diff --git a/apps/frontend/src/components/ui/auth/SignIn.vue b/apps/frontend/src/components/ui/auth/SignIn.vue
index 3683c57b83a..d7eb5decf62 100644
--- a/apps/frontend/src/components/ui/auth/SignIn.vue
+++ b/apps/frontend/src/components/ui/auth/SignIn.vue
@@ -74,7 +74,8 @@
 							type="colored"
 							color="brand"
 							class="!w-full !justify-center"
-							:href="getAuthUrl(focusedOauthProvider.id, redirectTarget)"
+							:disabled="!oauthCodeChallenge"
+							:href="providerAuthUrl(focusedOauthProvider.id)"
 							:aria-label="
 								formatMessage(messages.continueWithProvider, {
 									provider: focusedOauthProvider.name,
@@ -144,7 +145,8 @@
 							:class="{
 								'!border !border-[var(--color-green)]': lastSignInOAuthProvider === provider.id,
 							}"
-							:href="getAuthUrl(provider.id, redirectTarget, requestsAppSession)"
+							:disabled="!oauthCodeChallenge"
+							:href="providerAuthUrl(provider.id, requestsAppSession)"
 							:aria-label="
 								formatMessage(messages.continueWithProvider, { provider: provider.name })
 							"
@@ -274,6 +276,7 @@ import {
 	isLauncherProtocolV2,
 	LAUNCHER_REAUTH_ACCOUNT_STORAGE_KEY,
 } from '@/composables/launcher-auth.ts'
+import { useOAuthCodeChallenge } from '@/composables/oauth-pkce.ts'
 import { type OAuthProviderId, oauthProviders } from '@/composables/oauth-providers.ts'
 import { useSignIn } from '@/composables/sign-in.ts'
 
@@ -349,22 +352,32 @@ function openSignUp() {
 	})
 }
 
+const oauthCodeChallenge = useOAuthCodeChallenge()
+
+function providerAuthUrl(provider: string, includeAppSession = false) {
+	const challenge = oauthCodeChallenge.value
+	if (!challenge) {
+		return undefined
+	}
+	return getAuthUrl(provider, redirectTarget, includeAppSession, challenge)
+}
+
 const onOAuthProviderClick = (provider: OAuthProviderId, event: MouseEvent) => {
-	beginProviderHandoff(
-		provider,
-		event,
-		getAuthUrl(provider, redirectTarget, requestsAppSession.value),
-		{
-			skip: Boolean(routeQuery.value.launcher || requestsAppSession.value),
-			prepare() {
-				const account = reauthAccount.value
-				if (!account || !import.meta.client) {
-					return
-				}
-				window.sessionStorage.setItem(LAUNCHER_REAUTH_ACCOUNT_STORAGE_KEY, account.id)
-			},
+	const url = providerAuthUrl(provider, requestsAppSession.value)
+	if (!url) {
+		event.preventDefault()
+		return
+	}
+	beginProviderHandoff(provider, event, url, {
+		skip: Boolean(routeQuery.value.launcher || requestsAppSession.value),
+		prepare() {
+			const account = reauthAccount.value
+			if (!account || !import.meta.client) {
+				return
+			}
+			window.sessionStorage.setItem(LAUNCHER_REAUTH_ACCOUNT_STORAGE_KEY, account.id)
 		},
-	)
+	})
 }
 
 const { formatMessage } = useVIntl()
diff --git a/apps/frontend/src/components/ui/auth/SignUp.vue b/apps/frontend/src/components/ui/auth/SignUp.vue
index 83392f4b69d..2f7299e63fd 100644
--- a/apps/frontend/src/components/ui/auth/SignUp.vue
+++ b/apps/frontend/src/components/ui/auth/SignUp.vue
@@ -11,21 +11,24 @@
 			</div>
 			<section class="flex flex-col gap-2.5">
 				<ButtonLink
-					:href="getAuthUrl('google', redirectTarget, requestsAppSession)"
+					:disabled="!oauthCodeChallenge"
+					:href="providerAuthUrl('google')"
 					@click="onOAuthProviderClick('google', $event)"
 				>
 					<GoogleColorIcon />
 					<span>{{ formatMessage(messages.continueWithProvider, { provider: 'Google' }) }}</span>
 				</ButtonLink>
 				<ButtonLink
-					:href="getAuthUrl('microsoft', redirectTarget, requestsAppSession)"
+					:disabled="!oauthCodeChallenge"
+					:href="providerAuthUrl('microsoft')"
 					@click="onOAuthProviderClick('microsoft', $event)"
 				>
 					<MicrosoftColorIcon />
 					<span>{{ formatMessage(messages.continueWithProvider, { provider: 'Microsoft' }) }}</span>
 				</ButtonLink>
 				<ButtonLink
-					:href="getAuthUrl('discord', redirectTarget, requestsAppSession)"
+					:disabled="!oauthCodeChallenge"
+					:href="providerAuthUrl('discord')"
 					@click="onOAuthProviderClick('discord', $event)"
 				>
 					<DiscordColorIcon />
@@ -33,21 +36,24 @@
 				</ButtonLink>
 				<template v-if="showOtherOptions">
 					<ButtonLink
-						:href="getAuthUrl('github', redirectTarget, requestsAppSession)"
+						:disabled="!oauthCodeChallenge"
+						:href="providerAuthUrl('github')"
 						@click="onOAuthProviderClick('github', $event)"
 					>
 						<GitHubColorIcon />
 						<span>{{ formatMessage(messages.continueWithProvider, { provider: 'GitHub' }) }}</span>
 					</ButtonLink>
 					<ButtonLink
-						:href="getAuthUrl('gitlab', redirectTarget, requestsAppSession)"
+						:disabled="!oauthCodeChallenge"
+						:href="providerAuthUrl('gitlab')"
 						@click="onOAuthProviderClick('gitlab', $event)"
 					>
 						<GitLabColorIcon />
 						<span>{{ formatMessage(messages.continueWithProvider, { provider: 'GitLab' }) }}</span>
 					</ButtonLink>
 					<ButtonLink
-						:href="getAuthUrl('steam', redirectTarget, requestsAppSession)"
+						:disabled="!oauthCodeChallenge"
+						:href="providerAuthUrl('steam')"
 						@click="onOAuthProviderClick('steam', $event)"
 					>
 						<SteamColorIcon />
@@ -166,6 +172,7 @@ import { getAuthUrl } from '@/composables/auth.ts'
 import { isAuthEmbedded, useAuthNavigation } from '@/composables/auth-modal.ts'
 import { useProviderOpening } from '@/composables/external-auth.ts'
 import { isLauncherProtocolV2 } from '@/composables/launcher-auth.ts'
+import { useOAuthCodeChallenge } from '@/composables/oauth-pkce.ts'
 import type { OAuthProviderId } from '@/composables/oauth-providers.ts'
 
 interface Props {
@@ -199,13 +206,25 @@ function openSignIn() {
 	})
 }
 
+const oauthCodeChallenge = useOAuthCodeChallenge()
+
+function providerAuthUrl(provider: string) {
+	const challenge = oauthCodeChallenge.value
+	if (!challenge) {
+		return undefined
+	}
+	return getAuthUrl(provider, redirectTarget, requestsAppSession.value, challenge)
+}
+
 const onOAuthProviderClick = (provider: OAuthProviderId, event: MouseEvent) => {
-	beginProviderHandoff(
-		provider,
-		event,
-		getAuthUrl(provider, redirectTarget, requestsAppSession.value),
-		{ skip: Boolean(routeQuery.launcher || requestsAppSession.value) },
-	)
+	const url = providerAuthUrl(provider)
+	if (!url) {
+		event.preventDefault()
+		return
+	}
+	beginProviderHandoff(provider, event, url, {
+		skip: Boolean(routeQuery.launcher || requestsAppSession.value),
+	})
 }
 
 const { formatMessage } = useVIntl()
diff --git a/apps/frontend/src/components/ui/auth/screens/ReauthenticateScreen.vue b/apps/frontend/src/components/ui/auth/screens/ReauthenticateScreen.vue
index 1ccfef653c4..d992db23be3 100644
--- a/apps/frontend/src/components/ui/auth/screens/ReauthenticateScreen.vue
+++ b/apps/frontend/src/components/ui/auth/screens/ReauthenticateScreen.vue
@@ -56,7 +56,8 @@
 						type="colored"
 						color="brand"
 						class="!w-full !justify-center"
-						:href="getAuthUrl(oauthProvider.id, redirectTarget)"
+						:disabled="!oauthCodeChallenge"
+						:href="providerAuthUrl(oauthProvider.id)"
 						:aria-label="
 							formatMessage(messages.signInWithProvider, { provider: oauthProvider.name })
 						"
@@ -103,7 +104,8 @@
 						v-for="provider in oauthProviders"
 						:key="provider.id"
 						class="relative w-full !justify-center"
-						:href="getAuthUrl(provider.id, redirectTarget)"
+						:disabled="!oauthCodeChallenge"
+						:href="providerAuthUrl(provider.id)"
 						:aria-label="formatMessage(messages.signInWithProvider, { provider: provider.name })"
 						@click="onOAuthProviderClick(provider.id, $event)"
 					>
@@ -220,6 +222,7 @@ import {
 	useAuthRoute,
 } from '@/composables/auth-modal.ts'
 import { useProviderOpening } from '@/composables/external-auth.ts'
+import { useOAuthCodeChallenge } from '@/composables/oauth-pkce.ts'
 import { type OAuthProviderId, oauthProviders } from '@/composables/oauth-providers.ts'
 import { getPasskeyCredential } from '@/helpers/passkey.ts'
 
@@ -325,8 +328,23 @@ onMounted(() => {
 
 const { openingProviderName, beginProviderHandoff, cancelProviderOpening } = useProviderOpening()
 
+const oauthCodeChallenge = useOAuthCodeChallenge()
+
+function providerAuthUrl(provider: string) {
+	const challenge = oauthCodeChallenge.value
+	if (!challenge) {
+		return undefined
+	}
+	return getAuthUrl(provider, redirectTarget.value, false, challenge)
+}
+
 function onOAuthProviderClick(provider: OAuthProviderId, event: MouseEvent) {
-	beginProviderHandoff(provider, event, getAuthUrl(provider, redirectTarget.value), {
+	const url = providerAuthUrl(provider)
+	if (!url) {
+		event.preventDefault()
+		return
+	}
+	beginProviderHandoff(provider, event, url, {
 		skip: Boolean(route.query.launcher),
 	})
 }
diff --git a/apps/frontend/src/composables/auth.ts b/apps/frontend/src/composables/auth.ts
index e40493261eb..9818feec915 100644
--- a/apps/frontend/src/composables/auth.ts
+++ b/apps/frontend/src/composables/auth.ts
@@ -6,7 +6,6 @@ import { useAuthCookie } from '@/composables/auth-cookie.ts'
 import { useAuthRoute } from '@/composables/auth-modal.ts'
 import {
 	getQueryString,
-	isLauncherProtocolV2,
 	LAUNCHER_APP_SESSION_QUERY_PARAM,
 	LAUNCHER_AUTH_QUERY_PARAMS,
 } from '@/composables/launcher-auth.ts'
@@ -70,7 +69,7 @@ export const useAuth = async (
 
 export const initAuth = async (
 	oldToken: string | null | undefined = null,
-	route?: AuthInitRoute,
+	_route?: AuthInitRoute,
 ) => {
 	const auth: AuthState = {
 		user: null,
@@ -81,7 +80,6 @@ export const initAuth = async (
 		return auth
 	}
 
-	const resolvedRoute = route ?? useRoute()
 	const authCookie = useAuthCookie()
 
 	if (oldToken) {
@@ -91,29 +89,6 @@ export const initAuth = async (
 		}
 	}
 
-	const oauthCode = normalizeAuthToken(resolvedRoute.query.code)
-	const keepsExistingLauncherSession = isLauncherProtocolV2(resolvedRoute)
-	if (
-		oauthCode &&
-		!keepsExistingLauncherSession &&
-		!resolvedRoute.fullPath.includes('new_account=true')
-	) {
-		authCookie.value = oauthCode
-	}
-
-	if (
-		resolvedRoute.fullPath.includes('new_account=true') &&
-		resolvedRoute.path !== '/auth/welcome'
-	) {
-		const redirect = resolvedRoute.path.startsWith('/auth/') ? null : resolvedRoute.fullPath
-
-		await navigateTo(
-			`/auth/welcome?authToken=${oauthCode}${
-				redirect ? `&redirect=${encodeURIComponent(redirect)}` : ''
-			}`,
-		)
-	}
-
 	const tokenStr = normalizeAuthToken(authCookie.value)
 	let shouldRefresh = false
 
@@ -207,7 +182,12 @@ export const getSignInRouteObj = (route: FullPathRoute, redirectOverride?: strin
 
 export const ADD_ACCOUNT_QUERY_PARAM = 'add_account'
 
-export const getAuthUrl = (provider: string, redirect?: string, includeAppSession = false) => {
+export const getAuthUrl = (
+	provider: string,
+	redirect?: string,
+	includeAppSession = false,
+	codeChallenge?: string | null,
+) => {
 	const config = useRuntimeConfig()
 	const route = useAuthRoute()
 	const launcher = getQueryString(route.query.launcher)
@@ -235,7 +215,9 @@ export const getAuthUrl = (provider: string, redirect?: string, includeAppSessio
 		callbackUrl.searchParams.set(ADD_ACCOUNT_QUERY_PARAM, 'true')
 	}
 
-	return `${config.public.apiBaseUrl}auth/init?provider=${provider}&url=${encodeURIComponent(callbackUrl.toString())}`
+	const challengeQuery = codeChallenge ? `&code_challenge=${encodeURIComponent(codeChallenge)}` : ''
+
+	return `${config.public.apiBaseUrl}auth/init?provider=${provider}&url=${encodeURIComponent(callbackUrl.toString())}${challengeQuery}`
 }
 
 export const promotePendingSignInOAuthProvider = () => {
diff --git a/apps/frontend/src/composables/oauth-pkce.ts b/apps/frontend/src/composables/oauth-pkce.ts
new file mode 100644
index 00000000000..66a46876f40
--- /dev/null
+++ b/apps/frontend/src/composables/oauth-pkce.ts
@@ -0,0 +1,88 @@
+import { onMounted, ref } from 'vue'
+
+const VERIFIER_KEY = 'modrinth-oauth-pkce-verifier'
+const LOGIN_CODE_PREFIX = 'mlc_'
+
+const claimedLoginCodes = new Set<string>()
+
+export function isLoginCode(code: string) {
+	return code.startsWith(LOGIN_CODE_PREFIX) && isLoginCodeBody(code.slice(LOGIN_CODE_PREFIX.length))
+}
+
+export function claimLoginCode(code: string) {
+	if (claimedLoginCodes.has(code)) {
+		return false
+	}
+	claimedLoginCodes.add(code)
+	return true
+}
+
+export function readOauthCodeVerifier() {
+	if (!import.meta.client) {
+		return null
+	}
+
+	const verifier = window.sessionStorage.getItem(VERIFIER_KEY)
+	if (!verifier || !isPkceVerifier(verifier)) {
+		return null
+	}
+	return verifier
+}
+
+export function clearOauthCodeVerifier() {
+	if (!import.meta.client) {
+		return
+	}
+	window.sessionStorage.removeItem(VERIFIER_KEY)
+}
+
+export async function ensureOauthCodeChallenge() {
+	let verifier = readOauthCodeVerifier()
+	if (!verifier) {
+		verifier = createVerifier()
+		window.sessionStorage.setItem(VERIFIER_KEY, verifier)
+	}
+	return codeChallengeForVerifier(verifier)
+}
+
+export function useOAuthCodeChallenge() {
+	const challenge = ref<string | null>(null)
+
+	onMounted(() => {
+		void ensureOauthCodeChallenge()
+			.then((value) => {
+				challenge.value = value
+			})
+			.catch((error: unknown) => {
+				console.error(error)
+			})
+	})
+
+	return challenge
+}
+
+function createVerifier() {
+	return bytesToBase64Url(crypto.getRandomValues(new Uint8Array(32)))
+}
+
+async function codeChallengeForVerifier(verifier: string) {
+	const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))
+	return bytesToBase64Url(new Uint8Array(digest))
+}
+
+function isPkceVerifier(value: string) {
+	return /^[A-Za-z0-9._~-]{43,128}$/.test(value)
+}
+
+function isLoginCodeBody(value: string) {
+	return /^[A-Za-z0-9]{43}$/.test(value)
+}
+
+function bytesToBase64Url(bytes: Uint8Array) {
+	let binary = ''
+	for (const byte of bytes) {
+		binary += String.fromCharCode(byte)
+	}
+
+	return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replaceAll('=', '')
+}
diff --git a/apps/frontend/src/composables/sign-in.ts b/apps/frontend/src/composables/sign-in.ts
index 531fb436dfa..d1284a56452 100644
--- a/apps/frontend/src/composables/sign-in.ts
+++ b/apps/frontend/src/composables/sign-in.ts
@@ -34,11 +34,16 @@ import {
 	getQueryString,
 	hideLauncherSessionCode,
 	isLauncherProtocolV2,
-	LAUNCHER_APP_CODE_QUERY_PARAM,
 	LAUNCHER_REAUTH_ACCOUNT_STORAGE_KEY,
 	launcherAuthMessages,
 	type LauncherHandoff,
 } from '@/composables/launcher-auth.ts'
+import {
+	claimLoginCode,
+	clearOauthCodeVerifier,
+	isLoginCode,
+	readOauthCodeVerifier,
+} from '@/composables/oauth-pkce.ts'
 import { getPasskeyCredential } from '@/helpers/passkey.ts'
 
 type LauncherCallback = Extract<LauncherHandoff, { type: 'callback' }>
@@ -86,6 +91,10 @@ export function provideSignIn() {
 			id: 'auth.sign-in.title',
 			defaultMessage: 'Sign In',
 		},
+		signInCodeFailed: {
+			id: 'auth.sign-in.code-failed',
+			defaultMessage: 'This sign-in link is invalid or has expired. Try again.',
+		},
 	})
 
 	useAuthPageTitle(() => formatMessage(messages.signInTitle))
@@ -103,7 +112,8 @@ export function provideSignIn() {
 	const isAddingAccount = route.query[ADD_ACCOUNT_QUERY_PARAM] !== undefined
 	const isLauncherSignIn = route.query.launcher !== undefined
 	const storedAccounts = useStoredAccounts()
-	const signInReady = ref(!isLauncherSignIn)
+	const pendingLoginCode = isLoginCode(getQueryString(route.query.code) ?? '')
+	const signInReady = ref(!isLauncherSignIn && !pendingLoginCode)
 	const email = ref('')
 	const password = ref('')
 	const token = ref('')
@@ -203,29 +213,24 @@ export function provideSignIn() {
 		}
 	})
 
-	function sessionTokensFromRoute() {
-		const session = getQueryString(route.query.code) ?? ''
-		const appSession = getQueryString(route.query[LAUNCHER_APP_CODE_QUERY_PARAM]) ?? ''
-		return {
-			session: session.startsWith('mra_') ? session : null,
-			appSession: appSession.startsWith('mra_') ? appSession : null,
-		}
+	function notifySignInCodeFailed() {
+		addNotification({
+			title: formatMessage(commonMessages.errorNotificationTitle),
+			text: formatMessage(messages.signInCodeFailed),
+			type: 'error',
+		})
+		signInReady.value = true
 	}
 
 	onMounted(async () => {
+		await finishSessionCode()
+
 		if (!isLauncherSignIn) {
 			return
 		}
 
 		hydrateStoredAccounts()
 
-		if (isProtocolV2) {
-			const { session, appSession } = sessionTokensFromRoute()
-			if (session) {
-				await completeProtocolV2SignIn(session, appSession, readPendingAuthMethod())
-			}
-		}
-
 		if (launcherHandoff.value) {
 			signInReady.value = true
 			return
@@ -549,10 +554,42 @@ export function provideSignIn() {
 	}
 
 	async function finishSessionCode() {
-		if (!route.query.code || isProtocolV2) {
+		if (!import.meta.client) {
+			return
+		}
+
+		const code = getQueryString(route.query.code) ?? ''
+		const signInCodeRequired = getQueryString(route.query.error) === 'sign_in_code_required'
+		if (!code && !signInCodeRequired) {
 			return
 		}
-		await finishSignIn()
+		if (!claimLoginCode(code || 'sign_in_code_required')) {
+			return
+		}
+
+		hideLauncherSessionCode()
+		if (!isLoginCode(code)) {
+			notifySignInCodeFailed()
+			return
+		}
+
+		const verifier = readOauthCodeVerifier()
+		clearOauthCodeVerifier()
+		if (!verifier) {
+			notifySignInCodeFailed()
+			return
+		}
+
+		try {
+			const session = await client.labrinth.auth_v2.exchangeLoginCode({
+				code,
+				verifier,
+			})
+			await finishSignIn(session.session, session.app_session, readPendingAuthMethod())
+		} catch (error) {
+			console.error(error)
+			notifySignInCodeFailed()
+		}
 	}
 
 	const signIn = {
diff --git a/apps/frontend/src/locales/en-US/index.json b/apps/frontend/src/locales/en-US/index.json
index 78b12f9397c..1bb5fad7274 100644
--- a/apps/frontend/src/locales/en-US/index.json
+++ b/apps/frontend/src/locales/en-US/index.json
@@ -890,6 +890,9 @@
   "auth.sign-in.choose-existing-account": {
     "message": "Use an existing account"
   },
+  "auth.sign-in.code-failed": {
+    "message": "This sign-in link is invalid or has expired. Try again."
+  },
   "auth.sign-in.continue-with-email": {
     "message": "Continue with Email"
   },
diff --git a/apps/frontend/src/pages/auth/sign-in.vue b/apps/frontend/src/pages/auth/sign-in.vue
index d6dfdc6dd14..3c00bde2d8c 100644
--- a/apps/frontend/src/pages/auth/sign-in.vue
+++ b/apps/frontend/src/pages/auth/sign-in.vue
@@ -4,4 +4,8 @@
 
 <script setup lang="ts">
 import SignInScreen from '@/components/ui/auth/screens/SignInScreen.vue'
+
+useHead({
+	meta: [{ name: 'referrer', content: 'no-referrer' }],
+})
 </script>
diff --git a/apps/labrinth/src/routes/internal/flows.rs b/apps/labrinth/src/routes/internal/flows.rs
index 060565cc7bb..a2503c96750 100644
--- a/apps/labrinth/src/routes/internal/flows.rs
+++ b/apps/labrinth/src/routes/internal/flows.rs
@@ -50,7 +50,7 @@ use rand_chacha::ChaCha20Rng;
 use rand_chacha::rand_core::SeedableRng;
 use reqwest::header::AUTHORIZATION;
 use serde::{Deserialize, Serialize};
-use sha2::Sha256;
+use sha2::{Digest, Sha256};
 use std::collections::HashMap;
 use std::str::FromStr;
 use thiserror::Error;
@@ -71,6 +71,7 @@ pub fn config(cfg: &mut actix_web::web::ServiceConfig) {
         web::scope("/auth")
             .service(init)
             .service(auth_callback)
+            .service(exchange_login_code)
             .service(delete_auth_provider)
             .service(create_oauth_account)
             .service(validate_create_account_with_password)
@@ -1138,6 +1139,10 @@ pub struct AuthorizationInit {
     /// this will be set to the user's auth token from the frontend.
     /// Only first-party session tokens may authorize linking.
     pub auth_token: Option<String>,
+    /// S256 PKCE challenge from the browser tab that started sign-in.
+    /// Required when this flow will issue a session. Ignored for provider linking.
+    #[serde(default)]
+    pub code_challenge: Option<String>,
 }
 #[derive(Serialize, Deserialize, utoipa::ToSchema)]
 pub struct Authorization {
@@ -1154,7 +1159,8 @@ pub struct Authorization {
 		("url" = Url, Query),
 		("provider" = Option<AuthProvider>, Query),
 		("token" = Option<String>, Query),
-		("auth_token" = Option<String>, Query)
+		("auth_token" = Option<String>, Query),
+		("code_challenge" = Option<String>, Query)
 	),
 	responses((status = TEMPORARY_REDIRECT), (status = OK))
 )]
@@ -1241,6 +1247,12 @@ pub async fn init(
         None
     };
 
+    if let Some(challenge) = &info.code_challenge
+        && !is_s256_code_challenge(challenge)
+    {
+        return Err(AuthenticationError::InvalidCredentials);
+    }
+
     let state = DBFlow::OAuth {
         user_id,
         url,
@@ -1250,6 +1262,10 @@ pub async fn init(
     .insert(Duration::minutes(30), &redis)
     .await?;
 
+    if let Some(challenge) = &info.code_challenge {
+        store_oauth_code_challenge(&redis, &state, challenge).await?;
+    }
+
     let url = info.provider.get_redirect_url(state)?;
     Ok(HttpResponse::TemporaryRedirect()
         .append_header(("Location", &*url))
@@ -1262,7 +1278,6 @@ pub async fn init(
 )]
 #[get("/callback")]
 pub async fn auth_callback(
-    req: HttpRequest,
     Query(query): Query<HashMap<String, String>>,
     client: Data<PgPool>,
     redis: Data<RedisPool>,
@@ -1479,29 +1494,32 @@ pub async fn auth_callback(
                     .append_header((LOCATION, redirect_url.as_str()))
                     .json(serde_json::json!({ "url": redirect_url })))
             } else {
-                let sessions = issue_auth_sessions(
-                    req,
-                    user_id,
-                    &mut transaction,
+                transaction.rollback().await.wrap_err(
+                    "rolling back authentication transaction before login code",
+                )?;
+
+                let code_challenge =
+                    take_oauth_code_challenge(&redis, &state).await?;
+                let Some(code_challenge) = code_challenge else {
+                    let mut redirect_url = url.clone();
+                    redirect_url
+                        .query_pairs_mut()
+                        .append_pair("error", "sign_in_code_required");
+
+                    return Ok(HttpResponse::TemporaryRedirect()
+                        .append_header((LOCATION, redirect_url.as_str()))
+                        .json(serde_json::json!({ "url": redirect_url })));
+                };
+
+                let code = insert_pending_login_code(
                     &redis,
+                    user_id,
+                    &code_challenge,
                     requests_app_session(&url),
                 )
                 .await?;
-                transaction.commit().await?;
-
                 let mut redirect_url = url.clone();
-                let session = sessions
-                    .session
-                    .session
-                    .as_deref()
-                    .ok_or(AuthenticationError::InvalidCredentials)?;
-                {
-                    let mut query = redirect_url.query_pairs_mut();
-                    query.append_pair("code", session);
-                    if let Some(app_session) = sessions.app_session {
-                        query.append_pair("app_code", &app_session);
-                    }
-                }
+                redirect_url.query_pairs_mut().append_pair("code", &code);
 
                 Ok(HttpResponse::TemporaryRedirect()
                     .append_header((LOCATION, redirect_url.as_str()))
@@ -1545,6 +1563,229 @@ pub async fn auth_callback(
     Ok(res?)
 }
 
+const OAUTH_PKCE_NAMESPACE: &str = "oauth_pkce:v1";
+const LOGIN_CODE_NAMESPACE: &str = "login_code:v1";
+const LOGIN_CODE_TTL_SECONDS: i64 = 60;
+const OAUTH_FLOW_TTL_SECONDS: i64 = 30 * 60;
+
+#[derive(Serialize, Deserialize)]
+struct PendingLoginCode {
+    user_id: DBUserId,
+    code_challenge: String,
+    include_app_session: bool,
+}
+
+#[derive(Deserialize, utoipa::ToSchema)]
+struct ExchangeLoginCode {
+    pub code: String,
+    pub verifier: String,
+}
+
+/// Exchanges a one-time sign-in code for a session.
+///
+/// The code is single-use. It only succeeds for the PKCE verifier held by the
+/// browser tab that started the flow, so a copied redirect URL cannot sign
+/// someone else in.
+#[utoipa::path(
+	context_path = "/auth",
+	tag = "auth",
+	post,
+	operation_id = "exchangeLoginCode",
+	request_body = ExchangeLoginCode,
+	responses(
+		(status = 200, description = "Session issued", body = serde_json::Value),
+		(status = 401, description = "Invalid sign-in code")
+	)
+)]
+#[post("/code")]
+pub async fn exchange_login_code(
+    req: HttpRequest,
+    pool: Data<PgPool>,
+    redis: Data<RedisPool>,
+    body: web::Json<ExchangeLoginCode>,
+) -> Result<HttpResponse, ApiError> {
+    let pending = take_pending_login_code(&redis, &body.code)
+        .await
+        .wrap_internal_err("taking sign-in code")?;
+    let Some(pending) = pending else {
+        return Err(ApiError::Auth(eyre!(
+            AuthenticationError::InvalidCredentials
+        )));
+    };
+
+    let Some(challenge) = code_challenge_for_verifier(&body.verifier) else {
+        return Err(ApiError::Auth(eyre!(
+            AuthenticationError::InvalidCredentials
+        )));
+    };
+    if !constant_time_eq(&challenge, &pending.code_challenge) {
+        return Err(ApiError::Auth(eyre!(
+            AuthenticationError::InvalidCredentials
+        )));
+    }
+
+    let mut transaction = pool
+        .begin()
+        .await
+        .wrap_internal_err("starting database transaction")?;
+    let session = issue_auth_sessions(
+        req,
+        pending.user_id,
+        &mut transaction,
+        &redis,
+        pending.include_app_session,
+    )
+    .await
+    .wrap_auth_err("exchanging sign-in code")?;
+    transaction
+        .commit()
+        .await
+        .wrap_internal_err("committing database transaction")?;
+
+    Ok(HttpResponse::Ok().json(session))
+}
+
+fn is_s256_code_challenge(challenge: &str) -> bool {
+    challenge.len() == 43
+        && challenge.bytes().all(|byte| {
+            matches!(byte, b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_')
+        })
+}
+
+fn is_login_code(code: &str) -> bool {
+    let Some(body) = code.strip_prefix("mlc_") else {
+        return false;
+    };
+
+    body.len() == 43 && body.bytes().all(|byte| byte.is_ascii_alphanumeric())
+}
+
+fn code_challenge_for_verifier(verifier: &str) -> Option<String> {
+    if !(43..=128).contains(&verifier.len()) {
+        return None;
+    }
+    if !verifier.bytes().all(|byte| {
+        matches!(
+            byte,
+            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'.' | b'_' | b'~'
+        )
+    }) {
+        return None;
+    }
+
+    let digest = Sha256::digest(verifier.as_bytes());
+    Some(URL_SAFE_NO_PAD.encode(digest))
+}
+
+fn constant_time_eq(left: &str, right: &str) -> bool {
+    let left = left.as_bytes();
+    let right = right.as_bytes();
+    if left.len() != right.len() {
+        return false;
+    }
+
+    let mut diff = 0u8;
+    for (left_byte, right_byte) in left.iter().zip(right.iter()) {
+        diff |= left_byte ^ right_byte;
+    }
+    diff == 0
+}
+
+fn new_login_code() -> String {
+    let body = ChaCha20Rng::from_rng(&mut rand::rng())
+        .sample_iter(&Alphanumeric)
+        .take(43)
+        .map(char::from)
+        .collect::<String>();
+    format!("mlc_{body}")
+}
+
+async fn store_oauth_code_challenge(
+    redis: &RedisPool,
+    state: &str,
+    challenge: &str,
+) -> Result<(), AuthenticationError> {
+    let mut connection = redis
+        .connect()
+        .await
+        .wrap_err("connecting to redis to store oauth code challenge")?;
+    let key = connection.key().entity(OAUTH_PKCE_NAMESPACE, state);
+    connection
+        .set(&key, challenge, Some(OAUTH_FLOW_TTL_SECONDS))
+        .await
+        .wrap_err("storing oauth code challenge")?;
+    Ok(())
+}
+
+async fn take_oauth_code_challenge(
+    redis: &RedisPool,
+    state: &str,
+) -> Result<Option<String>, AuthenticationError> {
+    let mut connection = redis
+        .connect()
+        .await
+        .wrap_err("connecting to redis to take oauth code challenge")?;
+    let key = connection.key().entity(OAUTH_PKCE_NAMESPACE, state);
+    let challenge: Option<String> = redis::cmd("GETDEL")
+        .arg(&key)
+        .query_async(&mut connection)
+        .await
+        .wrap_err("taking oauth code challenge")?;
+    Ok(challenge.filter(|challenge| is_s256_code_challenge(challenge)))
+}
+
+async fn insert_pending_login_code(
+    redis: &RedisPool,
+    user_id: DBUserId,
+    code_challenge: &str,
+    include_app_session: bool,
+) -> Result<String, AuthenticationError> {
+    let code = new_login_code();
+    let payload = serde_json::to_string(&PendingLoginCode {
+        user_id,
+        code_challenge: code_challenge.to_string(),
+        include_app_session,
+    })
+    .wrap_err("encoding pending login code")?;
+    let mut connection = redis
+        .connect()
+        .await
+        .wrap_err("connecting to redis to store login code")?;
+    let key = connection.key().entity(LOGIN_CODE_NAMESPACE, &code);
+    connection
+        .set(&key, payload, Some(LOGIN_CODE_TTL_SECONDS))
+        .await
+        .wrap_err("storing login code")?;
+    Ok(code)
+}
+
+async fn take_pending_login_code(
+    redis: &RedisPool,
+    code: &str,
+) -> Result<Option<PendingLoginCode>, eyre::Report> {
+    if !is_login_code(code) {
+        return Ok(None);
+    }
+
+    let mut connection = redis
+        .connect()
+        .await
+        .wrap_err("connecting to redis to take login code")?;
+    let key = connection.key().entity(LOGIN_CODE_NAMESPACE, code);
+    let payload: Option<String> = redis::cmd("GETDEL")
+        .arg(&key)
+        .query_async(&mut connection)
+        .await
+        .wrap_err("taking login code")?;
+    let Some(payload) = payload else {
+        return Ok(None);
+    };
+
+    serde_json::from_str(&payload)
+        .wrap_err("decoding pending login code")
+        .map(Some)
+}
+
 fn requires_dob(provider: AuthProvider) -> bool {
     matches!(
         provider,
@@ -4185,3 +4426,18 @@ pub async fn delete_passkey(
         .wrap_internal_err("committing database transaction")?;
     Ok(HttpResponse::NoContent().finish())
 }
+
+#[cfg(test)]
+mod login_code_tests {
+    use super::code_challenge_for_verifier;
+
+    #[test]
+    fn s256_matches_rfc7636_example() {
+        let challenge = code_challenge_for_verifier(
+            "dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk",
+        )
+        .expect("verifier should be accepted");
+
+        assert_eq!(challenge, "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
+    }
+}
diff --git a/apps/labrinth/src/routes/internal/mod.rs b/apps/labrinth/src/routes/internal/mod.rs
index d31ad83ead6..9cfe0fa8125 100644
--- a/apps/labrinth/src/routes/internal/mod.rs
+++ b/apps/labrinth/src/routes/internal/mod.rs
@@ -75,6 +75,7 @@ pub fn config(cfg: &mut web::ServiceConfig) {
 		session::refresh,
 		flows::init,
 		flows::auth_callback,
+		flows::exchange_login_code,
 		flows::create_oauth_account,
 		flows::discord_community_link,
 		flows::delete_auth_provider,
diff --git a/apps/labrinth/src/search/indexing.rs b/apps/labrinth/src/search/indexing.rs
index 546f6860314..6153820842c 100644
--- a/apps/labrinth/src/search/indexing.rs
+++ b/apps/labrinth/src/search/indexing.rs
@@ -491,7 +491,7 @@ async fn build_search_documents(
             .map(|(_, disclosures)| disclosures)
             .unwrap_or_default()
             .into_iter()
-            .flat_map(|(kind, metadata)| {
+            .flat_map(|(kind, metadata): (String, serde_json::Value)| {
                 let disclosure =
                     match ProjectDisclosure::from_parts(&kind, metadata) {
                         Ok(disclosure) => disclosure,
diff --git a/packages/api-client/src/modules/labrinth/auth/v2.ts b/packages/api-client/src/modules/labrinth/auth/v2.ts
index 792e41cf5eb..7bbca8225a8 100644
--- a/packages/api-client/src/modules/labrinth/auth/v2.ts
+++ b/packages/api-client/src/modules/labrinth/auth/v2.ts
@@ -40,6 +40,23 @@ export class LabrinthAuthV2Module extends AbstractModule {
 		})
 	}
 
+	/**
+	 * Exchange a one-time OAuth sign-in code for a session.
+	 *
+	 * The verifier must be the one generated by the tab that started the flow.
+	 */
+	public async exchangeLoginCode(
+		data: Labrinth.Auth.v2.ExchangeLoginCodeRequest,
+	): Promise<Labrinth.Auth.v2.ExchangeLoginCodeResponse> {
+		return this.client.request<Labrinth.Auth.v2.ExchangeLoginCodeResponse>(`/auth/code`, {
+			api: 'labrinth',
+			version: 2,
+			method: 'POST',
+			body: data,
+			skipAuth: true,
+		})
+	}
+
 	/**
 	 * Create a new account with a password
 	 *
diff --git a/packages/api-client/src/modules/labrinth/types.ts b/packages/api-client/src/modules/labrinth/types.ts
index 14e8109beff..5c3ac7ed3e9 100644
--- a/packages/api-client/src/modules/labrinth/types.ts
+++ b/packages/api-client/src/modules/labrinth/types.ts
@@ -743,6 +743,13 @@ export namespace Labrinth {
 				app_session?: string
 			}
 
+			export type ExchangeLoginCodeRequest = {
+				code: string
+				verifier: string
+			}
+
+			export type ExchangeLoginCodeResponse = AuthSessionResponse
+
 			export type ResetPasswordRequest = {
 				username: string
 				challenge: string