+}
+
 // Called from a user action (settings, secret reveal, account/key management). The server is
 // authoritative about freshness; never cache a password or an assertion in browser storage.
 export async function freshAdminAuth({ force = false } = {}) {
   const me = await api("/api/auth/me", { cache: "no-store" });
   if (me.bootstrap) throw new Error("Create your first passkey under Settings → Admin access before continuing.");
   if (!force && me.fresh) return true;
+  if (me.passwordSlackEnabled && /^[UW][A-Z0-9]{8,}$/.test(me.account?.userId || "") && await passwordSlackReauth(me)) return true;
   try {
     const { options } = await api("/api/auth/reauth/options", { method: "POST", body: "{}" });
     const response = await passkeys().get(options);
@@ -67,7 +144,13 @@ export async function mountAdminAccess(container, { confirm = async () => false,
       </form>
       <p class="desc" data-access="link-status"></p>
     </div>
-    <p class="admin-access-bootstrap" data-access="bootstrap" hidden>Create your first passkey to finish setup. The existing admin password stops working after enrollment.</p>
+    <p class="admin-access-bootstrap" data-access="bootstrap" hidden>Create your first passkey to finish setup, or enable password and Slack code sign-in below after linking your admin identity.</p>
+    <form data-access="password-slack-form" class="admin-access-form">
+      <label class="toggle"><input data-access="password-slack-enabled" type="checkbox" /> Allow password and Slack code sign-in</label>
+      <p class="desc">Admins can sign in without a passkey using the shared dashboard password and a private Slack code. Requires a connected Slack admin account. Disabling this option signs out password and Slack code sessions.</p>
+      <label class="field"><span data-access="password-slack-label">Dashboard password (leave blank to keep the current password)</span><input data-access="password-slack-password" type="password" autocomplete="new-password" /></label>
+      <button type="submit" data-access="password-slack-save">Save sign-in option</button>
+    </form>
     <form data-access="register-form" class="admin-access-form">
       <label class="field"><span>Passkey name</span><input data-access="key-name" type="text" autocomplete="off" placeholder="For example, work laptop or spare key" required maxlength="100" /></label>
       <button type="submit" data-access="register">Add a passkey</button>
@@ -83,7 +166,7 @@ export async function mountAdminAccess(container, { confirm = async () => false,
   let linkRequestId = "";
   function syncControls() {
     if (!active()) return;
-    for (const control of container.querySelectorAll("button, select")) control.disabled = !ready || busy || control.dataset.unavailable === "true";
+    for (const control of container.querySelectorAll("button, select, input[type=checkbox]")) control.disabled = !ready || busy || control.dataset.unavailable === "true";
   }
   syncControls();
   function message(text, error = false) {
@@ -126,6 +209,10 @@ export async function mountAdminAccess(container, { confirm = async () => false,
       if (!users.length) at("link-status").textContent = "No existing admin user is available to link. Configure your chat connection and admin users first.";
     }
     at("bootstrap").hidden = !me.bootstrap;
+    at("password-slack-label").textContent = me.bootstrap ? "Existing setup password (required to enable sign-in)" : "Dashboard password (leave blank to keep the current password)";
+    at("password-slack-enabled").checked = Boolean(me.passwordSlackEnabled);
+    at("password-slack-save").dataset.unavailable = String(!me.account.userId || me.linkRequired);
+    at("password-slack-enabled").dataset.unavailable = String(!me.account.userId || me.linkRequired);
     at("register").textContent = me.passkeys.length ? "Add a passkey" : "Create your first passkey";
     at("register").dataset.unavailable = String(Boolean(me.linkRequired));
     at("keys").replaceChildren(...me.passkeys.map((key) => accessRow(
@@ -171,6 +258,27 @@ export async function mountAdminAccess(container, { confirm = async () => false,
     at("link-verify-form").hidden = true;
     at("link-status").textContent = "Send a new verification code to the selected user.";
   });
+  async function savePasswordSlack() {
+    const enabled = at("password-slack-enabled").checked;
+    const password = at("password-slack-password").value;
+    at("password-slack-password").value = "";
+    try {
+      if (!me.bootstrap) await freshAdminAuth();
+      const result = await api("/api/auth/password-slack/settings", { method: "PUT", body: JSON.stringify({ enabled, ...(password ? { password } : {}) }) });
+      if (result.signedOut) { location.replace("/login.html"); return; }
+      await refresh();
+      message(enabled ? "Password and Slack code sign-in enabled." : "Password and Slack code sign-in disabled.");
+      if (enabled && !me.bootstrap && !me.passkeys.length) location.replace("/settings#set-admin-access");
+    } catch (error) {
+      at("password-slack-enabled").checked = Boolean(me.passwordSlackEnabled);
+      throw error;
+    }
+  }
+  at("password-slack-form").addEventListener("submit", (event) => {
+    event.preventDefault();
+    void run(savePasswordSlack);
+  });
+  at("password-slack-enabled").addEventListener("change", () => { void run(savePasswordSlack); });
   at("register-form").addEventListener("submit", (event) => {
     event.preventDefault();
     void run(async () => {
diff --git a/public/app.js b/public/app.js
index c194f1b5..07ca6c3c 100644
--- a/public/app.js
+++ b/public/app.js
@@ -5239,7 +5239,7 @@ document.getElementById("dash-source").addEventListener("change", () => loadDash
 // ── Boot ─────────────────────────────────────────────────────────────────────────
 async function init() {
   const identity = await api("/api/auth/me", { cache: "no-store" });
-  if (identity.linkRequired) {
+  if (identity.linkRequired || identity.bootstrap) {
     // Existing unlinked passkeys can authenticate, but ordinary admin APIs stay closed until
     // their owner proves the existing gateway identity. Keep that remedy reachable on its own.
     document.querySelector(".app").style.display = "none";
@@ -5248,7 +5248,7 @@ async function init() {
     const card = document.createElement("div");
     card.className = "setcard identity-link-card";
     const title = document.createElement("h2");
-    title.textContent = "Link your gateway admin user";
+    title.textContent = identity.linkRequired ? "Link your gateway admin user" : "Complete dashboard access setup";
     const access = document.getElementById("admin-access");
     card.append(title, access);
     gate.append(card);
diff --git a/public/login.html b/public/login.html
index 3d6d3204..3d84cce9 100644
--- a/public/login.html
+++ b/public/login.html
@@ -56,9 +56,26 @@
       <form id="f">
         <button type="submit" id="sign-in">Sign in with a passkey</button>
       </form>
+      <details id="password-slack" hidden>
+        <summary>Sign in with password and Slack code</summary>
+        <p>Use the dashboard password and a code sent privately to your Slack admin account.</p>
+        <form id="password-slack-form">
+          <label for="slack-user">Your Slack admin user ID</label>
+          <input id="slack-user" type="text" placeholder="U0123456789" autocomplete="username" required maxlength="100" />
+          <label for="slack-password">Dashboard password</label>
+          <input id="slack-password" type="password" autocomplete="current-password" required />
+          <button type="submit">Send Slack code</button>
+        </form>
+        <form id="password-slack-verify-form" hidden>
+          <label for="slack-code">8-digit code from Slack</label>
+          <input id="slack-code" type="text" inputmode="numeric" autocomplete="one-time-code" pattern="[0-9]{8}" minlength="8" maxlength="8" required />
+          <button type="submit">Verify and sign in</button>
+        </form>
+        <p class="setup-note" id="password-slack-status"></p>
+      </details>
       <details id="bootstrap" hidden>
         <summary>First-time admin setup</summary>
-        <p>Use the existing admin password once, verify your gateway admin user, and register the first passkey. Password sign-in ends after setup.</p>
+        <p>Use the existing admin password and verify your gateway admin user. Then create a passkey or enable password and Slack code sign-in in Admin access.</p>
         <form id="bootstrap-form">
           <label for="pw">Existing admin password</label>
           <input id="pw" type="password" placeholder="Password" autocomplete="current-password" required />
@@ -84,6 +101,7 @@
         <button type="submit" id="enroll-submit">Create your passkey</button>
         <p class="setup-note">Use your device's screen lock or a security key. Keep a spare passkey once signed in.</p>
       </form>
+      <button type="button" id="setup-access" hidden>Continue to admin access settings</button>
       <button type="button" id="setup-restart" hidden>Sign out and restart setup</button>
       <p id="status" class="status" role="status" aria-live="polite"></p>
       <div class="err" id="err" role="alert"></div>
diff --git a/public/login.js b/public/login.js
index b2fd56a3..ff7b6f18 100644
--- a/public/login.js
+++ b/public/login.js
@@ -12,6 +12,7 @@
   const passkeys = window.ChannelGatePasskeys;
   let busy = false;
   let linkRequestId = "";
+  let passwordSlackRequestId = "";
 
   async function request(url, body) {
     const response = await fetch(url, {
@@ -40,9 +41,11 @@
 
   function showEnrollment(message) {
     byId("f").hidden = true;
+    byId("password-slack").hidden = true;
     byId("bootstrap").hidden = true;
     byId("link-panel").hidden = true;
     byId("enroll-form").hidden = false;
+    byId("setup-access").hidden = true;
     byId("intro").textContent = message;
     byId("status").textContent = "";
     byId("passkey-name").focus();
@@ -53,10 +56,16 @@
     const me = await request("/api/auth/me");
     byId("setup-restart").hidden = false;
     if (!me.linkRequired) {
-      if (me.bootstrap || !me.passkeys.length) return showEnrollment("Complete setup: create your first passkey.");
+      if (!me.bootstrap && me.passwordSlackEnabled && me.account?.userId) return void location.replace("/settings#set-admin-access");
+      if (me.bootstrap || !me.passkeys.length) {
+        showEnrollment("Complete setup: create your first passkey.");
+        byId("setup-access").hidden = !me.bootstrap || !me.account?.userId;
+        return;
+      }
       return void location.replace("/settings#set-admin-access");
     }
     byId("f").hidden = true;
+    byId("password-slack").hidden = true;
     byId("bootstrap").hidden = true;
     byId("enroll-form").hidden = true;
     byId("link-panel").hidden = false;
@@ -107,6 +116,7 @@
     byId("link-verify-form").hidden = true;
     byId("link-status").textContent = "Send a new verification code to the selected user.";
   });
+  byId("setup-access").addEventListener("click", () => location.assign("/settings#set-admin-access"));
   byId("setup-restart").addEventListener("click", () => run(async () => {
     await request("/api/logout", {});
     location.replace("/login.html");
@@ -125,6 +135,41 @@
     });
   });
 
+  byId("password-slack-form").addEventListener("submit", (event) => {
+    event.preventDefault();
+    void run(async () => {
+      passwordSlackRequestId = "";
+      byId("password-slack-verify-form").hidden = true;
+      byId("slack-code").value = "";
+      let result;
+      try {
+        result = await request("/api/auth/password-slack/options", {
+          userId: byId("slack-user").value.trim(), password: byId("slack-password").value,
+        });
+      } finally { byId("slack-password").value = ""; }
+      passwordSlackRequestId = result.requestId;
+      byId("password-slack-verify-form").hidden = false;
+      byId("password-slack-status").textContent = "Check your private Slack messages for an 8-digit code. It expires in 5 minutes.";
+      byId("slack-code").focus();
+    });
+  });
+  byId("password-slack-verify-form").addEventListener("submit", (event) => {
+    event.preventDefault();
+    void run(async () => {
+      try {
+        await request("/api/auth/password-slack/verify", { requestId: passwordSlackRequestId, code: byId("slack-code").value.trim() });
+      } finally { byId("slack-code").value = ""; }
+      passwordSlackRequestId = "";
+      location.replace("/");
+    });
+  });
+  byId("slack-user").addEventListener("input", () => {
+    passwordSlackRequestId = "";
+    byId("slack-code").value = "";
+    byId("password-slack-verify-form").hidden = true;
+    byId("password-slack-status").textContent = "";
+  });
+
   byId("bootstrap-form").addEventListener("submit", (event) => {
     event.preventDefault();
     void run(async () => {
@@ -154,6 +199,8 @@
     void run(async () => {
       const status = await request("/api/auth/status");
       byId("bootstrap").hidden = !status.bootstrapAvailable;
+      byId("password-slack").hidden = !status.passwordSlackEnabled;
+      if (status.passwordSlackEnabled) byId("intro").textContent = "Sign in with a passkey or your password and a Slack code.";
       // Refreshing during first-time setup resumes the limited bootstrap session.
       if (status.bootstrapAvailable) {
         const me = await request("/api/auth/me").catch(() => null);
@@ -161,5 +208,9 @@
       }
     });
   }
-  if (!passkeys.available()) byId("err").textContent = "Passkeys need a supported browser and a secure HTTPS connection (or localhost).";
+  if (!passkeys.available()) {
+    byId("sign-in").disabled = true;
+    byId("sign-in").dataset.unavailable = "true";
+    byId("status").textContent = "Passkeys need a supported browser and a secure HTTPS connection (or localhost).";
+  }
 })();
diff --git a/src/config/settings.js b/src/config/settings.js
index b0d6e841..fac794a5 100644
--- a/src/config/settings.js
+++ b/src/config/settings.js
@@ -96,6 +96,10 @@ export function saveSettings(patch, { expectVersion = "" } = {}) {
       if (v === undefined) continue;
       next[k] = k === "publicUrl" ? normalizePublicUrl(v) : v;
     }
+    // A disable/re-enable or password rotation must never resurrect alternate-login proofs.
+    if (next.adminPasswordSlackEnabled !== current.adminPasswordSlackEnabled || next.adminPassword !== current.adminPassword) {
+      next.adminPasswordSlackVersion = (Number(current.adminPasswordSlackVersion) || 0) + 1;
+    }
     // Persist every effective Teams activation change, even A → B → A between Graph
     // refreshes. The comparison and monotonic stamp share the settings write lock.
     if (Object.hasOwn(patch, "teamsMentionReactions") && patch.teamsMentionReactions !== undefined
diff --git a/src/web/admin-auth.js b/src/web/admin-auth.js
index 4a6e5efd..2a7d1e10 100644
--- a/src/web/admin-auth.js
+++ b/src/web/admin-auth.js
@@ -1,12 +1,12 @@
-// WebAuthn ceremonies never run through an agent. Only verified public-key signatures mint
-// dashboard sessions; setup links authorize registration alone, not dashboard access.
+// Authentication never runs through an agent. Verified passkey signatures or the explicitly
+// enabled password-plus-private-Slack-code flow mint sessions; setup links only enroll keys.
 import crypto from 'node:crypto';
 import express from 'express';
 import { generateRegistrationOptions, verifyRegistrationResponse, generateAuthenticationOptions, verifyAuthenticationResponse } from '@simplewebauthn/server';
-import { getPublicUrl, getAdminPassword } from '../config/settings.js';
+import { getPublicUrl, getAdminPassword, getSettings, saveSettings } from '../config/settings.js';
 import { adminAccount, adminPasskeys, adminPasskeyById, bootstrapAvailable, createAdminEnrollment, adminEnrollment, saveAdminPasskey, advanceAdminCounter, listAdminAccounts, deleteAdminPasskey, revokeAdminSessions, adminLinkRequired, eligibleAdminUsers, dashboardUser, adminAccountForUser, ensureUserAdminAccount, createAdminIdentityLink, verifyAdminIdentityLink, cancelAdminIdentityLink, getIdentityLinkState } from '../config/admin-accounts.js';
-import { adminSession, requireRecentAdminAuth, createAdminSession, refreshAdminSession, parseCookies, cookieAttrs } from './auth.js';
-import { clientKey, createLoginLimiter } from './security.js';
+import { adminSession, requireRecentAdminAuth, createAdminSession, refreshAdminSession, parseCookies, cookieAttrs, adminPasswordFingerprint } from './auth.js';
+import { clientKey, createLoginLimiter, hashPassword, verifyPassword } from './security.js';
 import { logEvent } from '../util/logger.js';
 
 const FIVE_MIN = 5 * 60_000;
@@ -15,6 +15,9 @@ const pending = new Map();
 const failures = createLoginLimiter();
 const starts = createLoginLimiter({ freeAttempts: 20, baseDelayMs: 1000, maxDelayMs: 60_000, ttlMs: 60_000, globalMaxFailures: 500, globalWindowMs: 60_000 });
 const COOKIE = 'cg_webauthn';
+const passwordSlackPending = new Map();
+const slackAdmin = id => typeof id === 'string' && /^[UW][A-Z0-9]{8,}$/.test(id) && dashboardUser(id)?.isAdmin === true;
+const passwordSlackVersion = () => Number(getSettings().adminPasswordSlackVersion) || 0;
 function reject(message, status = 400) { const error = new Error(message); error.status = status; error.expose = true; throw error; }
 const loopback = host => ['localhost', '127.0.0.1', '[::1]'].includes(host);
 // A configured public URL is authoritative. With none configured only an explicitly loopback
@@ -110,7 +113,7 @@ function safe(handler) {
     res.setHeader('Cache-Control', 'no-store');
     res.setHeader('Referrer-Policy', 'no-referrer');
     try { await handler(req, res); } catch (error) {
-      if (/^\/(login|reauth|register|enroll)\/(options|verify)\/?$/.test(req.path) && error.status !== 429) {
+      if (/^\/(login|reauth|register|enroll|password-slack)\/(options|verify)\/?$/.test(req.path) && error.status !== 429) {
         for (const key of rateKeys(req, req.adminAuthAccountId)) failures.recordFailure(key);
       }
       // Verifier error strings may contain attacker-controlled assertions. Do not log or echo.
@@ -123,13 +126,94 @@ export function createAdminAuthRouter({ adminIdentityDelivery } = {}) {
   const router = express.Router({ caseSensitive: true });
   router.get('/status', safe(async (req, res) => {
     const rp = adminRelyingParty(req);
-    res.json({ bootstrapAvailable: Boolean(getAdminPassword()) && bootstrapAvailable(), ...rp });
+    res.json({ bootstrapAvailable: Boolean(getAdminPassword()) && bootstrapAvailable(), passwordSlackEnabled: getSettings().adminPasswordSlackEnabled === true, ...rp });
   }));
   router.get('/me', safe(async (req, res) => {
     const s = loggedIn(req);
-    res.json({ account: publicAccount(s.account), fresh: requireRecentAdminAuth(req), bootstrap: s.bootstrap, linkRequired: adminLinkRequired(s.account), canLink: canLink(s),
+    res.json({ account: publicAccount(s.account), passwordSlackEnabled: getSettings().adminPasswordSlackEnabled === true, fresh: requireRecentAdminAuth(req), bootstrap: s.bootstrap, linkRequired: adminLinkRequired(s.account), canLink: canLink(s),
       passkeys: adminPasskeys(s.accountId).map(p => ({ id: p.id, name: p.name, createdAt: p.createdAt, lastUsedAt: p.lastUsedAt })) });
   }));
+  router.post('/password-slack/options', safe(async (req, res) => {
+    const rp = ceremonyGuard(req);
+    limited(req, res, failures); limited(req, res, starts, '', true);
+    if (getSettings().adminPasswordSlackEnabled !== true || typeof adminIdentityDelivery !== 'function') reject('Password and Slack code sign-in is unavailable.', 403);
+    const userId = req.body?.userId;
+    if (!slackAdmin(userId)) reject('Unable to sign in with those credentials.', 401);
+    const a = ensureUserAdminAccount(userId);
+    req.adminAuthAccountId = a.id;
+    limited(req, res, failures, a.id); limited(req, res, starts, a.id, true);
+    const version = passwordSlackVersion(); const passwordBefore = getAdminPassword();
+    // Verify directly: an opportunistic legacy hash upgrade would invalidate this ceremony.
+    if (!a.enabled || !passwordBefore || typeof req.body?.password !== 'string' || !(await verifyPassword(req.body.password, passwordBefore))) reject('Unable to sign in with those credentials.', 401);
+    const valid = () => getSettings().adminPasswordSlackEnabled === true && passwordSlackVersion() === version && getAdminPassword() === passwordBefore && slackAdmin(userId) && adminAccount(a.id)?.enabled && adminAccount(a.id)?.authVersion === a.authVersion;
+    if (!valid()) reject('Account access changed. Start again.', 401);
+    const now = Date.now();
+    for (const [key, value] of passwordSlackPending) if (value.expiresAt <= now) passwordSlackPending.delete(key);
+    if (passwordSlackPending.size >= MAX_PENDING) reject('Authentication is busy. Try again shortly.', 429);
+    const binding = browserBinding(req, res);
+    // One outstanding code per browser/account; a resend retires the previous code.
+    for (const [key, value] of passwordSlackPending) if (value.binding === binding && value.accountId === a.id) passwordSlackPending.delete(key);
+    const requestId = crypto.randomBytes(24).toString('base64url');
+    const code = String(crypto.randomInt(10_000_000, 100_000_000));
+    const digest = crypto.createHash('sha256').update(`${requestId}\0${code}`).digest('hex');
+    const saved = { binding, accountId: a.id, authVersion: a.authVersion, version, passwordFingerprint: adminPasswordFingerprint(), origin: rp.origin, expiresAt: now + FIVE_MIN, digest, attempts: 0 };
+    passwordSlackPending.set(requestId, saved);
+    try {
+      await adminIdentityDelivery(userId, `ChannelGate dashboard sign-in for ${rp.origin}\nYour sign-in code is: ${code}\nThis code expires in 5 minutes. Enter it only on the gateway page where you requested it. If you did not request this, ignore this message.`);
+      if (!valid() || passwordSlackPending.get(requestId) !== saved || saved.expiresAt <= Date.now()) throw new Error('Access changed');
+    } catch { passwordSlackPending.delete(requestId); reject('The private Slack code could not be delivered, or access changed. Retry sign-in.', 503); }
+    audit('password_slack_code_sent', a);
+    res.json({ requestId, expiresAt: saved.expiresAt });
+  }));
+  router.post('/password-slack/verify', safe(async (req, res) => {
+    const rp = ceremonyGuard(req); limited(req, res, failures);
+    const requestId = req.body?.requestId;
+    const saved = typeof requestId === 'string' ? passwordSlackPending.get(requestId) : null;
+    if (!saved || saved.binding !== parseCookies(req.headers.cookie)[COOKIE] || saved.origin !== rp.origin) reject('Sign-in request expired. Start again.', 401);
+    req.adminAuthAccountId = saved.accountId; limited(req, res, failures, saved.accountId);
+    const a = adminAccount(saved.accountId);
+    if (saved.expiresAt <= Date.now() || saved.attempts >= 5 || getSettings().adminPasswordSlackEnabled !== true || passwordSlackVersion() !== saved.version || saved.passwordFingerprint !== adminPasswordFingerprint() || !a?.enabled || a.authVersion !== saved.authVersion || !slackAdmin(a.userId)) {
+      passwordSlackPending.delete(requestId); reject('Sign-in request expired or access changed. Start again.', 401);
+    }
+    const code = req.body?.code;
+    const digest = crypto.createHash('sha256').update(`${requestId}\0${String(code)}`).digest('hex');
+    if (typeof code !== 'string' || !/^\d{8}$/.test(code) || !crypto.timingSafeEqual(Buffer.from(digest, 'hex'), Buffer.from(saved.digest, 'hex'))) {
+      if (++saved.attempts >= 5) passwordSlackPending.delete(requestId);
+      reject('The verification code is incorrect.', 401);
+    }
+    passwordSlackPending.delete(requestId);
+    createAdminSession(req, res, a, { method: 'password-slack' });
+    for (const key of rateKeys(req, a.id)) { failures.recordSuccess(key); starts.recordSuccess(key); }
+    audit('password_slack_login', a); res.json({ ok: true });
+  }));
+  router.put('/password-slack/settings', safe(async (req, res) => {
+    ceremonyGuard(req); const s = loggedIn(req);
+    if (typeof req.body?.enabled !== 'boolean') reject('Choose whether password and Slack code sign-in is enabled.');
+    const enabled = req.body.enabled;
+    const bootstrap = s.bootstrap && s.account.userId && Date.now() - s.authenticatedAt <= FIVE_MIN;
+    if (!bootstrap) linkedFresh(req);
+    if (!s.account.userId) reject('Verify and link your administrator user first.', 403);
+    const passwordBefore = getAdminPassword(); const version = passwordSlackVersion();
+    if (bootstrap && (!enabled || typeof req.body?.password !== 'string' || !passwordBefore || !(await verifyPassword(req.body.password, passwordBefore)))) reject('Verify the initial setup password before enabling sign-in.', 403);
+    const patch = { adminPasswordSlackEnabled: enabled };
+    if (enabled) {
+      if (!slackAdmin(s.account.userId) || typeof adminIdentityDelivery !== 'function') reject('A linked Slack administrator and private Slack delivery are required.', 403);
+      if (req.body.password !== undefined && req.body.password !== '') {
+        if (typeof req.body.password !== 'string' || req.body.password.length < 12 || req.body.password.length > 1024) reject('Use a password between 12 and 1024 characters.');
+        patch.adminPassword = await hashPassword(req.body.password);
+      }
+      if (!patch.adminPassword && !getAdminPassword()) reject('Set a shared admin password before enabling this sign-in method.');
+    }
+    const current = adminSession(req);
+    if (!current || current.token !== s.token || current.authVersion !== s.authVersion || getAdminPassword() !== passwordBefore || passwordSlackVersion() !== version || (bootstrap ? Date.now() - current.authenticatedAt > FIVE_MIN : !requireRecentAdminAuth(req))) reject('Authentication changed. Start again.', 401);
+    saveSettings(patch); passwordSlackPending.clear();
+    // Preserve this freshly authenticated browser, while old alternate sessions fail validation.
+    const signedOut = !enabled && current.method === 'password-slack';
+    if (!signedOut) createAdminSession(req, res, current.account, { method: bootstrap || current.method === 'password-slack' ? 'password-slack' : 'passkey' });
+    else res.setHeader('Set-Cookie', `cg_session=; ${cookieAttrs(req)}; Max-Age=0`);
+    audit('password_slack_setting_changed', current.account, { enabled });
+    res.json({ ok: true, passwordSlackEnabled: enabled, signedOut });
+  }));
   for (const kind of ['login', 'reauth']) {
     router.post(`/${kind}/options`, safe(async (req, res) => {
       const rp = ceremonyGuard(req);
@@ -251,7 +335,7 @@ export function createAdminAuthRouter({ adminIdentityDelivery } = {}) {
     let updated;
     try { updated = verifyAdminIdentityLink(s.account, req.body?.requestId, req.body?.code, s.token); }
     catch (error) { reject(error.message); }
-    createAdminSession(req, res, updated, { bootstrap: s.bootstrap });
+    createAdminSession(req, res, updated, { bootstrap: s.bootstrap, method: s.method });
     audit('identity_linked', updated, { userId: updated.userId }); res.json({ ok: true });
   }));
   router.get('/users/:userId', safe(async (req, res) => {
@@ -283,7 +367,7 @@ export function createAdminAuthRouter({ adminIdentityDelivery } = {}) {
     const a = adminAccountForUser(user.id);
     if (a) {
       revokeAdminSessions(a.id);
-      if (a.id === s.accountId) createAdminSession(req, res, adminAccount(a.id));
+      if (a.id === s.accountId) createAdminSession(req, res, adminAccount(a.id), { method: s.method });
     }
     audit('sessions_revoked', s.account, { targetUser: user.id }); res.json({ ok: true });
   }));
@@ -291,13 +375,13 @@ export function createAdminAuthRouter({ adminIdentityDelivery } = {}) {
     ceremonyGuard(req); const s = linkedFresh(req);
     if (s.account.userId !== req.params.userId) reject('You can remove only your own passkeys.', 403);
     try { deleteAdminPasskey(s.accountId, req.params.keyId); } catch (error) { reject(error.message); }
-    createAdminSession(req, res, adminAccount(s.accountId)); audit('passkey_removed', s.account); res.json({ ok: true });
+    createAdminSession(req, res, adminAccount(s.accountId), { method: s.method }); audit('passkey_removed', s.account); res.json({ ok: true });
   }));
   router.delete('/passkeys/:id', safe(async (req, res) => {
     ceremonyGuard(req); const s = fresh(req);
     try { deleteAdminPasskey(s.accountId, req.params.id); } catch (error) { reject(error.message); }
     // Other sessions and in-flight ceremonies are revoked, this freshly verified browser rotates.
-    createAdminSession(req, res, adminAccount(s.accountId)); audit('passkey_removed', s.account); res.json({ ok: true });
+    createAdminSession(req, res, adminAccount(s.accountId), { method: s.method }); audit('passkey_removed', s.account); res.json({ ok: true });
   }));
   return router;
 }
diff --git a/src/web/auth.js b/src/web/auth.js
index 100eeee7..cce71fff 100644
--- a/src/web/auth.js
+++ b/src/web/auth.js
@@ -1,6 +1,7 @@
 // Dashboard sessions are bound to individual local admin accounts. The existing shared
 // password can authenticate bootstrap username `admin` only until the first passkey is enrolled.
-// The durable passkey latch prevents a later settings/password edit from restoring that path.
+// The durable passkey latch prevents restoring password-only bootstrap. The optional
+// password-plus-Slack-code path is separately enabled and always verifies both factors.
 // WebAuthn ceremonies live in admin-auth.js; every session use rechecks account authorization.
 import crypto from "node:crypto";
 import { getAdminPassword, getApiKey, getSettings, saveSettings } from "../config/settings.js";
@@ -25,7 +26,7 @@ function sessionValid(token, now = Date.now()) {
     return false;
   }
   const a = adminAccount(s.accountId);
-  if (!a?.enabled || a.authVersion !== s.authVersion || (s.bootstrap && !bootstrapAvailable())) {
+  if (!a?.enabled || a.authVersion !== s.authVersion || (s.bootstrap && !bootstrapAvailable()) || (s.method === 'password-slack' && (getSettings().adminPasswordSlackEnabled !== true || s.passwordFingerprint !== adminPasswordFingerprint() || s.passwordSlackVersion !== (Number(getSettings().adminPasswordSlackVersion) || 0)))) {
     sessions.delete(token); return false;
   }
   s.lastSeenAt = now; // sliding idle window
@@ -58,7 +59,7 @@ export function parseCookies(header) {
 // Verify, and opportunistically retire a legacy cleartext password. Only the settings.json copy
 // is upgraded — an ADMIN_PASSWORD from the environment is owned by whoever wrote .env, so we
 // verify against it but never rewrite config behind their back.
-async function passwordOk(pw) {
+export async function passwordOk(pw) {
   const expected = getAdminPassword();
   if (!expected || !pw) return false;
   const ok = await verifyPassword(String(pw), expected);
@@ -225,14 +226,15 @@ export function requireRecentAdminAuth(req) {
   const s = adminSession(req);
   return Boolean(s && !s.bootstrap && !adminLinkRequired(s.account) && Date.now() - s.authenticatedAt <= 5 * 60_000);
 }
-export function createAdminSession(req, res, a, { bootstrap = false } = {}) {
+export function adminPasswordFingerprint() { return crypto.createHash('sha256').update(getAdminPassword() || '').digest('hex'); }
+export function createAdminSession(req, res, a, { bootstrap = false, method = 'passkey' } = {}) {
   const current = adminAccount(a.id);
   if (!current?.enabled || current.authVersion !== a.authVersion) throw new Error('Account access changed. Start again.');
   const previous = parseCookies(req.headers?.cookie).cg_session;
   if (previous) sessions.delete(previous);
   const token = crypto.randomBytes(32).toString('hex');
   const now = Date.now();
-  sessions.set(token, { createdAt: now, lastSeenAt: now, authenticatedAt: now, accountId: a.id, authVersion: a.authVersion, bootstrap });
+  sessions.set(token, { createdAt: now, lastSeenAt: now, authenticatedAt: now, accountId: a.id, authVersion: a.authVersion, bootstrap, method, ...(method === 'password-slack' ? { passwordFingerprint: adminPasswordFingerprint(), passwordSlackVersion: Number(getSettings().adminPasswordSlackVersion) || 0 } : {}) });
   // Bound memory even if an authenticated client deliberately creates sessions repeatedly.
   while (sessions.size > 10_000) sessions.delete(sessions.keys().next().value);
   res.setHeader('Set-Cookie', `cg_session=${token}; ${cookieAttrs(req)}; Max-Age=${Math.floor(ABSOLUTE_MS / 1000)}`);
diff --git a/src/web/routes/settings.js b/src/web/routes/settings.js
index 6de63311..bde71649 100644
--- a/src/web/routes/settings.js
+++ b/src/web/routes/settings.js
@@ -161,7 +161,7 @@ export function createSettingsRouter({
   });
 
   // Reveal ONE stored secret, on demand. Listing endpoints return has*/last4 only; this is the
-  // single way to see a value. Enrolled installations require recent passkey verification;
+  // single way to see a value. Full individual sessions require recent authentication;
   // before first enrollment the bootstrap password remains the reauthentication credential.
   // Audit the account and requested names, never the secret value or password.
   router.post("/secrets/reveal", async (req, res, next) => {
@@ -174,17 +174,17 @@ export function createSettingsRouter({
       // Re-authenticate even though a valid session got here: a borrowed session should not be
       // able to drain every credential silently. Skipped only when no password is configured at
       // all, in which case there is nothing to re-enter.
-      let enrolled = passkeysConfigured();
+      let enrolled = passkeysConfigured() || adminSession(req)?.method === 'password-slack';
       let authorized = enrolled ? requireRecentAdminAuth(req) : !authEnabled() || await verifyPassword(String(password), getAdminPassword());
       // The first enrollment may finish while scrypt yields. Its permanent mode change and
       // session revocation apply to this request too, before any secret is returned.
-      if (passkeysConfigured()) { enrolled = true; authorized = requireRecentAdminAuth(req); }
+      if (passkeysConfigured() || adminSession(req)?.method === 'password-slack') { enrolled = true; authorized = requireRecentAdminAuth(req); }
       if (!authorized) {
         await logEvent("secret_reveal_denied", { scope: clipLabel(scope), field: clipLabel(field), id: clipLabel(id), actor, author: actor });
-        return res.status(enrolled ? 403 : 401).json({ error: enrolled ? "Verify your passkey before revealing a secret." : "Wrong password", ...(enrolled ? { code: "reauth_required" } : {}) });
+        return res.status(enrolled ? 403 : 401).json({ error: enrolled ? "Verify your sign-in again before revealing a secret." : "Wrong password", ...(enrolled ? { code: "reauth_required" } : {}) });
       }
       const value = await readSecret({ scope, field, id: String(id) });
-      if (passkeysConfigured() && !requireRecentAdminAuth(req)) return res.status(403).json({ error: "Verify your passkey before revealing a secret.", code: "reauth_required" });
+      if (enrolled && !requireRecentAdminAuth(req)) return res.status(403).json({ error: "Verify your sign-in again before revealing a secret.", code: "reauth_required" });
       await logEvent("secret_revealed", { scope, field, id, actor, author: actor });
       res.json({ value });
     } catch (e) {
diff --git a/test/admin-password-slack-browser.test.js b/test/admin-password-slack-browser.test.js
new file mode 100644
index 00000000..dd41e758
--- /dev/null
+++ b/test/admin-password-slack-browser.test.js
@@ -0,0 +1,76 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ensureTestEnv } from './helpers.js';
+ensureTestEnv();
+delete process.env.ADMIN_PASSWORD;
+const { saveSettings } = await import('../src/config/settings.js');
+const { hashPassword } = await import('../src/web/security.js');
+const { setUser } = await import('../src/config/store.js');
+const { createWebApp } = await import('../src/web/app.js');
+
+test('browser completes initial setup and Slack code sign-in without an authenticator', { skip: !process.env.CG_BROWSER_MODULE, timeout: 60_000 }, async (t) => {
+  const password = 'disposable-browser-slack-password';
+  saveSettings({ publicUrl: '', adminPassword: await hashPassword(password), adminPasswordSlackEnabled: false });
+  await setUser('U123456789', { name: 'Fixture administrator', isAdmin: true });
+  let code;
+  const app = createWebApp({ adminIdentityDelivery: async (_id, text) => { code = text.match(/\b\d{8}\b/)[0]; } });
+  const server = await new Promise(resolve => { const s = app.listen(0, '127.0.0.1', () => resolve(s)); });
+  t.after(() => new Promise(resolve => { server.closeAllConnections(); server.close(resolve); }));
+  const base = `http://localhost:${server.address().port}`;
+  const { chromium } = await import(process.env.CG_BROWSER_MODULE);
+  const browser = await chromium.launch({ headless: true, executablePath: process.env.CG_BROWSER_EXECUTABLE });
+  t.after(() => browser.close());
+  const context = await browser.newContext();
+  const page = await context.newPage();
+  const errors = [];
+  page.on('pageerror', error => errors.push(error.message));
+  const request = (route, body) => page.evaluate(async ({ route, body }) => {
+    const r = await fetch(route, { method: body ? 'POST' : 'GET', headers: { 'Content-Type': 'application/json', 'X-CG-Request': '1' }, ...(body ? { body: JSON.stringify(body) } : {}) });
+    return { status: r.status, body: await r.json() };
+  }, { route, body });
+  await page.goto(`${base}/login.html`);
+  await page.locator('#bootstrap').waitFor({ state: 'visible' });
+  await page.locator('#bootstrap summary').click();
+  await page.locator('#pw').fill(password);
+  await page.locator('#bootstrap-submit').click();
+  await page.locator('#link-panel').waitFor({ state: 'visible' });
+  await page.locator('#link-send').click();
+  await page.locator('#link-code').waitFor({ state: 'visible' });
+  await page.locator('#link-code').fill(code);
+  await page.locator('#link-verify').click();
+  await page.locator('#setup-access').waitFor({ state: 'visible' });
+  await page.locator('#setup-access').click();
+  await page.locator('[data-access="password-slack-save"]').waitFor({ state: 'visible' });
+  await page.locator('[data-access="password-slack-password"]').fill(password);
+  await page.locator('[data-access="password-slack-enabled"]').check();
+  await page.waitForFunction(() => globalThis.document.querySelector('[data-access="password-slack-enabled"]')?.checked && !globalThis.document.querySelector('[data-access="bootstrap"]')?.checkVisibility());
+  const me = await request('/api/auth/me');
+  assert.equal(me.body.bootstrap, false);
+  assert.equal(me.body.passkeys.length, 0);
+  assert.equal(me.body.account.userId, 'U123456789');
+  assert.equal((await request('/api/settings')).status, 200);
+  await request('/api/logout', {});
+  await page.goto(`${base}/login.html`);
+  await page.locator('#password-slack').waitFor({ state: 'visible' });
+  await page.locator('#password-slack summary').click();
+  await page.locator('#slack-user').fill('U123456789');
+  await page.locator('#slack-password').fill(password);
+  await page.locator('#password-slack-form button').click();
+  await page.locator('#slack-code').waitFor({ state: 'visible' });
+  assert.equal(await page.locator('#slack-password').inputValue(), '');
+  await page.locator('#slack-code').fill(code);
+  await Promise.all([page.waitForURL(`${base}/`), page.locator('#password-slack-verify-form button').click()]);
+  assert.equal((await request('/api/auth/me')).body.account.userId, 'U123456789');
+  await page.goto(`${base}/settings#set-admin-access`);
+  await page.locator('[data-access="reauth"]').click();
+  await page.locator('[data-auth="password"]').fill(password);
+  await page.locator('[data-auth="submit"]').click();
+  await page.locator('[data-auth="code"]').waitFor({ state: 'visible' });
+  await page.locator('[data-auth="code"]').fill(code);
+  await page.locator('[data-auth="submit"]').click();
+  await page.locator('[data-access="message"]').filter({ hasText: 'Identity verified' }).waitFor();
+  await Promise.all([page.waitForURL(`${base}/login.html`), page.locator('[data-access="password-slack-enabled"]').uncheck()]);
+  assert.equal((await request('/api/auth/me')).status, 401);
+  assert.equal((await request('/api/auth/status')).body.passwordSlackEnabled, false);
+  assert.deepEqual(errors, []);
+});
diff --git a/test/admin-password-slack-race.test.js b/test/admin-password-slack-race.test.js
new file mode 100644
index 00000000..03bfc9e4
--- /dev/null
+++ b/test/admin-password-slack-race.test.js
@@ -0,0 +1,50 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import crypto from 'node:crypto';
+import { ensureTestEnv } from './helpers.js';
+
+ensureTestEnv();
+delete process.env.ADMIN_PASSWORD;
+const settings = await import('../src/config/settings.js');
+const accounts = await import('../src/config/admin-accounts.js');
+const { setUser } = await import('../src/config/store.js');
+const { hashPassword } = await import('../src/web/security.js');
+const { createAdminSession } = await import('../src/web/auth.js');
+const { createWebApp } = await import('../src/web/app.js');
+
+test('bootstrap alternate-login enable cannot overwrite a password rotated while its verification yields', async t => {
+  const password = 'disposable-original-bootstrap-password';
+  const rotatedHash = await hashPassword('disposable-rotated-bootstrap-password');
+  settings.saveSettings({ publicUrl: '', adminPassword: await hashPassword(password), adminPasswordSlackEnabled: false });
+  await setUser('URACEADMIN', { name: 'Fixture administrator', isAdmin: true });
+  const account = accounts.ensureUserAdminAccount('URACEADMIN');
+  let cookie;
+  createAdminSession({ headers: {} }, { setHeader: (_name, value) => { cookie = value.split(';')[0]; } }, account, { bootstrap: true });
+  const app = createWebApp({ adminIdentityDelivery: async () => true });
+  const server = await new Promise(resolve => { const s = app.listen(0, '127.0.0.1', () => resolve(s)); });
+  t.after(() => new Promise(resolve => { server.closeAllConnections(); server.close(resolve); }));
+  const base = `http://localhost:${server.address().port}`;
+  const originalScrypt = crypto.scrypt;
+  t.after(() => { crypto.scrypt = originalScrypt; });
+  let resumeVerification;
+  let signalVerification;
+  const verificationStarted = new Promise(resolve => { signalVerification = resolve; });
+  crypto.scrypt = (...args) => {
+    // Pause exactly the first password verification, then restore the real asynchronous primitive.
+    crypto.scrypt = originalScrypt;
+    resumeVerification = () => originalScrypt(...args);
+    signalVerification();
+  };
+  const enabling = fetch(`${base}/api/auth/password-slack/settings`, {
+    method: 'PUT', headers: { 'Content-Type': 'application/json', 'X-CG-Request': '1', Origin: base, Cookie: cookie },
+    body: JSON.stringify({ enabled: true, password }),
+  });
+  await verificationStarted;
+  settings.saveSettings({ adminPassword: rotatedHash });
+  resumeVerification();
+  const response = await enabling;
+  assert.equal(response.status, 401);
+  assert.match((await response.json()).error, /Authentication changed/);
+  assert.equal(settings.getSettings().adminPasswordSlackEnabled, false);
+  assert.equal(settings.getAdminPassword(), rotatedHash, 'the stale bootstrap request cannot restore its old password');
+});
diff --git a/test/admin-password-slack.test.js b/test/admin-password-slack.test.js
new file mode 100644
index 00000000..0aeb89aa
--- /dev/null
+++ b/test/admin-password-slack.test.js
@@ -0,0 +1,153 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { ensureTestEnv } from './helpers.js';
+
+ensureTestEnv();
+delete process.env.ADMIN_PASSWORD;
+const settings = await import('../src/config/settings.js');
+const accounts = await import('../src/config/admin-accounts.js');
+const { setUser } = await import('../src/config/store.js');
+const { hashPassword } = await import('../src/web/security.js');
+const { createWebApp } = await import('../src/web/app.js');
+const { getDb } = await import('../src/db/index.js');
+const { createAdminSession } = await import('../src/web/auth.js');
+
+// HTTP integration: delivery is captured locally; no Slack message leaves the test.
+test('optional password + private Slack code remains a two-factor, browser-bound login after passkey enrollment', async t => {
+  const originalNow = Date.now;
+  let clockOffset = 0;
+  Date.now = () => originalNow() + clockOffset;
+  t.after(() => { Date.now = originalNow; });
+  const password = 'disposable-password-slack-http';
+  settings.saveSettings({ publicUrl: '', apiKey: '', adminPassword: await hashPassword(password), adminPasswordSlackEnabled: false });
+  await setUser('UPASSWORDADMIN', { name: 'Fixture administrator', isAdmin: true });
+  await setUser('UPASSWORDMEMBER', { name: 'Fixture member', isAdmin: false });
+  await setUser('msteams:fixture-admin', { name: 'Fixture Teams administrator', isAdmin: true });
+  const account = accounts.ensureUserAdminAccount('UPASSWORDADMIN');
+  let administratorCookie;
+  createAdminSession({ headers: {} }, { setHeader: (_name, value) => { administratorCookie = value.split(';')[0]; } }, account);
+  let deliveryMode = 'ok';
+  let releaseDelivery;
+  let signalDelivery;
+  const deliveries = [];
+  const app = createWebApp({ adminIdentityDelivery: async (userId, text) => {
+    const code = text.match(/\b\d{8}\b/)?.[0];
+    assert.match(code, /^\d{8}$/);
+    deliveries.push({ userId, code, text });
+    if (deliveryMode === 'pause') {
+      deliveryMode = 'ok';
+      signalDelivery();
+      await new Promise(resolve => { releaseDelivery = resolve; });
+    }
+    if (deliveryMode === 'fail') throw new Error('fixture delivery failure');
+    if (deliveryMode === 'demote') {
+      await setUser(userId, { isAdmin: false });
+      await setUser(userId, { isAdmin: true });
+    }
+    return true;
+  } });
+  const server = await new Promise(resolve => { const s = app.listen(0, '127.0.0.1', () => resolve(s)); });
+  t.after(() => new Promise(resolve => { server.closeAllConnections(); server.close(resolve); }));
+  const base = `http://localhost:${server.address().port}`;
+  async function request(route, body, cookie = '', method = body === undefined ? 'GET' : 'POST') {
+    const response = await fetch(`${base}${route}`, { method,
+      headers: { 'Content-Type': 'application/json', 'X-CG-Request': '1', Origin: base, Cookie: cookie },
+      ...(body === undefined ? {} : { body: JSON.stringify(body) }) });
+    // Move past intentional failure backoff without slowing the regression or disabling limits.
+    if (response.status >= 400) clockOffset += 61_000;
+    const cookies = response.headers.getSetCookie?.() || [];
+    return { status: response.status, body: await response.json(), cookies,
+      cookie: cookies.map(value => value.split(';')[0]).join('; ') };
+  }
+  const options = (userId = 'UPASSWORDADMIN', suppliedPassword = password, cookie = '') =>
+    request('/api/auth/password-slack/options', { userId, password: suppliedPassword }, cookie);
+  const verify = (proof, code = deliveries.at(-1).code, cookie = proof.cookie) =>
+    request('/api/auth/password-slack/verify', { requestId: proof.body.requestId, code }, cookie);
+  const configure = enabled => request('/api/auth/password-slack/settings', { enabled }, administratorCookie, 'PUT');
+  assert.equal((await request('/api/auth/status')).body.passwordSlackEnabled, false);
+  assert.notEqual((await options()).status, 200);
+  assert.equal(deliveries.length, 0);
+  assert.equal((await configure(true)).status, 200);
+  assert.equal((await request('/api/auth/status')).body.passwordSlackEnabled, true);
+  // A stored fixture key sets the irreversible enrollment latch without pretending to verify WebAuthn.
+  accounts.saveAdminPasskey({ accountId: account.id, authVersion: account.authVersion,
+    credential: { id: 'cGFzc3dvcmQtc2xhY2stZml4dHVyZQ', publicKey: new Uint8Array([1]), counter: 0, transports: ['internal'] }, name: 'Fixture', deviceType: 'singleDevice', backedUp: false });
+  assert.equal((await request('/api/login', { password })).status, 401, 'the old password-only bootstrap stays closed');
+  for (const userId of ['UPASSWORDMEMBER', 'msteams:fixture-admin', 'api', 'missing']) {
+    assert.notEqual((await options(userId)).status, 200);
+  }
+  assert.notEqual((await options('UPASSWORDADMIN', 'wrong-password')).status, 200);
+  assert.equal(deliveries.length, 0);
+  const proof = await options();
+  assert.equal(proof.status, 200);
+  const code = deliveries.at(-1).code;
+  assert.equal(deliveries.at(-1).userId, 'UPASSWORDADMIN');
+  assert.equal(JSON.stringify(proof.body).includes(code), false, 'the code is delivered only privately');
+  assert.equal((await request('/api/settings', undefined, proof.cookie)).status, 401, 'password and pending request cannot authorize dashboard access');
+  assert.notEqual((await verify(proof, code, '')).status, 200, 'another browser cannot consume the code');
+  const login = await verify(proof, code);
+  assert.equal(login.status, 200);
+  const me = await request('/api/auth/me', undefined, login.cookie);
+  assert.equal(me.status, 200);
+  assert.equal(me.body.account.userId, 'UPASSWORDADMIN');
+  assert.equal(me.body.bootstrap, false);
+  assert.equal((await request('/api/settings', undefined, login.cookie)).status, 200);
+  assert.notEqual((await verify(proof, code)).status, 200, 'code cannot be replayed');
+  const expired = await options();
+  clockOffset += 5 * 60_000 + 1;
+  assert.notEqual((await verify(expired)).status, 200, 'expired private codes fail closed');
+  const guesses = await options();
+  const correctCode = deliveries.at(-1).code;
+  const wrongCode = correctCode === '10000000' ? '10000001' : '10000000';
+  for (let attempt = 0; attempt < 5; attempt++) {
+    assert.equal((await verify(guesses, wrongCode)).status, 401);
+  }
+  assert.notEqual((await verify(guesses, correctCode)).status, 200, 'five guesses retire the challenge');
+  clockOffset += 301_000;
+  deliveryMode = 'fail';
+  assert.equal((await options()).status, 503);
+  clockOffset += 301_000;
+  deliveryMode = 'demote';
+  assert.equal((await options()).status, 503, 'role changes during private delivery retire authority');
+  clockOffset += 301_000;
+  deliveryMode = 'ok';
+  const revokedRole = await options();
+  const roleCode = deliveries.at(-1).code;
+  await setUser('UPASSWORDADMIN', { isAdmin: false });
+  await setUser('UPASSWORDADMIN', { isAdmin: true });
+  assert.notEqual((await verify(revokedRole, roleCode)).status, 200);
+  assert.equal((await request('/api/settings', undefined, login.cookie)).status, 401, 'role changes revoke established fallback sessions');
+  clockOffset += 301_000;
+  const rotatedPassword = await options();
+  const oldCode = deliveries.at(-1).code;
+  settings.saveSettings({ adminPassword: await hashPassword(password) });
+  assert.notEqual((await verify(rotatedPassword, oldCode)).status, 200, 'password rotation revokes outstanding codes');
+  clockOffset += 301_000;
+  const active = await options();
+  assert.equal((await verify(active)).status, 200, 'a fresh successful login resets failure backoff');
+  const deliveryStarted = new Promise(resolve => { signalDelivery = resolve; });
+  deliveryMode = 'pause';
+  const superseded = options('UPASSWORDADMIN', password, active.cookie);
+  await deliveryStarted;
+  const replacement = await options('UPASSWORDADMIN', password, active.cookie);
+  releaseDelivery();
+  assert.equal((await superseded).status, 503, 'a slower resend cannot revive its superseded challenge');
+  assert.equal(replacement.status, 200);
+  const activeLogin = await verify(replacement);
+  assert.equal(activeLogin.status, 200);
+  const rotated = await request('/api/auth/users/UPASSWORDADMIN/revoke-sessions', {}, activeLogin.cookie);
+  assert.equal(rotated.status, 200);
+  assert.equal((await request('/api/settings', undefined, activeLogin.cookie)).status, 401);
+  assert.equal((await request('/api/settings', undefined, rotated.cookie)).status, 200);
+  getDb().prepare('DELETE FROM admin_passkeys').run();
+  settings.saveSettings({ slackBotToken: 'fixture-private-slack-token' });
+  const reveal = await request('/api/secrets/reveal', { scope: 'settings', field: 'slackBotToken' }, rotated.cookie);
+  assert.equal(reveal.status, 200, 'fresh alternate auth authorizes reveal even with zero stored passkeys');
+  assert.equal(reveal.body.value, 'fixture-private-slack-token');
+  // Freshly authenticated fallback administrators may turn the option off, revoking their session.
+  assert.equal((await request('/api/auth/password-slack/settings', { enabled: false }, rotated.cookie, 'PUT')).status, 200);
+  assert.equal((await request('/api/settings', undefined, rotated.cookie)).status, 401);
+  assert.notEqual((await options()).status, 200);
+  settings.saveSettings({ adminPasswordSlackEnabled: true });
+  assert.equal((await request('/api/settings', undefined, rotated.cookie)).status, 401, 're-enabling cannot resurrect a retired session');
+});
diff --git a/test/authorization.test.js b/test/authorization.test.js
index 670f0283..312fc1c8 100644
--- a/test/authorization.test.js
+++ b/test/authorization.test.js
@@ -144,3 +144,30 @@ test("a per-channel exclusion refuses an approved member there, never an admin,
   // A malformed list is ignored rather than trusted.
   assert.equal(isAuthorized({ access: "approved", excludedUsers: "U_OUT" }, "U_OUT", false, { isApprovedUser: true }), true);
 });
+
+// Linked execution surfaces inherit the source workspace's policy, including its DM semantics.
+test("linked workspace authorization uses the source DM flag rather than the inbound surface", () => {
+  for (const source of [
+    { workspaceLink: { isDM: true } },
+    { workspacePolicyIsDM: true },
+  ]) {
+    const meta = { ...source, access: "none", allowedUsers: ["UGUEST"], excludedUsers: ["UAPPROVED"] };
+    assert.equal(isAuthorized(meta, "UAPPROVED", false, APPROVED), true, "source DMs ignore per-channel exclusions");
+    assert.equal(isAuthorized(meta, "UGUEST", false, UNKNOWN), false, "source DMs cannot inherit a channel guest escape hatch");
+    assert.match(authorizationDenialReason(meta, false), /not approved to use ChannelGate/);
+  }
+  for (const source of [
+    { workspaceLink: { isDM: false } },
+    { workspaceLink: {} },
+    { workspacePolicyIsDM: false },
+  ]) {
+    const meta = { ...source, access: "admins", excludedUsers: ["UAPPROVED"] };
+    assert.equal(isAuthorized(meta, "UAPPROVED", true, APPROVED), false, "source channel exclusions apply even through a DM-shaped execution surface");
+    assert.match(authorizationDenialReason(meta, true), /restricted to admins/);
+    assert.equal(isAuthorized({ ...meta, access: "none", allowedUsers: ["UGUEST"] }, "UGUEST", true, UNKNOWN), true);
+    assert.match(authorizationDenialReason({ ...meta, access: "none" }, true), /restricted to named users/);
+  }
+  const conflicting = { workspaceLink: { isDM: false }, workspacePolicyIsDM: true, access: "none" };
+  assert.equal(isAuthorized(conflicting, "UADMIN", true, ADMIN), false, "an explicit workspace link takes precedence over the policy hint");
+  assert.match(authorizationDenialReason(conflicting, true), /restricted to named users/);
+});
diff --git a/test/web-security.test.js b/test/web-security.test.js
index 7f77738d..b13977f6 100644
--- a/test/web-security.test.js
+++ b/test/web-security.test.js
@@ -5,8 +5,9 @@ import assert from "node:assert/strict";
 import { mkdirSync, symlinkSync, realpathSync, rmSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { tempDir } from "./helpers.js";
-import {
+import { tempDir, ensureTestEnv } from "./helpers.js";
+ensureTestEnv();
+const {
   isLoopbackHost,
   pathWithin,
   resolveWithinRoot,
@@ -15,7 +16,7 @@ import {
   createLoginLimiter,
   sanitizeMcpMatch,
   sanitizeCodexMcpSelection,
-} from "../src/web/security.js";
+} = await import("../src/web/security.js");
 
 // ── isLoopbackHost ──────────────────────────────────────────────────────────────
 test("isLoopbackHost: loopback forms", () => {