diff --git a/__mocks__/expo-crypto.ts b/__mocks__/expo-crypto.ts
new file mode 100644
index 00000000..8d4e0039
--- /dev/null
+++ b/__mocks__/expo-crypto.ts
@@ -0,0 +1,24 @@
+// Jest stand-in for expo-crypto, whose native AES classes cannot load under Jest. Randomness and digests use Node's
+// crypto so PKCE values are real; tests that need fixed values still mock expo-crypto themselves, which takes precedence.
+import { createHash, randomBytes, randomUUID as nodeRandomUUID } from 'crypto';
+
+export const CryptoDigestAlgorithm = { SHA1: 'SHA-1', SHA256: 'SHA-256', SHA384: 'SHA-384', SHA512: 'SHA-512', MD5: 'MD5' } as const;
+export const CryptoEncoding = { HEX: 'hex', BASE64: 'base64' } as const;
+
+const nodeAlgorithm = (algorithm: string) => algorithm.replace('-', '').toLowerCase();
+
+export const getRandomBytes = (byteCount: number): Uint8Array => new Uint8Array(randomBytes(byteCount));
+export const getRandomBytesAsync = async (byteCount: number): Promise<Uint8Array> => getRandomBytes(byteCount);
+export const randomUUID = (): string => nodeRandomUUID();
+export const digestStringAsync = async (algorithm: string, data: string, options?: { encoding?: string }): Promise<string> =>
+  createHash(nodeAlgorithm(algorithm))
+    .update(data)
+    .digest(options?.encoding === 'base64' ? 'base64' : 'hex');
+export const digest = async (algorithm: string, data: ArrayBuffer | Uint8Array): Promise<ArrayBuffer> => {
+  // A copy into a fresh ArrayBuffer: Node's pooled Buffer may sit on a shared backing store.
+  return new Uint8Array(createHash(nodeAlgorithm(algorithm)).update(Buffer.from(data as ArrayBuffer)).digest()).buffer;
+};
+export const aesEncryptAsync = jest.fn();
+export const aesDecryptAsync = jest.fn();
+export class AESEncryptionKey {}
+export class AESSealedData {}
diff --git a/__mocks__/react-native-passkey.ts b/__mocks__/react-native-passkey.ts
new file mode 100644
index 00000000..8f02cad8
--- /dev/null
+++ b/__mocks__/react-native-passkey.ts
@@ -0,0 +1,8 @@
+// Jest stand-in for react-native-passkey (a native module). Tests set the results they need on these mocks.
+export const Passkey = {
+  isSupported: jest.fn(() => true),
+  get: jest.fn(),
+  create: jest.fn(),
+  getPlatformKey: jest.fn(),
+  createPlatformKey: jest.fn(),
+};
diff --git a/app.config.ts b/app.config.ts
index 819ca559..493d3411 100644
--- a/app.config.ts
+++ b/app.config.ts
@@ -52,6 +52,11 @@ export default ({ config }: ConfigContext): ExpoConfig => ({
     bundleIdentifier: Env.BUNDLE_ID,
     ...(Env.IOS_APPLE_TEAM_ID ? { appleTeamId: Env.IOS_APPLE_TEAM_ID } : {}),
     requireFullScreen: true,
+    // Passkeys: Responder's own relying-party hosts, one per region (passkey workbook section 5.1). Each host serves an
+    // apple-app-site-association listing only this app. Staging and development builds use their own hosts, not these.
+    ...((Env.APP_ENV === 'production' || Env.APP_ENV === 'internal') && {
+      associatedDomains: ['webcredentials:responder.resgrid.com', 'webcredentials:responder-eu-central.resgrid.com'],
+    }),
     infoPlist: {
       UIBackgroundModes: ['remote-notification', 'audio', 'bluetooth-central', 'voip'],
       ITSAppUsesNonExemptEncryption: false,
diff --git a/package.json b/package.json
index 931f8f50..56289e65 100644
--- a/package.json
+++ b/package.json
@@ -131,6 +131,7 @@
     "react-native-keyboard-controller": "1.21.9",
     "react-native-logs": "~5.3.0",
     "react-native-mmkv": "3.3.3",
+    "react-native-passkey": "3.6.2",
     "react-native-permissions": "^5.4.1",
     "react-native-reanimated": "4.5.1",
     "react-native-restart": "0.0.27",
diff --git a/src/api/common/__tests__/client-token-refresh.test.ts b/src/api/common/__tests__/client-token-refresh.test.ts
index fda0665b..9b7af1ab 100644
--- a/src/api/common/__tests__/client-token-refresh.test.ts
+++ b/src/api/common/__tests__/client-token-refresh.test.ts
@@ -409,6 +409,27 @@ describe('API Client - Token Refresh', () => {
     });
   });
 
+  describe('Response Interceptor - application refusals', () => {
+    it('passes a 401 problem refusal straight through: no refresh, no replay of the code', async () => {
+      useAuthStore.setState({
+        accessToken: 'access-token',
+        refreshToken: 'refresh-token',
+        accessTokenObtainedAt: Date.now() - 1000,
+        refreshTokenObtainedAt: Date.now() - 1000,
+        status: 'signedIn',
+        profile: { sub: 'test-user' } as any,
+        userId: 'test-user',
+      });
+      mockAxios.onPost('/Mfa/VerifyStepUp').reply(401, { type: 'invalid_totp', title: 'The code is invalid', status: 401 });
+
+      await expect(api.post('/Mfa/VerifyStepUp', { Code: '000000' })).rejects.toMatchObject({ response: { status: 401, data: { type: 'invalid_totp' } } });
+
+      expect(mockedRefreshTokenRequest).not.toHaveBeenCalled();
+      expect(mockAxios.history.post).toHaveLength(1);
+      expect(useAuthStore.getState().status).toBe('signedIn');
+    });
+  });
+
   describe('Token Expiry Helper Methods', () => {
     it('should correctly identify expiring soon tokens', () => {
       const now = Date.now();
diff --git a/src/api/common/client.tsx b/src/api/common/client.tsx
index d8aedcfc..1cbc24ce 100644
--- a/src/api/common/client.tsx
+++ b/src/api/common/client.tsx
@@ -2,6 +2,7 @@ import axios, { type AxiosError, type AxiosInstance, type InternalAxiosRequestCo
 
 import { readProtectedGrantHeaders } from '@/lib/data-protection/grant-provider';
 import { logger } from '@/lib/logging';
+import { CLIENT_HEADER, RESGRID_CLIENT } from '@/lib/mfa/client-app';
 import { getBaseApiUrl } from '@/lib/storage/app';
 import useAuthStore from '@/stores/auth/store';
 
@@ -15,6 +16,8 @@ const axiosInstance: AxiosInstance = axios.create({
   timeout: DEFAULT_REQUEST_TIMEOUT_MS,
   headers: {
     'Content-Type': 'application/json',
+    // Which app is calling (passkey plan section 10.4): passkeys, brokered SSO and approvals are bound to it.
+    [CLIENT_HEADER]: RESGRID_CLIENT,
   },
 });
 
@@ -131,6 +134,13 @@ axiosInstance.interceptors.response.use(
       return Promise.reject(error);
     }
 
+    // A 401 carrying a problem `type` is the application refusing this request (a wrong code, a session that ended),
+    // not an expired token: the authentication layer answers those with an empty body. Refreshing and replaying would
+    // count a wrong code twice toward the lockout.
+    if (error.response?.status === 401 && typeof (error.response.data as { type?: unknown } | undefined)?.type === 'string') {
+      return Promise.reject(error);
+    }
+
     // Handle 401 errors
     if (error.response?.status === 401 && !(originalRequest as InternalAxiosRequestConfig & { _retry?: boolean })._retry) {
       const authStore = useAuthStore.getState();
diff --git a/src/api/data-protection/data-protection.ts b/src/api/data-protection/data-protection.ts
index 1794dc80..4fe77094 100644
--- a/src/api/data-protection/data-protection.ts
+++ b/src/api/data-protection/data-protection.ts
@@ -69,3 +69,82 @@ export const verifyStepUp = async (code: string) => {
   const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/VerifyStepUp`, { Code: code });
   return response.data;
 };
+
+// ---------------------------------------------------------------------------
+// Step-up by other methods (passkey plan sections 7.8, 7.9 and 8.1): a passkey for this app, approval from the member's
+// Responder, or the department's identity provider. Every method ends in the same StepUpResult grant; the server
+// decides which ones this department and member may use.
+// ---------------------------------------------------------------------------
+
+export interface StepUpMethodsData {
+  /** What this member has and the department accepts for protected data, in the server's order. */
+  Methods: string[];
+  Preferred: string | null;
+  EnrolledMethods: string[];
+  AllowedMethods: string[];
+}
+
+interface PasskeyCeremony {
+  RequestId: string;
+  Options: Record<string, unknown>;
+}
+
+export const getStepUpMethods = async () => {
+  const response = await api.get<{ Data: StepUpMethodsData }>(`${DATA_PROTECTION}/StepUpMethods`);
+  return response.data.Data;
+};
+
+export const getStepUpPasskeyOptions = async () => {
+  const response = await api.post<{ Data: PasskeyCeremony }>(`${DATA_PROTECTION}/PasskeyOptions`, {});
+  return response.data.Data;
+};
+
+export const verifyStepUpPasskey = async (requestId: string, credential: Record<string, unknown>) => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/VerifyPasskey`, { RequestId: requestId, Credential: credential });
+  return response.data;
+};
+
+/** Asks the member's Responder to approve access to protected data; the number is shown on this screen only. */
+export const requestStepUpApproval = async () => {
+  const response = await api.post<{ Data: { ApprovalRequestId: string; MatchNumber: string; ExpiresIn: number } }>('/MfaApproval/Request', { Purpose: 'adp' });
+  return response.data.Data;
+};
+
+export const getStepUpApprovalStatus = async (approvalRequestId: string) => {
+  const response = await api.post<{ Data: { State: 'pending' | 'approved' | 'denied' | 'expired' | 'canceled' | 'consumed'; ExpiresAt: string | null } }>('/MfaApproval/Status', { ApprovalRequestId: approvalRequestId });
+  return response.data.Data;
+};
+
+export const cancelStepUpApproval = async (approvalRequestId: string) => {
+  await api.post('/MfaApproval/Cancel', { ApprovalRequestId: approvalRequestId });
+};
+
+export const completeStepUpApproval = async (approvalRequestId: string) => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/CompleteApproval`, { ApprovalRequestId: approvalRequestId });
+  return response.data;
+};
+
+export interface StepUpSsoSecrets {
+  returnTarget: string;
+  state: string;
+  codeChallenge: string;
+  platform: string;
+}
+
+/** Begins a provider step-up for protected data, bound to this session (the broker reads the app from the session). */
+export const beginStepUpSso = async (secrets: StepUpSsoSecrets) => {
+  const response = await api.post<{ Data: { AuthorizeUrl: string; SsoTransactionId: string; ExpiresIn: number } }>('/Sso/Begin', {
+    Purpose: 'adp_step_up',
+    ReturnTarget: secrets.returnTarget,
+    State: secrets.state,
+    CodeChallenge: secrets.codeChallenge,
+    CodeChallengeMethod: 'S256',
+    Platform: secrets.platform,
+  });
+  return response.data.Data;
+};
+
+export const completeStepUpFederated = async (ssoTransactionId: string, ssoCode: string, codeVerifier: string) => {
+  const response = await api.post<StepUpResult>(`${DATA_PROTECTION}/CompleteFederated`, { SsoTransactionId: ssoTransactionId, SsoCode: ssoCode, CodeVerifier: codeVerifier });
+  return response.data;
+};
diff --git a/src/api/mfa/account-security.ts b/src/api/mfa/account-security.ts
new file mode 100644
index 00000000..0b1d3c0a
--- /dev/null
+++ b/src/api/mfa/account-security.ts
@@ -0,0 +1,171 @@
+import type { PasskeyCeremonyData, PasskeyData, SsoBeginData, SsoRedeemData } from '@/lib/mfa/types';
+
+import { api } from '../common/client';
+
+// ---------------------------------------------------------------------------
+// The signed-in side of sign-in methods (passkey plan sections 6.5, 7.6 and 7.9): the account methods view, passkeys for
+// this app, Responder approval as the approver, and the fresh verification the server asks for before any change.
+// Bodies are PascalCase; results carry their payload in `Data`.
+// ---------------------------------------------------------------------------
+
+const data = async <T>(request: Promise<{ data: { Data: T } }>): Promise<T> => (await request).data.Data;
+
+// ---- Approving another app's sign-in (Responder is the approver) -----------------------------------------------------
+
+export interface PendingApprovalData {
+  ApprovalRequestId: string;
+  RequestingApp: string | null;
+  InstallationLabel: string | null;
+  Shared: boolean;
+  Department: string | null;
+  Purpose: 'login' | 'step_up' | 'adp' | 'unlock' | 'department_entry';
+  Operation: string | null;
+  OriginRegion: string | null;
+  CreatedAt: string | null;
+  ExpiresAt: string | null;
+  AttemptsRemaining: number;
+}
+
+export const getPendingApproval = () => data<PendingApprovalData | null>(api.get('/MfaApproval/Pending'));
+
+export const getApprovalOptions = (approvalRequestId: string) => data<PasskeyCeremonyData>(api.post('/MfaApproval/Options', { ApprovalRequestId: approvalRequestId }));
+
+export const approveRequest = (approvalRequestId: string, matchNumber: string, requestId: string, credential: Record<string, unknown>) =>
+  data<{ State: string }>(api.post('/MfaApproval/Approve', { ApprovalRequestId: approvalRequestId, MatchNumber: matchNumber, RequestId: requestId, Credential: credential }));
+
+export const denyRequest = (approvalRequestId: string, reason: 'declined' | 'not_me') => data<{ State: string }>(api.post('/MfaApproval/Deny', { ApprovalRequestId: approvalRequestId, Reason: reason }));
+
+// ---- Account methods view (plan section 6.5) --------------------------------------------------------------------------
+
+export interface TotpMethodData {
+  Enrolled: boolean;
+  EnrolledOn: string | null;
+  LastUsedOn: string | null;
+  RecoveryCodesRemaining: number;
+  RecoveryCodeWarning: boolean;
+  SetUpOnSharedInstallation: boolean;
+  CanTurnOff: boolean;
+}
+
+export interface PasskeyGroupData {
+  Client: string;
+  RegistrationAvailable: boolean;
+  Passkeys: PasskeyData[];
+}
+
+export interface ApprovalInstallationData {
+  InstallationId: string;
+  Label: string | null;
+  Platform: string | null;
+  IsCurrent: boolean;
+  ApprovalsOn: boolean;
+  StoppedOn: string | null;
+  LastDecisionOn: string | null;
+  LastDecision: 'approved' | 'denied' | null;
+}
+
+export interface LinkedIdentityData {
+  DepartmentId: number;
+  DepartmentName: string | null;
+  ProviderType: string | null;
+  LinkedOn: string | null;
+  AcceptsProviderStepUp: boolean;
+  LastProviderStepUpOn: string | null;
+}
+
+export interface MfaActivityData {
+  ActivityId: string;
+  OccurredOn: string;
+  Method: string;
+  Purpose: string;
+  Successful: boolean;
+  Client: string | null;
+  Installation: string | null;
+  SharedInstallation: boolean;
+  IsCurrentSession: boolean;
+  ReportedOn: string | null;
+}
+
+export interface AccountMethodsData {
+  CurrentClient: string | null;
+  Totp: TotpMethodData;
+  PasskeyGroups: PasskeyGroupData[];
+  ApprovalInstallations: ApprovalInstallationData[];
+  LinkedIdentities: LinkedIdentityData[];
+  RecentActivity: MfaActivityData[];
+}
+
+export const getAccountMethods = () => data<AccountMethodsData>(api.get('/AccountSecurity/Methods'));
+
+/** "This wasn't me": ends the session a verification served and sends a notice. */
+export const reportActivity = (activityId: string) => data<{ SessionEnded: boolean; NextSteps: string[] }>(api.post('/AccountSecurity/ReportActivity', { ActivityId: activityId }));
+
+// ---- Fresh proof before a change (plan sections 6.2 and 7.6 row 14) ----------------------------------------------------
+
+export const reauthenticateWithPassword = (password: string) => data<{ VerifiedAt: string }>(api.post('/AccountSecurity/Reauthenticate', { Password: password }));
+
+export interface SsoReauthSecrets {
+  returnTarget: string;
+  state: string;
+  codeChallenge: string;
+  platform: string;
+}
+
+/** For a member whose department signs in through its identity provider: reauthenticate there instead of with a password. */
+export const beginSsoReauthentication = (secrets: SsoReauthSecrets) =>
+  data<SsoBeginData>(
+    api.post('/Sso/Begin', {
+      Purpose: 'reauth',
+      ReturnTarget: secrets.returnTarget,
+      State: secrets.state,
+      CodeChallenge: secrets.codeChallenge,
+      CodeChallengeMethod: 'S256',
+      Platform: secrets.platform,
+    })
+  );
+
+export const redeemSsoReauthentication = (ssoTransactionId: string, ssoCode: string, codeVerifier: string) =>
+  data<SsoRedeemData>(api.post('/Sso/Redeem', { SsoTransactionId: ssoTransactionId, SsoCode: ssoCode, CodeVerifier: codeVerifier }));
+
+export interface StepUpOptionsData {
+  Methods: string[];
+  Preferred: string | null;
+  EnrollmentRequired: boolean;
+  WindowMinutes: number;
+  Passkey: PasskeyCeremonyData | null;
+}
+
+export const getStepUpOptions = (operation: string) => data<StepUpOptionsData>(api.get('/Mfa/StepUpOptions', { params: { operation } }));
+
+export interface VerifyStepUpInput {
+  Operation: string;
+  Method: 'totp' | 'passkey';
+  Code?: string;
+  RequestId?: string;
+  Credential?: Record<string, unknown>;
+}
+
+export const verifyStepUp = (input: VerifyStepUpInput) => data<{ VerifiedAt: string; ExpiresAt: string }>(api.post('/Mfa/VerifyStepUp', input as unknown as Record<string, unknown>));
+
+// ---- Passkeys for this app (plan section 6.1) --------------------------------------------------------------------------
+
+export const getPasskeyRegistrationOptions = () => data<PasskeyCeremonyData>(api.post('/Passkeys/RegistrationOptions', {}));
+
+export const completePasskeyRegistration = (requestId: string, credential: Record<string, unknown>, displayName: string) =>
+  data<PasskeyData>(api.post('/Passkeys/CompleteRegistration', { RequestId: requestId, Credential: credential, DisplayName: displayName }));
+
+export interface PasskeyChangeData {
+  Revoked: number;
+  SessionsEnded: number;
+  CurrentSessionEnded: boolean;
+}
+
+export const renamePasskey = (passkeyId: string, displayName: string) => data<PasskeyChangeData>(api.post('/Passkeys/Rename', { PasskeyId: passkeyId, DisplayName: displayName }));
+
+export const revokePasskey = (passkeyId: string) => data<PasskeyChangeData>(api.post('/Passkeys/Revoke', { PasskeyId: passkeyId }));
+
+/** Responder passkeys only: whether this passkey may approve other apps' sign-ins. */
+export const setPasskeyApproval = (passkeyId: string, enabled: boolean) => data<PasskeyChangeData>(api.post('/Passkeys/SetApproval', { PasskeyId: passkeyId, Enabled: enabled }));
+
+export const stopApprovalInstallations = (installationId: string | null) =>
+  data<{ InstallationsStopped: number; PasskeysStopped: number }>(api.post('/MfaApproval/Installations/Disable', installationId ? { InstallationId: installationId, All: false } : { All: true }));
diff --git a/src/app/(app)/__tests__/account-security.test.tsx b/src/app/(app)/__tests__/account-security.test.tsx
new file mode 100644
index 00000000..8574b09a
--- /dev/null
+++ b/src/app/(app)/__tests__/account-security.test.tsx
@@ -0,0 +1,113 @@
+import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
+import React from 'react';
+
+import * as api from '@/api/mfa/account-security';
+import { createPasskeyCredential } from '@/lib/mfa/passkey';
+
+import AccountSecurity from '../account-security';
+
+jest.mock('expo-router', () => ({ Stack: { Screen: () => null } }));
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/api/mfa/account-security');
+jest.mock('@/lib/mfa/passkey', () => ({ createPasskeyCredential: jest.fn(), getPasskeyAssertion: jest.fn(), passkeysSupported: jest.fn(() => true) }));
+jest.mock('@/lib/mfa/sso-browser', () => ({ runSsoRoundTrip: jest.fn() }));
+jest.mock('@/components/ui/modal', () => {
+  const { View } = require('react-native');
+  return {
+    Modal: ({ isOpen, children, ...props }: any) => (isOpen ? <View {...props}>{children}</View> : null),
+    ModalBackdrop: () => null,
+    ModalBody: ({ children }: any) => <View>{children}</View>,
+    ModalContent: ({ children }: any) => <View>{children}</View>,
+    ModalFooter: ({ children }: any) => <View>{children}</View>,
+    ModalHeader: ({ children }: any) => <View>{children}</View>,
+  };
+});
+
+const mocked = api as jest.Mocked<typeof api>;
+const refusal = (status: number, type: string) => Object.assign(new Error(type), { response: { status, data: { type } } });
+const methods: api.AccountMethodsData = {
+  CurrentClient: 'responder',
+  Totp: { Enrolled: true, EnrolledOn: '2026-09-01T00:00:00Z', LastUsedOn: null, RecoveryCodesRemaining: 8, RecoveryCodeWarning: false, SetUpOnSharedInstallation: false, CanTurnOff: true },
+  PasskeyGroups: [
+    { Client: 'responder', RegistrationAvailable: true, Passkeys: [] },
+    { Client: 'web', RegistrationAvailable: false, Passkeys: [{ PasskeyId: 'pk-web', DisplayName: 'Laptop' } as never] },
+  ],
+  ApprovalInstallations: [],
+  LinkedIdentities: [],
+  RecentActivity: [{ ActivityId: 'act-1', OccurredOn: '2026-09-29T10:00:00Z', Method: 'totp', Purpose: 'login', Successful: true, Client: 'web', Installation: null, SharedInstallation: false, IsCurrentSession: false, ReportedOn: null }],
+};
+
+describe('AccountSecurity', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mocked.getAccountMethods.mockResolvedValue(methods);
+  });
+
+  it('adds a passkey after the proof the server asks for, one step at a time', async () => {
+    mocked.getPasskeyRegistrationOptions
+      .mockRejectedValueOnce(refusal(401, 'reauthentication_required'))
+      .mockRejectedValueOnce(refusal(401, 'step_up_required'))
+      .mockResolvedValue({ RequestId: 'req-1', Options: { challenge: 'abc' } });
+    mocked.reauthenticateWithPassword.mockResolvedValue({ VerifiedAt: 'now' });
+    mocked.getStepUpOptions.mockResolvedValue({ Methods: ['totp'], Preferred: 'totp', EnrollmentRequired: false, WindowMinutes: 5, Passkey: null });
+    mocked.verifyStepUp.mockResolvedValue({ VerifiedAt: 'now', ExpiresAt: 'later' });
+    (createPasskeyCredential as jest.Mock).mockResolvedValue({ id: 'new' });
+    mocked.completePasskeyRegistration.mockResolvedValue({ PasskeyId: 'pk-new' } as never);
+
+    const { getByTestId, queryByTestId } = render(<AccountSecurity />);
+    await waitFor(() => expect(getByTestId('account-add-passkey')).toBeTruthy());
+    expect(getByTestId('account-passkeys-web')).toBeTruthy();
+
+    await act(async () => fireEvent.press(getByTestId('account-add-passkey')));
+    await waitFor(() => expect(getByTestId('account-verify-secret')).toBeTruthy());
+    fireEvent.changeText(getByTestId('account-verify-secret'), 'pw');
+    await act(async () => fireEvent.press(getByTestId('account-verify-submit')));
+    expect(mocked.reauthenticateWithPassword).toHaveBeenCalledWith('pw');
+
+    await waitFor(() => expect(mocked.getStepUpOptions).toHaveBeenCalledWith('account_security'));
+    fireEvent.changeText(getByTestId('account-verify-secret'), '123456');
+    await act(async () => fireEvent.press(getByTestId('account-verify-submit')));
+    expect(mocked.verifyStepUp).toHaveBeenCalledWith({ Operation: 'account_security', Method: 'totp', Code: '123456' });
+
+    await waitFor(() => expect(mocked.completePasskeyRegistration).toHaveBeenCalledWith('req-1', { id: 'new' }, ''));
+    await waitFor(() => expect(queryByTestId('account-verify-modal')).toBeNull());
+    expect(getByTestId('account-notice')).toBeTruthy();
+  });
+
+  it('stops when the member declines the proof', async () => {
+    mocked.getPasskeyRegistrationOptions.mockRejectedValue(refusal(401, 'reauthentication_required'));
+    const { getByTestId } = render(<AccountSecurity />);
+    await waitFor(() => expect(getByTestId('account-add-passkey')).toBeTruthy());
+    await act(async () => fireEvent.press(getByTestId('account-add-passkey')));
+    await act(async () => fireEvent.press(getByTestId('account-verify-cancel')));
+    expect(mocked.getPasskeyRegistrationOptions).toHaveBeenCalledTimes(1);
+    expect(mocked.completePasskeyRegistration).not.toHaveBeenCalled();
+  });
+
+  it('reports the refusal instead of asking for proof a third time when no retry is left', async () => {
+    mocked.getPasskeyRegistrationOptions.mockRejectedValue(refusal(401, 'reauthentication_required'));
+    mocked.reauthenticateWithPassword.mockResolvedValue({ VerifiedAt: 'now' });
+    const { getByTestId, queryByTestId } = render(<AccountSecurity />);
+    await waitFor(() => expect(getByTestId('account-add-passkey')).toBeTruthy());
+
+    await act(async () => fireEvent.press(getByTestId('account-add-passkey')));
+    for (let proof = 0; proof < 2; proof++) {
+      await waitFor(() => expect(getByTestId('account-verify-secret')).toBeTruthy());
+      fireEvent.changeText(getByTestId('account-verify-secret'), 'pw');
+      await act(async () => fireEvent.press(getByTestId('account-verify-submit')));
+    }
+
+    await waitFor(() => expect(getByTestId('account-error').props.children).toBe('mfa.errors.reauthentication_required'));
+    expect(queryByTestId('account-verify-modal')).toBeNull();
+    expect(mocked.reauthenticateWithPassword).toHaveBeenCalledTimes(2);
+    expect(mocked.getPasskeyRegistrationOptions).toHaveBeenCalledTimes(3);
+  });
+
+  it('reports a verification that was not the member', async () => {
+    mocked.reportActivity.mockResolvedValue({ SessionEnded: true, NextSteps: [] });
+    const { getByTestId } = render(<AccountSecurity />);
+    await waitFor(() => expect(getByTestId('activity-report-act-1')).toBeTruthy());
+    await act(async () => fireEvent.press(getByTestId('activity-report-act-1')));
+    expect(mocked.reportActivity).toHaveBeenCalledWith('act-1');
+  });
+});
diff --git a/src/app/(app)/__tests__/approve-sign-in.test.tsx b/src/app/(app)/__tests__/approve-sign-in.test.tsx
new file mode 100644
index 00000000..cf4cbe1e
--- /dev/null
+++ b/src/app/(app)/__tests__/approve-sign-in.test.tsx
@@ -0,0 +1,128 @@
+import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
+import React from 'react';
+
+import * as api from '@/api/mfa/account-security';
+import { getPasskeyAssertion } from '@/lib/mfa/passkey';
+import { PasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+
+import ApproveSignIn from '../approve-sign-in';
+
+const mockBack = jest.fn();
+jest.mock('expo-router', () => ({
+  Stack: { Screen: () => null },
+  useLocalSearchParams: () => ({ id: 'ap-1' }),
+  useRouter: () => ({ canGoBack: () => true, back: mockBack, replace: jest.fn() }),
+}));
+jest.mock('react-i18next', () => ({
+  useTranslation: () => ({
+    t: (key: string, options?: Record<string, unknown>) => (options?.count !== undefined ? `${key}:${options.count}` : options?.label !== undefined ? `${key}:${options.label}` : key),
+  }),
+}));
+jest.mock('@/api/mfa/account-security');
+jest.mock('@/lib/mfa/passkey', () => ({ getPasskeyAssertion: jest.fn() }));
+
+const mocked = api as jest.Mocked<typeof api>;
+const pending: api.PendingApprovalData = {
+  ApprovalRequestId: 'ap-1',
+  RequestingApp: 'unit',
+  InstallationLabel: 'Engine 7 tablet',
+  Shared: true,
+  Department: 'Station 1',
+  Purpose: 'unlock',
+  Operation: null,
+  OriginRegion: 'Colorado, US',
+  CreatedAt: '2026-09-29T12:00:00',
+  ExpiresAt: '2026-09-29T12:02:00',
+  AttemptsRemaining: 3,
+};
+const refusal = (status: number, type: string) => Object.assign(new Error(type), { response: { status, data: { type } } });
+
+describe('ApproveSignIn', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mocked.getPendingApproval.mockResolvedValue(pending);
+  });
+
+  it('shows what is asking, then approves with the number and this app\'s passkey', async () => {
+    mocked.getApprovalOptions.mockResolvedValue({ RequestId: 'req-1', Options: { challenge: 'abc' } });
+    (getPasskeyAssertion as jest.Mock).mockResolvedValue({ id: 'cred' });
+    mocked.approveRequest.mockResolvedValue({ State: 'approved' });
+
+    const { getByTestId, getByText } = render(<ApproveSignIn />);
+    await waitFor(() => expect(getByTestId('approve-details')).toBeTruthy());
+    expect(getByText('mfa.approve.purpose.unlock')).toBeTruthy();
+    expect(getByText('mfa.approve.shared')).toBeTruthy();
+
+    fireEvent.changeText(getByTestId('approve-number'), '42');
+    await act(async () => fireEvent.press(getByTestId('approve-confirm')));
+
+    expect(mocked.approveRequest).toHaveBeenCalledWith('ap-1', '42', 'req-1', { id: 'cred' });
+    expect(getByTestId('approve-approved')).toBeTruthy();
+    fireEvent.press(getByTestId('approve-done'));
+    expect(mockBack).toHaveBeenCalled();
+  });
+
+  it("shows a shared workstation's sign-in as shared and named by the station, and a personal one by its device alone", async () => {
+    mocked.getPendingApproval.mockResolvedValueOnce({ ...pending, Purpose: 'login', RequestingApp: 'dispatch', InstallationLabel: 'Dispatch desk 2', Shared: true });
+    const shared = render(<ApproveSignIn />);
+    await waitFor(() => expect(shared.getByTestId('approve-details')).toBeTruthy());
+    expect(shared.getByText('mfa.approve.purpose.login')).toBeTruthy();
+    expect(shared.getByText('mfa.approve.installation:Dispatch desk 2')).toBeTruthy();
+    expect(shared.getByText('mfa.approve.shared')).toBeTruthy();
+    shared.unmount();
+
+    mocked.getPendingApproval.mockResolvedValueOnce({ ...pending, Purpose: 'login', InstallationLabel: "Pat's iPhone", Shared: false });
+    const personal = render(<ApproveSignIn />);
+    await waitFor(() => expect(personal.getByTestId('approve-details')).toBeTruthy());
+    expect(personal.getByText("mfa.approve.installation:Pat's iPhone")).toBeTruthy();
+    expect(personal.queryByText('mfa.approve.shared')).toBeNull();
+  });
+
+  it('says how many tries are left after a wrong number, and never approves without one', async () => {
+    mocked.getApprovalOptions.mockResolvedValue({ RequestId: 'req-1', Options: {} });
+    (getPasskeyAssertion as jest.Mock).mockResolvedValue({ id: 'cred' });
+    mocked.approveRequest.mockRejectedValueOnce(refusal(400, 'approval_number_mismatch'));
+    mocked.getPendingApproval.mockResolvedValueOnce(pending).mockResolvedValueOnce({ ...pending, AttemptsRemaining: 2 });
+
+    const { getByTestId } = render(<ApproveSignIn />);
+    await waitFor(() => expect(getByTestId('approve-number')).toBeTruthy());
+    expect(getByTestId('approve-confirm').props.accessibilityState?.disabled ?? getByTestId('approve-confirm').props.isDisabled).toBeTruthy();
+
+    fireEvent.changeText(getByTestId('approve-number'), '17');
+    await act(async () => fireEvent.press(getByTestId('approve-confirm')));
+    await waitFor(() => expect(getByTestId('approve-error').props.children).toBe('mfa.approve.number_mismatch:2'));
+  });
+
+  it('keeps the request when the passkey prompt is closed', async () => {
+    mocked.getApprovalOptions.mockResolvedValue({ RequestId: 'req-1', Options: {} });
+    (getPasskeyAssertion as jest.Mock).mockRejectedValue(new PasskeyCeremonyError('cancelled'));
+    const { getByTestId } = render(<ApproveSignIn />);
+    await waitFor(() => expect(getByTestId('approve-number')).toBeTruthy());
+    fireEvent.changeText(getByTestId('approve-number'), '42');
+    await act(async () => fireEvent.press(getByTestId('approve-confirm')));
+    expect(mocked.approveRequest).not.toHaveBeenCalled();
+    expect(getByTestId('approve-error').props.children).toBe('mfa.errors.passkey_cancelled');
+    expect(getByTestId('approve-details')).toBeTruthy();
+  });
+
+  it('denies, or reports that it was not the member', async () => {
+    mocked.denyRequest.mockResolvedValue({ State: 'denied' });
+    const first = render(<ApproveSignIn />);
+    await waitFor(() => expect(first.getByTestId('approve-deny')).toBeTruthy());
+    await act(async () => fireEvent.press(first.getByTestId('approve-deny')));
+    expect(mocked.denyRequest).toHaveBeenCalledWith('ap-1', 'declined');
+    expect(first.getByTestId('approve-denied')).toBeTruthy();
+    first.unmount();
+
+    const second = render(<ApproveSignIn />);
+    await waitFor(() => expect(second.getByTestId('approve-not-me')).toBeTruthy());
+    await act(async () => fireEvent.press(second.getByTestId('approve-not-me')));
+    expect(mocked.denyRequest).toHaveBeenLastCalledWith('ap-1', 'not_me');
+  });
+
+  it('says so when nothing is waiting', async () => {
+    mocked.getPendingApproval.mockResolvedValue(null);
+    const { getByTestId } = render(<ApproveSignIn />);
+    await waitFor(() => expect(getByTestId('approve-none')).toBeTruthy());
+  });
+});
diff --git a/src/app/(app)/__tests__/certification-edit.test.tsx b/src/app/(app)/__tests__/certification-edit.test.tsx
index 91175509..cedce816 100644
--- a/src/app/(app)/__tests__/certification-edit.test.tsx
+++ b/src/app/(app)/__tests__/certification-edit.test.tsx
@@ -123,3 +123,19 @@ describe('EditCertificationScreen', () => {
     expect(getCertification).not.toHaveBeenCalled();
   });
 });
+
+it('saves issued and expiry dates selected from pickers', async () => {
+  mockParams.id = '42';
+  useCertificationsStore.setState({ items: [record()] });
+  jest.mocked(saveCertification).mockResolvedValue(record());
+  const screen = render(<EditCertificationScreen />);
+  fireEvent.press(screen.getByTestId('certification-received'));
+  fireEvent.press(screen.getByTestId('certification-received-day-15'));
+  fireEvent.press(screen.getByTestId('certification-received-done'));
+  fireEvent.press(screen.getByTestId('certification-expires'));
+  fireEvent.press(screen.getByTestId('certification-expires-day-20'));
+  fireEvent.press(screen.getByTestId('certification-expires-done'));
+  fireEvent.press(screen.getByTestId('certification-save'));
+  await waitFor(() => expect(saveCertification).toHaveBeenCalledWith(expect.objectContaining({ ReceivedOn: '2025-01-15', ExpiresOn: '2027-01-20' })));
+  screen.unmount();
+});
diff --git a/src/app/(app)/__tests__/map.test.tsx b/src/app/(app)/__tests__/map.test.tsx
index a794cbe7..4a24a4cd 100644
--- a/src/app/(app)/__tests__/map.test.tsx
+++ b/src/app/(app)/__tests__/map.test.tsx
@@ -4,6 +4,9 @@ import React from 'react';
 
 import { useAnalytics } from '@/hooks/use-analytics';
 import { useMapSignalRUpdates } from '@/hooks/use-map-signalr-updates';
+import { FALLBACK_DAY_MAP_STYLE } from '@/lib/map-style';
+import { GetConfigResultData } from '@/models/v4/configs/getConfigResultData';
+import { useCoreStore } from '@/stores/app/core-store';
 
 import HomeMap from '../map';
 
@@ -116,13 +119,13 @@ jest.mock('@rnmapbox/maps', () => ({
   __esModule: true,
   default: {
     setAccessToken: jest.fn(),
-    StyleURL: {
-      Street: 'mapbox://styles/mapbox/streets-v11',
-      Satellite: 'mapbox://styles/mapbox/satellite-v9',
-    },
-    MapView: ({ children, testID }: any) => {
+    MapView: ({ children, testID, styleURL }: any) => {
       const { View } = require('react-native');
-      return <View testID={testID}>{children}</View>;
+      return (
+        <View testID={testID} styleURL={styleURL}>
+          {children}
+        </View>
+      );
     },
     Camera: ({ children }: any) => {
       const { View } = require('react-native');
@@ -317,6 +320,13 @@ jest.mock('@/stores/calls/active-call-store', () => ({
   },
 }));
 
+// A real store, so the base map style follows department config when it lands after mount.
+jest.mock('@/stores/app/core-store', () => {
+  const { create } = require('zustand');
+
+  return { useCoreStore: create(() => ({ config: null })) };
+});
+
 jest.mock('@/stores/app/location-store', () => {
   let mockState = {
     latitude: 40.7128,
@@ -615,6 +625,36 @@ describe('HomeMap', () => {
     expect(screen.getByTestId('home-map-container')).toBeTruthy();
   });
 
+  describe('department map style', () => {
+    afterEach(() => {
+      useCoreStore.setState({ config: null });
+    });
+
+    it('renders the department day style once config lands', async () => {
+      render(<HomeMap />);
+
+      await waitFor(() => {
+        expect(screen.getByTestId('map-pins')).toBeTruthy();
+      });
+
+      // Before config arrives the map uses the bootstrap fallback, not a hardcoded SDK style.
+      expect(screen.getByTestId('home-map-view').props.styleURL).toBe(FALLBACK_DAY_MAP_STYLE);
+
+      act(() => {
+        useCoreStore.setState({
+          config: Object.assign(new GetConfigResultData(), {
+            MapDayStyleUrl: 'mapbox://styles/mapbox/satellite-v9',
+            MapNightStyleUrl: 'mapbox://styles/mapbox/navigation-night-v1',
+          }),
+        });
+      });
+
+      await waitFor(() => {
+        expect(screen.getByTestId('home-map-view').props.styleURL).toBe('mapbox://styles/mapbox/satellite-v9');
+      });
+    });
+  });
+
   describe('Analytics Tracking', () => {
     it('tracks map view on focus', async () => {
       const mockLocationStore = jest.requireMock('@/stores/app/location-store') as any;
diff --git a/src/app/(app)/_layout.tsx b/src/app/(app)/_layout.tsx
index 4844697c..edb562ab 100644
--- a/src/app/(app)/_layout.tsx
+++ b/src/app/(app)/_layout.tsx
@@ -11,6 +11,7 @@ import { useSafeAreaInsets } from 'react-native-safe-area-context';
 
 import { RealtimeStatusBanner } from '@/components/common/realtime-status-banner';
 import { StepUpPromptHost } from '@/components/data-protection/step-up-prompt-host';
+import { RecoveryCodesModal } from '@/components/mfa/recovery-codes-modal';
 import { NotificationButton } from '@/components/notifications/NotificationButton';
 import { NotificationInbox } from '@/components/notifications/NotificationInbox';
 import SideMenu from '@/components/sidebar/side-menu-content';
@@ -22,10 +23,11 @@ import { Pressable } from '@/components/ui/pressable';
 import { Text } from '@/components/ui/text';
 import { useAppInitRetry } from '@/hooks/use-app-init-retry';
 import { useAppLifecycle } from '@/hooks/use-app-lifecycle';
+import { usePendingApprovalCheck } from '@/hooks/use-pending-approval-check';
 import { useSignalRLifecycle } from '@/hooks/use-signalr-lifecycle';
 import { useAuthStore } from '@/lib/auth';
-import { Env } from '@/lib/env';
 import { logger } from '@/lib/logging';
+import { onMapboxAccessTokenChange } from '@/lib/mapbox-token';
 import { useIsFirstTime } from '@/lib/storage';
 import { loadRealtimeGeolocationState } from '@/lib/storage/realtime-geolocation';
 import { type GetConfigResultData } from '@/models/v4/configs/getConfigResultData';
@@ -46,13 +48,20 @@ import { securityStore } from '@/stores/security/store';
 import { useSignalRStore } from '@/stores/signalr/signalr-store';
 import { useWeatherAlertsStore } from '@/stores/weather-alerts/weather-alerts-store';
 
-Mapbox.setAccessToken(Env.RESPOND_MAPBOX_PUBKEY);
+// Sets the SDK token now (stored server token, else the built-in one) and again whenever it changes.
+// Store listeners run synchronously, before React re-renders, so the SDK has the new token before a
+// map re-renders with a style that needs it. On web, Mapbox.setAccessToken sets mapboxgl.accessToken.
+onMapboxAccessTokenChange((token) => {
+  Mapbox.setAccessToken(token);
+});
 
 export default function TabLayout() {
   const { t } = useTranslation();
   const router = useRouter();
   const pathname = usePathname();
   const status = useAuthStore((state) => state.status);
+  // Approve with Responder: open a waiting request when the app comes to the foreground (the push may be late).
+  usePendingApprovalCheck(status === 'signedIn');
   const [isFirstTime, _setIsFirstTime] = useIsFirstTime();
   const [isOpen, setIsOpen] = React.useState(false);
   const [isNotificationsOpen, setIsNotificationsOpen] = React.useState(false);
@@ -404,6 +413,7 @@ export default function TabLayout() {
         two prompts over each other.
       */}
       <StepUpPromptHost />
+      <RecoveryCodesModal />
 
       {/* Top Navigation Bar */}
       <View className="flex-row items-center justify-between bg-primary-600 px-4" style={{ paddingTop: insets.top }}>
diff --git a/src/app/(app)/account-security.tsx b/src/app/(app)/account-security.tsx
new file mode 100644
index 00000000..445e43d8
--- /dev/null
+++ b/src/app/(app)/account-security.tsx
@@ -0,0 +1,310 @@
+import { Stack } from 'expo-router';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { RefreshControl, ScrollView } from 'react-native';
+
+import {
+  type AccountMethodsData,
+  completePasskeyRegistration,
+  getAccountMethods,
+  getPasskeyRegistrationOptions,
+  renamePasskey,
+  reportActivity,
+  revokePasskey,
+  setPasskeyApproval,
+  stopApprovalInstallations,
+} from '@/api/mfa/account-security';
+import { type AccountProof, AccountVerifyModal } from '@/components/mfa/account-verify-modal';
+import { Box } from '@/components/ui/box';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Heading } from '@/components/ui/heading';
+import { HStack } from '@/components/ui/hstack';
+import { Input, InputField } from '@/components/ui/input';
+import { Spinner } from '@/components/ui/spinner';
+import { Switch } from '@/components/ui/switch';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+import { RESGRID_CLIENT } from '@/lib/mfa/client-app';
+import { toMfaProblem } from '@/lib/mfa/errors';
+import { mfaErrorKey } from '@/lib/mfa/messages';
+import { createPasskeyCredential, passkeysSupported } from '@/lib/mfa/passkey';
+import { isPasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { parseUtc, type PasskeyData } from '@/lib/mfa/types';
+import useAuthStore from '@/stores/auth/store';
+
+const APP_NAMES: Record<string, string> = { web: 'Resgrid Web', responder: 'Resgrid Responder', unit: 'Resgrid Unit', dispatch: 'Resgrid Dispatch', ic: 'Resgrid Command' };
+
+/** A change, and at most two retries after the proof the server asks for. */
+const MAX_ROUNDS = 3;
+
+const when = (value: string | null | undefined): string | null => {
+  const parsed = parseUtc(value);
+  return parsed ? new Date(parsed).toLocaleString() : null;
+};
+
+/**
+ * Sign-in and security (passkey plan section 6.5): the authenticator app and recovery codes, passkeys for this app and
+ * where the others are, the Responder installations that approve sign-ins, linked organization sign-in, and 30 days of
+ * verifications with "This wasn't me". Every change asks for the proof the server requires first.
+ */
+export default function AccountSecurity() {
+  const { t } = useTranslation();
+  const [methods, setMethods] = useState<AccountMethodsData | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [busy, setBusy] = useState(false);
+  const [errorCode, setErrorCode] = useState<string | null>(null);
+  const [notice, setNotice] = useState<string | null>(null);
+  const [renaming, setRenaming] = useState<{ id: string; name: string } | null>(null);
+  const [proof, setProof] = useState<AccountProof | null>(null);
+  const proofResult = useRef<((verified: boolean) => void) | null>(null);
+
+  const load = useCallback(async () => {
+    setLoading(true);
+    try {
+      setMethods(await getAccountMethods());
+      setErrorCode(null);
+    } catch (error) {
+      setErrorCode(toMfaProblem(error).code);
+    } finally {
+      setLoading(false);
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load]);
+
+  /** Asks for the proof the server named, and resolves whether the member gave it. */
+  const prove = useCallback(
+    (kind: AccountProof) =>
+      new Promise<boolean>((resolve) => {
+        proofResult.current = resolve;
+        setProof(kind);
+      }),
+    []
+  );
+
+  const onProofDone = useCallback((verified: boolean) => {
+    setProof(null);
+    proofResult.current?.(verified);
+    proofResult.current = null;
+  }, []);
+
+  /** Runs a change; when the server asks for fresh proof first, asks for it and tries again (at most twice). */
+  const change = useCallback(
+    async (action: () => Promise<unknown>, done?: string) => {
+      setBusy(true);
+      setErrorCode(null);
+      setNotice(null);
+      try {
+        for (let round = 0; round < MAX_ROUNDS; round++) {
+          try {
+            const result = await action();
+            if ((result as { CurrentSessionEnded?: boolean } | undefined)?.CurrentSessionEnded) {
+              await useAuthStore.getState().logout('Sign-in methods changed');
+              return;
+            }
+            if (done) {
+              setNotice(done);
+            }
+            await load();
+            return;
+          } catch (error) {
+            if (isPasskeyCeremonyError(error)) {
+              setErrorCode(`passkey_${error.reason}`);
+              return;
+            }
+            const code = toMfaProblem(error).code;
+            const needed: AccountProof | null = code === 'reauthentication_required' ? 'reauthenticate' : code === 'step_up_required' ? 'step_up' : null;
+            // No retry is left after the last round, so asking for proof again would verify the member for nothing.
+            if (!needed || round === MAX_ROUNDS - 1) {
+              setErrorCode(code);
+              return;
+            }
+            if (!(await prove(needed))) {
+              return;
+            }
+          }
+        }
+      } finally {
+        setBusy(false);
+      }
+    },
+    [load, prove]
+  );
+
+  const addPasskey = () =>
+    void change(async () => {
+      const ceremony = await getPasskeyRegistrationOptions();
+      const credential = await createPasskeyCredential(ceremony.Options);
+      return completePasskeyRegistration(ceremony.RequestId, credential, '');
+    }, t('mfa.account.passkey_added'));
+
+  const ownGroup = methods?.PasskeyGroups.find((g) => g.Client === (methods.CurrentClient ?? RESGRID_CLIENT));
+  const otherGroups = (methods?.PasskeyGroups ?? []).filter((g) => g !== ownGroup && g.Passkeys.length > 0);
+
+  const renderPasskey = (passkey: PasskeyData) => (
+    <Box key={passkey.PasskeyId} className="rounded-lg border border-outline-200 p-3" testID={`passkey-${passkey.PasskeyId}`}>
+      <VStack space="xs">
+        <Text className="font-semibold">{passkey.DisplayName}</Text>
+        <Text size="sm">{t('mfa.account.passkey_created', { time: when(passkey.CreatedOn) ?? '' })}</Text>
+        {passkey.LastUsedOn ? <Text size="sm">{t('mfa.account.passkey_last_used', { time: when(passkey.LastUsedOn) ?? '' })}</Text> : null}
+        {passkey.ApprovalEnabled !== null ? (
+          <HStack space="sm" className="items-center">
+            <Switch value={!!passkey.ApprovalEnabled} onValueChange={(enabled) => void change(() => setPasskeyApproval(passkey.PasskeyId, enabled))} isDisabled={busy} testID={`passkey-approval-${passkey.PasskeyId}`} />
+            <Text size="sm">{t('mfa.account.passkey_approves')}</Text>
+          </HStack>
+        ) : null}
+        <HStack space="sm">
+          <Button size="xs" variant="outline" action="secondary" isDisabled={busy} onPress={() => setRenaming({ id: passkey.PasskeyId, name: passkey.DisplayName })}>
+            <ButtonText>{t('mfa.account.rename')}</ButtonText>
+          </Button>
+          <Button size="xs" variant="outline" action="negative" isDisabled={busy} onPress={() => void change(() => revokePasskey(passkey.PasskeyId), t('mfa.account.passkey_removed'))}>
+            <ButtonText>{t('mfa.account.remove')}</ButtonText>
+          </Button>
+        </HStack>
+      </VStack>
+    </Box>
+  );
+
+  return (
+    <>
+      <Stack.Screen options={{ title: t('mfa.account.title') }} />
+      <ScrollView contentContainerStyle={{ padding: 16 }} refreshControl={<RefreshControl refreshing={loading} onRefresh={() => void load()} />}>
+        <VStack space="lg">
+          {notice ? (
+            <Text size="sm" className="text-success-600" testID="account-notice" accessibilityLiveRegion="polite">
+              {notice}
+            </Text>
+          ) : null}
+          {errorCode ? (
+            <Text size="sm" className="text-error-600" testID="account-error" accessibilityLiveRegion="polite" accessibilityRole="alert" role="alert">
+              {t(mfaErrorKey(errorCode))}
+            </Text>
+          ) : null}
+
+          {methods ? (
+            <>
+              <VStack space="sm" testID="account-totp">
+                <Heading size="md">{t('mfa.account.authenticator')}</Heading>
+                <Text size="sm">{methods.Totp.Enrolled ? t('mfa.account.authenticator_on', { time: when(methods.Totp.EnrolledOn) ?? '' }) : t('mfa.account.authenticator_off')}</Text>
+                {methods.Totp.Enrolled ? (
+                  <Text size="sm" className={methods.Totp.RecoveryCodeWarning ? 'text-warning-600' : ''}>
+                    {t('mfa.account.recovery_codes_left', { count: methods.Totp.RecoveryCodesRemaining })}
+                  </Text>
+                ) : null}
+              </VStack>
+
+              <VStack space="sm" testID="account-passkeys">
+                <Heading size="md">{t('mfa.account.passkeys_here')}</Heading>
+                {ownGroup && ownGroup.Passkeys.length > 0 ? ownGroup.Passkeys.map(renderPasskey) : <Text size="sm">{t('mfa.account.no_passkeys')}</Text>}
+                {ownGroup?.RegistrationAvailable && passkeysSupported() ? (
+                  <Button action="primary" onPress={addPasskey} isDisabled={busy} testID="account-add-passkey">
+                    {busy ? <Spinner size="small" /> : <ButtonText>{t('mfa.account.add_passkey')}</ButtonText>}
+                  </Button>
+                ) : null}
+                {otherGroups.map((group) => (
+                  <Text key={group.Client} size="sm" testID={`account-passkeys-${group.Client}`}>
+                    {t('mfa.account.passkeys_elsewhere', { app: APP_NAMES[group.Client] ?? group.Client, count: group.Passkeys.length })}
+                  </Text>
+                ))}
+              </VStack>
+
+              {methods.ApprovalInstallations.length > 0 ? (
+                <VStack space="sm" testID="account-approvals">
+                  <Heading size="md">{t('mfa.account.approvals')}</Heading>
+                  {methods.ApprovalInstallations.map((installation) => (
+                    <HStack key={installation.InstallationId} space="sm" className="items-center justify-between">
+                      <VStack className="flex-1">
+                        <Text size="sm" className="font-semibold">
+                          {installation.Label ?? installation.Platform ?? t('mfa.account.this_device')}
+                          {installation.IsCurrent ? ` · ${t('mfa.account.this_device')}` : ''}
+                        </Text>
+                        <Text size="sm">{installation.ApprovalsOn ? t('mfa.account.approvals_on') : t('mfa.account.approvals_off')}</Text>
+                      </VStack>
+                      {installation.ApprovalsOn ? (
+                        <Button size="xs" variant="outline" action="negative" isDisabled={busy} onPress={() => void change(() => stopApprovalInstallations(installation.InstallationId))}>
+                          <ButtonText>{t('mfa.account.stop_approvals')}</ButtonText>
+                        </Button>
+                      ) : null}
+                    </HStack>
+                  ))}
+                </VStack>
+              ) : null}
+
+              {methods.LinkedIdentities.length > 0 ? (
+                <VStack space="sm" testID="account-linked">
+                  <Heading size="md">{t('mfa.account.linked')}</Heading>
+                  {methods.LinkedIdentities.map((link) => (
+                    <Text key={link.DepartmentId} size="sm">
+                      {link.DepartmentName ?? link.DepartmentId}
+                      {link.AcceptsProviderStepUp ? ` · ${t('mfa.account.linked_step_up')}` : ''}
+                    </Text>
+                  ))}
+                </VStack>
+              ) : null}
+
+              <VStack space="sm" testID="account-activity">
+                <Heading size="md">{t('mfa.account.activity')}</Heading>
+                {methods.RecentActivity.length === 0 ? <Text size="sm">{t('mfa.account.no_activity')}</Text> : null}
+                {methods.RecentActivity.map((activity) => (
+                  <HStack key={activity.ActivityId} space="sm" className="items-center justify-between">
+                    <VStack className="flex-1">
+                      <Text size="sm" className="font-semibold">
+                        {t(`mfa.account.activity_${activity.Successful ? 'ok' : 'failed'}`, {
+                          method: t(`mfa.methods.${activity.Method}`, activity.Method),
+                          app: (activity.Client && APP_NAMES[activity.Client]) ?? '',
+                        })}
+                      </Text>
+                      <Text size="sm">{when(activity.OccurredOn)}</Text>
+                    </VStack>
+                    {activity.Successful && !activity.ReportedOn ? (
+                      <Button
+                        size="xs"
+                        variant="outline"
+                        action="negative"
+                        isDisabled={busy}
+                        onPress={() => void change(() => reportActivity(activity.ActivityId), t('mfa.account.reported'))}
+                        testID={`activity-report-${activity.ActivityId}`}
+                      >
+                        <ButtonText>{t('mfa.account.not_me')}</ButtonText>
+                      </Button>
+                    ) : null}
+                  </HStack>
+                ))}
+              </VStack>
+            </>
+          ) : loading ? (
+            <Spinner size="large" />
+          ) : null}
+
+          {renaming ? (
+            <VStack space="sm" testID="account-rename">
+              <Input variant="outline" size="md" isDisabled={busy}>
+                <InputField value={renaming.name} onChangeText={(name) => setRenaming({ ...renaming, name })} maxLength={100} aria-label={t('mfa.account.rename')} />
+              </Input>
+              <HStack space="sm">
+                <Button size="sm" variant="outline" action="secondary" onPress={() => setRenaming(null)}>
+                  <ButtonText>{t('common.cancel')}</ButtonText>
+                </Button>
+                <Button
+                  size="sm"
+                  action="primary"
+                  isDisabled={busy || renaming.name.trim().length === 0}
+                  onPress={() => {
+                    const { id, name } = renaming;
+                    setRenaming(null);
+                    void change(() => renamePasskey(id, name.trim()));
+                  }}
+                >
+                  <ButtonText>{t('mfa.account.save')}</ButtonText>
+                </Button>
+              </HStack>
+            </VStack>
+          ) : null}
+        </VStack>
+      </ScrollView>
+      <AccountVerifyModal proof={proof} onDone={onProofDone} />
+    </>
+  );
+}
diff --git a/src/app/(app)/approve-sign-in.tsx b/src/app/(app)/approve-sign-in.tsx
new file mode 100644
index 00000000..28bfe12d
--- /dev/null
+++ b/src/app/(app)/approve-sign-in.tsx
@@ -0,0 +1,174 @@
+import { Stack, useLocalSearchParams, useRouter } from 'expo-router';
+import React, { useCallback, useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { ScrollView } from 'react-native';
+
+import { approveRequest, denyRequest, getApprovalOptions, getPendingApproval, type PendingApprovalData } from '@/api/mfa/account-security';
+import { Box } from '@/components/ui/box';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Heading } from '@/components/ui/heading';
+import { Input, InputField } from '@/components/ui/input';
+import { Spinner } from '@/components/ui/spinner';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+import { toMfaProblem } from '@/lib/mfa/errors';
+import { mfaErrorKey } from '@/lib/mfa/messages';
+import { getPasskeyAssertion } from '@/lib/mfa/passkey';
+import { isPasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { parseUtc } from '@/lib/mfa/types';
+
+type Phase = 'loading' | 'review' | 'approved' | 'denied' | 'none';
+
+const APP_NAMES: Record<string, string> = { web: 'Resgrid Web', unit: 'Resgrid Unit', dispatch: 'Resgrid Dispatch', ic: 'Resgrid Command' };
+
+/**
+ * Approve with Responder, as the approver (passkey plan section 7.9). The request names the app, installation, department,
+ * purpose and coarse origin; the member types the number shown on the other screen and confirms with this app's
+ * passkey. The number is never pushed, so only someone who can see that screen can approve it. "This wasn't me" ends
+ * the other sign-in and pauses requests for a while.
+ */
+export default function ApproveSignIn() {
+  const { t } = useTranslation();
+  const router = useRouter();
+  const params = useLocalSearchParams<{ id?: string }>();
+  const [phase, setPhase] = useState<Phase>('loading');
+  const [request, setRequest] = useState<PendingApprovalData | null>(null);
+  const [number, setNumber] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [errorCode, setErrorCode] = useState<string | null>(null);
+
+  const load = useCallback(async () => {
+    try {
+      const pending = await getPendingApproval();
+      setRequest(pending);
+      setPhase(pending ? 'review' : 'none');
+    } catch (error) {
+      setErrorCode(toMfaProblem(error).code);
+      setPhase('none');
+    }
+  }, []);
+
+  useEffect(() => {
+    void load();
+  }, [load, params.id]);
+
+  const approve = useCallback(async () => {
+    if (!request) {
+      return;
+    }
+    setBusy(true);
+    setErrorCode(null);
+    try {
+      const ceremony = await getApprovalOptions(request.ApprovalRequestId);
+      const credential = await getPasskeyAssertion(ceremony.Options);
+      await approveRequest(request.ApprovalRequestId, number.trim(), ceremony.RequestId, credential);
+      setPhase('approved');
+    } catch (error) {
+      if (isPasskeyCeremonyError(error)) {
+        setErrorCode(`passkey_${error.reason}`);
+      } else {
+        const problem = toMfaProblem(error);
+        setErrorCode(problem.code);
+        if (problem.code === 'approval_number_mismatch') {
+          // The attempts left come from the server; a request that ran out is denied there.
+          await load();
+        } else if (problem.code === 'approval_denied' || problem.code === 'approval_expired') {
+          setPhase('none');
+        }
+      }
+    } finally {
+      setNumber('');
+      setBusy(false);
+    }
+  }, [load, number, request]);
+
+  const deny = useCallback(
+    async (reason: 'declined' | 'not_me') => {
+      if (!request) {
+        return;
+      }
+      setBusy(true);
+      setErrorCode(null);
+      try {
+        await denyRequest(request.ApprovalRequestId, reason);
+        setPhase('denied');
+      } catch (error) {
+        setErrorCode(toMfaProblem(error).code);
+      } finally {
+        setBusy(false);
+      }
+    },
+    [request]
+  );
+
+  const done = useCallback(() => (router.canGoBack() ? router.back() : router.replace('/(app)')), [router]);
+
+  const expiresAt = parseUtc(request?.ExpiresAt);
+
+  return (
+    <>
+      <Stack.Screen options={{ title: t('mfa.approve.title') }} />
+      <ScrollView contentContainerStyle={{ padding: 24 }} keyboardShouldPersistTaps="handled">
+        <VStack space="md">
+          <Heading size="lg">{t('mfa.approve.title')}</Heading>
+
+          {phase === 'loading' ? <Spinner size="large" /> : null}
+
+          {phase === 'review' && request ? (
+            <>
+              <Box className="rounded-lg bg-background-50 p-4" testID="approve-details">
+                <VStack space="xs">
+                  <Text className="font-semibold">{t(`mfa.approve.purpose.${request.Purpose}`)}</Text>
+                  <Text size="sm">{t('mfa.approve.app', { app: (request.RequestingApp && APP_NAMES[request.RequestingApp]) ?? t('mfa.approve.unknown_app') })}</Text>
+                  {request.InstallationLabel ? <Text size="sm">{t('mfa.approve.installation', { label: request.InstallationLabel })}</Text> : null}
+                  {request.Shared ? <Text size="sm">{t('mfa.approve.shared')}</Text> : null}
+                  {request.Department ? <Text size="sm">{t('mfa.approve.department', { department: request.Department })}</Text> : null}
+                  {request.OriginRegion ? <Text size="sm">{t('mfa.approve.origin', { origin: request.OriginRegion })}</Text> : null}
+                  {expiresAt ? <Text size="sm">{t('mfa.approve.expires', { time: new Date(expiresAt).toLocaleTimeString() })}</Text> : null}
+                </VStack>
+              </Box>
+              <Text size="sm">{t('mfa.approve.number_body')}</Text>
+              <Input variant="outline" size="lg" isDisabled={busy}>
+                <InputField
+                  testID="approve-number"
+                  value={number}
+                  onChangeText={setNumber}
+                  placeholder={t('mfa.approve.number_placeholder')}
+                  keyboardType="number-pad"
+                  maxLength={2}
+                  accessibilityLabel={t('mfa.approve.number_placeholder')}
+                  aria-label={t('mfa.approve.number_placeholder')}
+                />
+              </Input>
+              <Button action="primary" onPress={() => void approve()} isDisabled={busy || number.trim().length !== 2} testID="approve-confirm">
+                {busy ? <Spinner size="small" /> : <ButtonText>{t('mfa.approve.approve')}</ButtonText>}
+              </Button>
+              <Button variant="outline" action="secondary" onPress={() => void deny('declined')} isDisabled={busy} testID="approve-deny">
+                <ButtonText>{t('mfa.approve.deny')}</ButtonText>
+              </Button>
+              <Button variant="outline" action="negative" onPress={() => void deny('not_me')} isDisabled={busy} testID="approve-not-me">
+                <ButtonText>{t('mfa.approve.not_me')}</ButtonText>
+              </Button>
+            </>
+          ) : null}
+
+          {phase === 'approved' ? <Text testID="approve-approved">{t('mfa.approve.approved')}</Text> : null}
+          {phase === 'denied' ? <Text testID="approve-denied">{t('mfa.approve.denied')}</Text> : null}
+          {phase === 'none' ? <Text testID="approve-none">{t('mfa.approve.none')}</Text> : null}
+
+          {errorCode ? (
+            <Text size="sm" className="text-error-600" testID="approve-error" accessibilityLiveRegion="polite" accessibilityRole="alert" role="alert">
+              {errorCode === 'approval_number_mismatch' && request ? t('mfa.approve.number_mismatch', { count: request.AttemptsRemaining }) : t(mfaErrorKey(errorCode))}
+            </Text>
+          ) : null}
+
+          {phase !== 'review' && phase !== 'loading' ? (
+            <Button action="primary" onPress={done} testID="approve-done">
+              <ButtonText>{t('mfa.approve.done')}</ButtonText>
+            </Button>
+          ) : null}
+        </VStack>
+      </ScrollView>
+    </>
+  );
+}
diff --git a/src/app/(app)/certifications/[id].tsx b/src/app/(app)/certifications/[id].tsx
index f9a257f8..7ae98299 100644
--- a/src/app/(app)/certifications/[id].tsx
+++ b/src/app/(app)/certifications/[id].tsx
@@ -4,6 +4,7 @@ import React, { useCallback, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Alert, ScrollView } from 'react-native';
 
+import { DateTimeField } from '@/components/common/date-time-field';
 import { Button, ButtonText } from '@/components/ui/button';
 import { HStack } from '@/components/ui/hstack';
 import { Input, InputField } from '@/components/ui/input';
@@ -145,9 +146,7 @@ export default function CertificationScreen() {
 
             <VStack space="sm" className="rounded-lg border border-outline-200 p-3" testID="certification-renew">
               <Text className="font-semibold">{t('certifications.renew')}</Text>
-              <Input>
-                <InputField value={renewTo} onChangeText={setRenewTo} placeholder={t('certifications.newExpiry')} maxLength={10} testID="certification-renew-date" />
-              </Input>
+              <DateTimeField value={renewTo} onChange={setRenewTo} label={t('certifications.newExpiry')} testID="certification-renew-date" />
               <Input>
                 <InputField value={renewNumber} onChangeText={setRenewNumber} placeholder={t('certifications.newNumber')} maxLength={100} testID="certification-renew-number" />
               </Input>
@@ -171,9 +170,9 @@ export default function CertificationScreen() {
                 <Input className="w-24">
                   <InputField value={creditHours} onChangeText={setCreditHours} keyboardType="decimal-pad" placeholder={t('certifications.hours')} testID="certification-credit-hours" />
                 </Input>
-                <Input className="flex-1">
-                  <InputField value={creditDate} onChangeText={setCreditDate} placeholder={t('certifications.creditDate')} maxLength={10} testID="certification-credit-date" />
-                </Input>
+                <VStack className="flex-1">
+                  <DateTimeField value={creditDate} onChange={setCreditDate} label={t('certifications.creditDate')} testID="certification-credit-date" />
+                </VStack>
               </HStack>
               <Input>
                 <InputField value={creditCategory} onChangeText={setCreditCategory} placeholder={t('certifications.category')} maxLength={100} testID="certification-credit-category" />
diff --git a/src/app/(app)/certifications/edit.tsx b/src/app/(app)/certifications/edit.tsx
index 60682667..9445f40c 100644
--- a/src/app/(app)/certifications/edit.tsx
+++ b/src/app/(app)/certifications/edit.tsx
@@ -5,6 +5,7 @@ import { useTranslation } from 'react-i18next';
 import { ScrollView } from 'react-native';
 
 import { getCertification } from '@/api/certifications/certifications';
+import { DateTimeField } from '@/components/common/date-time-field';
 import { OptionSelect } from '@/components/operations/option-select';
 import { Button, ButtonText } from '@/components/ui/button';
 import { HStack } from '@/components/ui/hstack';
@@ -181,12 +182,8 @@ const CertificationForm: React.FC<CertificationFormProps> = ({ existing }) => {
         <Input>
           <InputField value={area} onChangeText={setArea} placeholder={t('certifications.form.area')} maxLength={200} testID="certification-area" />
         </Input>
-        <Input>
-          <InputField value={receivedOn} onChangeText={setReceivedOn} placeholder={t('certifications.form.receivedOn')} maxLength={10} testID="certification-received" />
-        </Input>
-        <Input>
-          <InputField value={expiresOn} onChangeText={setExpiresOn} placeholder={t('certifications.form.expiresOn')} maxLength={10} testID="certification-expires" />
-        </Input>
+        <DateTimeField value={receivedOn} onChange={setReceivedOn} label={t('certifications.form.receivedOn')} testID="certification-received" />
+        <DateTimeField value={expiresOn} onChange={setExpiresOn} label={t('certifications.form.expiresOn')} testID="certification-expires" />
         <HStack space="sm">
           <Button variant="outline" size="sm" onPress={() => void pick('camera')} testID="certification-camera">
             <ButtonText>{t('certifications.form.takePhoto')}</ButtonText>
diff --git a/src/app/(app)/operations/[id].tsx b/src/app/(app)/operations/[id].tsx
index 2cc98d9c..aa4f586a 100644
--- a/src/app/(app)/operations/[id].tsx
+++ b/src/app/(app)/operations/[id].tsx
@@ -4,6 +4,7 @@ import React, { useCallback, useMemo, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { ScrollView } from 'react-native';
 
+import { DateTimeField } from '@/components/common/date-time-field';
 import { ExpensesPanel } from '@/components/operations/expenses-panel';
 import { MarsPanel } from '@/components/operations/mars-panel';
 import { AwaitingApproval, DayReports, ScopePicker, useScopeLabel } from '@/components/operations/scope-picker';
@@ -103,8 +104,7 @@ export default function OperationsDeploymentScreen() {
     return mine.length > 0 ? mine : crewed;
   }, [deployment, access, activeUnitId]);
 
-  const changeDay = (days: number) => {
-    const next = shiftDateKey(dateKey, days);
+  const selectDay = (next: string) => {
     dateRef.current = next;
     setDateKey(next);
     useOperationsStore.getState().setScope(useOperationsStore.getState().scope, next);
@@ -182,11 +182,11 @@ export default function OperationsDeploymentScreen() {
         ) : null}
         {deployment && section !== 'mars' ? (
           <HStack className="items-center justify-between">
-            <Pressable onPress={() => changeDay(-1)} testID="operations-day-previous" accessibilityRole="button" accessibilityLabel={t('operations.previousDay')}>
+            <Pressable onPress={() => selectDay(shiftDateKey(dateKey, -1))} testID="operations-day-previous" accessibilityRole="button" accessibilityLabel={t('operations.previousDay')}>
               <ChevronLeft size={22} color="#2563eb" />
             </Pressable>
-            <Text className="font-semibold">{dateKey}</Text>
-            <Pressable onPress={() => changeDay(1)} testID="operations-day-next" accessibilityRole="button" accessibilityLabel={t('operations.nextDay')}>
+            <DateTimeField value={dateKey} onChange={selectDay} label={t('dateTimePicker.date')} clearable={false} disabled={busy} testID="operations-day" />
+            <Pressable onPress={() => selectDay(shiftDateKey(dateKey, 1))} testID="operations-day-next" accessibilityRole="button" accessibilityLabel={t('operations.nextDay')}>
               <ChevronRight size={22} color="#2563eb" />
             </Pressable>
           </HStack>
diff --git a/src/app/(app)/settings.tsx b/src/app/(app)/settings.tsx
index 7b2ce85a..9c27c4ba 100644
--- a/src/app/(app)/settings.tsx
+++ b/src/app/(app)/settings.tsx
@@ -1,6 +1,6 @@
 /* eslint-disable react/react-in-jsx-scope */
 import { Env } from '@env';
-import { useFocusEffect } from 'expo-router';
+import { type Href, useFocusEffect, useRouter } from 'expo-router';
 import { useColorScheme } from 'nativewind';
 import React, { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
@@ -31,6 +31,7 @@ import { useUnitsStore } from '@/stores/units/store';
 
 export default function Settings() {
   const { t } = useTranslation();
+  const router = useRouter();
   const signOut = useAuthStore.getState().logout;
   const { colorScheme } = useColorScheme();
   const { trackEvent } = useAnalytics();
@@ -205,6 +206,7 @@ export default function Settings() {
             <VStack space="sm">
               <Item text={t('settings.server')} value={getBaseApiUrl()} onPress={handleServerUrlPress} textStyle="text-info-600" />
               <Item text={t('settings.login_info')} onPress={handleLoginInfoPress} textStyle="text-info-600" />
+              <Item text={t('mfa.account.title')} onPress={() => router.push('/account-security' as unknown as Href)} textStyle="text-info-600" />
               <Item text={t('settings.logout')} onPress={handleLogoutPress} textStyle="text-error-600" />
             </VStack>
           </Card>
diff --git a/src/app/(app)/weather-alerts/[id].tsx b/src/app/(app)/weather-alerts/[id].tsx
index d895438c..0bca1597 100644
--- a/src/app/(app)/weather-alerts/[id].tsx
+++ b/src/app/(app)/weather-alerts/[id].tsx
@@ -17,6 +17,7 @@ import { VStack } from '@/components/ui/vstack';
 import { formatWeatherAlertTranslation, getWeatherAlertCategoryName, normalizeWeatherAlertSeverity } from '@/components/weather-alerts/weather-alert-formatters';
 import { getWeatherAlertRequestId } from '@/components/weather-alerts/weather-alert-list-utils';
 import { WeatherAlertSeverityBadge } from '@/components/weather-alerts/weather-alert-severity-badge';
+import { useDepartmentMapStyle } from '@/lib/map-style';
 import { SEVERITY_COLORS } from '@/models/v4/weatherAlerts/weatherAlertEnums';
 import { useWeatherAlertsStore } from '@/stores/weather-alerts/weather-alerts-store';
 
@@ -72,6 +73,7 @@ export default function WeatherAlertDetail() {
   const fetchActiveAlerts = useWeatherAlertsStore((state) => state.fetchActiveAlerts);
   const selectAlertByIdentity = useWeatherAlertsStore((state) => state.selectAlertByIdentity);
   const alertIdentity = typeof id === 'string' ? decodeURIComponent(id).trim() : '';
+  const mapStyle = useDepartmentMapStyle();
 
   const handleBack = useCallback(() => {
     router.back();
@@ -264,7 +266,7 @@ export default function WeatherAlertDetail() {
         {/* Map */}
         {mapCenter ? (
           <Box className="mx-4 mt-3 overflow-hidden rounded-xl" style={styles.mapContainer}>
-            <Mapbox.MapView style={styles.map} styleURL={Mapbox.StyleURL.Street} scrollEnabled={false} zoomEnabled={false} rotateEnabled={false} pitchEnabled={false} compassEnabled={false}>
+            <Mapbox.MapView style={styles.map} styleURL={mapStyle} scrollEnabled={false} zoomEnabled={false} rotateEnabled={false} pitchEnabled={false} compassEnabled={false}>
               {mapBounds ? <Mapbox.Camera bounds={mapBounds} animationMode="none" /> : <Mapbox.Camera centerCoordinate={mapCenter} zoomLevel={7} animationMode="none" />}
               {geoJsonShape ? (
                 <Mapbox.ShapeSource id="alertPolygon" shape={geoJsonShape as GeoJSON.Feature}>
diff --git a/src/app/__tests__/onboarding.test.tsx b/src/app/__tests__/onboarding.test.tsx
index 676ebdea..e1ab0287 100644
--- a/src/app/__tests__/onboarding.test.tsx
+++ b/src/app/__tests__/onboarding.test.tsx
@@ -333,30 +333,12 @@ describe('Onboarding Component', () => {
       expect(mockRouter.replace).toHaveBeenCalledWith('/login');
     });
 
-    it('should navigate to login when Get Started is pressed on last slide', async () => {
-      // Since the animation/state logic is complex to test, we'll test the button functionality
-      // by manually triggering the onPress logic that would be called in the last slide
-      render(<Onboarding />);
-
-      // Clear previous analytics calls
+    it('should navigate to login when Get Started is pressed on last slide', () => {
+      const screen = render(<Onboarding />);
+      fireEvent.press(screen.getByTestId('next-button'));
+      fireEvent.press(screen.getByTestId('next-button'));
       mockTrackEvent.mockClear();
-
-      // Simulate the button press behavior (what happens in the actual last slide onPress)
-      // This tests the same logic that would be called when the Get Started button is pressed
-      const onGetStartedPress = () => {
-        mockTrackEvent('onboarding_completed', {
-          timestamp: new Date().toISOString(),
-          totalSlides: 3,
-          completionMethod: 'finished',
-        });
-        mockSetIsFirstTime(false);
-        mockRouter.replace('/login');
-      };
-
-      // Execute the logic
-      onGetStartedPress();
-
-      // Verify analytics and navigation
+      fireEvent.press(screen.getByTestId('get-started-button'));
       expect(mockTrackEvent).toHaveBeenCalledWith('onboarding_completed', {
         timestamp: expect.any(String),
         totalSlides: 3,
@@ -364,6 +346,7 @@ describe('Onboarding Component', () => {
       });
       expect(mockSetIsFirstTime).toHaveBeenCalledWith(false);
       expect(mockRouter.replace).toHaveBeenCalledWith('/login');
+      screen.unmount();
     });
 
     it('should render component without calling setIsOnboarding (functionality is commented out)', () => {
diff --git a/src/app/__tests__/root-layout.test.ts b/src/app/__tests__/root-layout.test.ts
new file mode 100644
index 00000000..acb596a1
--- /dev/null
+++ b/src/app/__tests__/root-layout.test.ts
@@ -0,0 +1,52 @@
+import fs from 'fs';
+import path from 'path';
+
+// A web sign-in popup comes back to the page its redirect names (/auth/callback here), and a production web build loads a
+// route's module only when that route is shown, so the sign-in hooks' own module may never load in the popup. The root
+// layout loads on every page: it must complete the popup. Every other import of the layout is stubbed, so this loads
+// only the layout's own module code.
+const stub = (): unknown =>
+  new Proxy(function stubbed() {}, {
+    get: (_target, key) => {
+      if (key === '__esModule') return true;
+      if (key === Symbol.toPrimitive) return () => '';
+      if (key === 'then' || typeof key === 'symbol') return undefined;
+      return stub();
+    },
+    apply: () => stub(),
+    construct: () => stub() as object,
+  });
+
+const layoutImports = (layoutPath: string): string[] => {
+  const source = fs.readFileSync(layoutPath, 'utf8');
+  const specifiers = new Set<string>();
+  for (const match of source.matchAll(/^\s*(?:import|export)\s+(?:type\s+)?(?:[^'";]*?\s+from\s+)?['"]([^'"]+)['"]/gm)) {
+    specifiers.add(match[1]);
+  }
+  return [...specifiers];
+};
+
+describe('root layout', () => {
+  it('completes a pending web sign-in on whatever page the popup returns to', () => {
+    const layoutPath = path.join(__dirname, '..', '_layout.tsx');
+    const maybeCompleteAuthSession = jest.fn();
+
+    // The setup file's mocks are already built, and a built mock wins over a later doMock until the registry is reset.
+    jest.resetModules();
+    jest.isolateModules(() => {
+      for (const specifier of layoutImports(layoutPath)) {
+        if (specifier === 'react') continue;
+        const target = specifier.startsWith('.') ? path.resolve(path.dirname(layoutPath), specifier) : specifier;
+        const factory = specifier === 'expo-web-browser' ? () => ({ __esModule: true, maybeCompleteAuthSession }) : stub;
+        try {
+          jest.doMock(target, factory);
+        } catch {
+          jest.doMock(target, factory, { virtual: true });
+        }
+      }
+      require(layoutPath);
+    });
+
+    expect(maybeCompleteAuthSession).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/src/app/_layout.tsx b/src/app/_layout.tsx
index a2a6a0a7..acd64289 100644
--- a/src/app/_layout.tsx
+++ b/src/app/_layout.tsx
@@ -230,6 +230,8 @@ function RootLayout() {
         <Stack.Screen name="onboarding" options={{ headerShown: false }} />
         <Stack.Screen name="login/index" options={{ headerShown: false }} />
         <Stack.Screen name="login/sso" options={{ headerShown: true }} />
+        <Stack.Screen name="login/recovery" options={{ headerShown: true }} />
+        <Stack.Screen name="sso-return" options={{ headerShown: false }} />
       </Stack>
     </Providers>
   );
diff --git a/src/app/call/new/__tests__/address-search.test.ts b/src/app/call/new/__tests__/address-search.test.ts
index f706fc84..816b08be 100644
--- a/src/app/call/new/__tests__/address-search.test.ts
+++ b/src/app/call/new/__tests__/address-search.test.ts
@@ -120,7 +120,11 @@ describe('Address Search Logic', () => {
     AnalyticsHost: '',
     MapCenterLatitude: 0,
     MapCenterLongitude: 0,
-    MapCenterZoomLevel: 9
+    MapCenterZoomLevel: 9,
+    MapDayStyleUrl: '',
+    MapNightStyleUrl: '',
+    AppMapboxAccessToken: '',
+    IsDepartmentMapOverride: false
   };
 
   beforeEach(() => {
@@ -171,7 +175,11 @@ describe('Address Search Logic', () => {
         AnalyticsHost: '',
         MapCenterLatitude: 0,
         MapCenterLongitude: 0,
-        MapCenterZoomLevel: 9
+        MapCenterZoomLevel: 9,
+        MapDayStyleUrl: '',
+        MapNightStyleUrl: '',
+        AppMapboxAccessToken: '',
+        IsDepartmentMapOverride: false
       };
 
       const result = await performAddressSearch('123 Main St', configWithoutKey);
diff --git a/src/app/call/new/__tests__/coordinates-search.test.tsx b/src/app/call/new/__tests__/coordinates-search.test.tsx
index 6b9eaa4e..5b283630 100644
--- a/src/app/call/new/__tests__/coordinates-search.test.tsx
+++ b/src/app/call/new/__tests__/coordinates-search.test.tsx
@@ -130,7 +130,11 @@ describe('Coordinates Search Logic', () => {
     AnalyticsHost: '',
     MapCenterLatitude: 0,
     MapCenterLongitude: 0,
-    MapCenterZoomLevel: 9
+    MapCenterZoomLevel: 9,
+    MapDayStyleUrl: '',
+    MapNightStyleUrl: '',
+    AppMapboxAccessToken: '',
+    IsDepartmentMapOverride: false
   };
 
   beforeEach(() => {
@@ -277,7 +281,11 @@ describe('Coordinates Search Logic', () => {
         AnalyticsHost: '',
         MapCenterLatitude: 0,
         MapCenterLongitude: 0,
-        MapCenterZoomLevel: 9
+        MapCenterZoomLevel: 9,
+        MapDayStyleUrl: '',
+        MapNightStyleUrl: '',
+        AppMapboxAccessToken: '',
+        IsDepartmentMapOverride: false
       };
 
       const result = await performCoordinatesSearch('40.7128, -74.0060', configWithoutKey);
diff --git a/src/app/call/new/__tests__/plus-code-search.test.ts b/src/app/call/new/__tests__/plus-code-search.test.ts
index cea47dc0..a694e880 100644
--- a/src/app/call/new/__tests__/plus-code-search.test.ts
+++ b/src/app/call/new/__tests__/plus-code-search.test.ts
@@ -94,7 +94,11 @@ describe('Plus Code Search Logic', () => {
     AnalyticsHost: '',
     MapCenterLatitude: 0,
     MapCenterLongitude: 0,
-    MapCenterZoomLevel: 9
+    MapCenterZoomLevel: 9,
+    MapDayStyleUrl: '',
+    MapNightStyleUrl: '',
+    AppMapboxAccessToken: '',
+    IsDepartmentMapOverride: false
   };
 
   beforeEach(() => {
@@ -145,7 +149,11 @@ describe('Plus Code Search Logic', () => {
         AnalyticsHost: '',
         MapCenterLatitude: 0,
         MapCenterLongitude: 0,
-        MapCenterZoomLevel: 9
+        MapCenterZoomLevel: 9,
+        MapDayStyleUrl: '',
+        MapNightStyleUrl: '',
+        AppMapboxAccessToken: '',
+        IsDepartmentMapOverride: false
       };
 
       const result = await performPlusCodeSearch('849VCWC8+R9', configWithoutKey);
diff --git a/src/app/call/new/__tests__/what3words.test.tsx b/src/app/call/new/__tests__/what3words.test.tsx
index cc00f367..7963d503 100644
--- a/src/app/call/new/__tests__/what3words.test.tsx
+++ b/src/app/call/new/__tests__/what3words.test.tsx
@@ -27,7 +27,11 @@ const mockConfig: GetConfigResultData = {
   AnalyticsHost: '',
   MapCenterLatitude: 0,
   MapCenterLongitude: 0,
-  MapCenterZoomLevel: 9
+  MapCenterZoomLevel: 9,
+  MapDayStyleUrl: '',
+  MapNightStyleUrl: '',
+  AppMapboxAccessToken: '',
+  IsDepartmentMapOverride: false
 };
 
 // Mock the core store
diff --git a/src/app/login/__tests__/recovery.test.tsx b/src/app/login/__tests__/recovery.test.tsx
new file mode 100644
index 00000000..41f4814b
--- /dev/null
+++ b/src/app/login/__tests__/recovery.test.tsx
@@ -0,0 +1,78 @@
+import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
+import React from 'react';
+
+import * as loginMfa from '@/stores/auth/login-mfa';
+import useAuthStore from '@/stores/auth/store';
+
+import FactorRecovery from '../recovery';
+
+const mockReplace = jest.fn();
+jest.mock('expo-router', () => ({ Stack: { Screen: () => null }, useRouter: () => ({ replace: mockReplace }) }));
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/components/ui', () => ({ FocusAwareStatusBar: () => null }));
+jest.mock('expo-linking', () => ({ openURL: jest.fn() }));
+jest.mock('expo-clipboard', () => ({ setStringAsync: jest.fn() }));
+jest.mock('@/stores/auth/login-mfa', () => ({
+  abandonFactorRecovery: jest.fn(),
+  finishFactorRecovery: jest.fn(),
+  hasLoginTransaction: jest.fn(() => true),
+  recoveryReplacementKey: jest.fn(),
+}));
+
+const mocked = loginMfa as jest.Mocked<typeof loginMfa>;
+
+describe('"I lost my authenticator"', () => {
+  const beginFactorRecovery = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mocked.hasLoginTransaction.mockReturnValue(true);
+    useAuthStore.setState({ beginFactorRecovery });
+  });
+
+  it('spends a recovery code, stages a new authenticator, removes the chosen passkeys, and shows the new codes once', async () => {
+    beginFactorRecovery.mockResolvedValue({ passkeys: [{ PasskeyId: 'pk-lost', DisplayName: 'Old phone' }], expiresAt: null });
+    mocked.recoveryReplacementKey.mockResolvedValue({ SharedKey: 'NEW KEY', AuthenticatorUri: 'otpauth://x', ExpiresIn: 600 });
+    mocked.finishFactorRecovery.mockResolvedValue({ recoveryCodes: ['n1', 'n2'] });
+
+    const { getByTestId, getAllByTestId } = render(<FactorRecovery />);
+    fireEvent.changeText(getByTestId('recovery-code-input'), 'RC-1111');
+    await act(async () => fireEvent.press(getByTestId('recovery-begin')));
+    expect(beginFactorRecovery).toHaveBeenCalledWith('RC-1111');
+
+    await waitFor(() => expect(getByTestId('recovery-shared-key').props.children).toBe('NEW KEY'));
+    fireEvent.press(getByTestId('recovery-passkey-pk-lost'));
+    fireEvent.changeText(getByTestId('recovery-new-code'), '123456');
+    await act(async () => fireEvent.press(getByTestId('recovery-finish')));
+    expect(mocked.finishFactorRecovery).toHaveBeenCalledWith('123456', ['pk-lost']);
+    expect(getAllByTestId('mfa-recovery-code').map((n) => n.props.children)).toEqual(['n1', 'n2']);
+
+    fireEvent.press(getByTestId('recovery-sign-in'));
+    expect(mockReplace).toHaveBeenCalledWith('/login');
+  });
+
+  it('says who can help without a sign-in or a recovery code, and never waives anything', async () => {
+    mocked.hasLoginTransaction.mockReturnValue(false);
+    const { getByTestId, queryByTestId } = render(<FactorRecovery />);
+    expect(queryByTestId('recovery-code-input')).toBeNull();
+    fireEvent.press(getByTestId('recovery-back'));
+    expect(mockReplace).toHaveBeenCalledWith('/login');
+  });
+
+  it('shows a wrong code and lets the member cancel the recovery', async () => {
+    beginFactorRecovery.mockResolvedValue({ passkeys: [], expiresAt: null });
+    mocked.recoveryReplacementKey.mockResolvedValue({ SharedKey: 'K', AuthenticatorUri: 'otpauth://x', ExpiresIn: 600 });
+    mocked.finishFactorRecovery.mockResolvedValue({ code: 'invalid_totp', ended: false });
+    const { getByTestId } = render(<FactorRecovery />);
+    fireEvent.changeText(getByTestId('recovery-code-input'), 'RC-1111');
+    await act(async () => fireEvent.press(getByTestId('recovery-begin')));
+    await waitFor(() => expect(getByTestId('recovery-shared-key')).toBeTruthy());
+    fireEvent.changeText(getByTestId('recovery-new-code'), '000000');
+    await act(async () => fireEvent.press(getByTestId('recovery-finish')));
+    expect(getByTestId('recovery-error').props.children).toBe('mfa.errors.invalid_totp');
+
+    await act(async () => fireEvent.press(getByTestId('recovery-cancel')));
+    expect(mocked.abandonFactorRecovery).toHaveBeenCalled();
+    expect(mockReplace).toHaveBeenCalledWith('/login');
+  });
+});
diff --git a/src/app/login/__tests__/screen.test.tsx b/src/app/login/__tests__/screen.test.tsx
index ad21e034..ef1c5a2a 100644
--- a/src/app/login/__tests__/screen.test.tsx
+++ b/src/app/login/__tests__/screen.test.tsx
@@ -25,15 +25,23 @@ jest.mock('@/hooks/use-analytics', () => ({
   }),
 }));
 
+const mockAuthStatus = { current: 'idle' };
 jest.mock('@/lib/auth', () => ({
   useAuth: () => ({
     login: mockLogin,
-    status: 'idle',
+    status: mockAuthStatus.current,
     error: undefined,
     isAuthenticated: false,
   }),
 }));
 
+// The second-factor sheet renders as a marker that says whether it is open.
+jest.mock('@/components/auth/login-mfa-sheet', () => {
+  const React = require('react');
+  const { View } = require('react-native');
+  return { LoginMfaSheet: ({ isOpen }: { isOpen: boolean }) => (isOpen ? React.createElement(View, { testID: 'login-mfa-sheet-open' }) : null) };
+});
+
 jest.mock('@/lib/env', () => ({
   Env: {
     LOGGING_KEY: 'test-key',
@@ -117,3 +125,29 @@ describe('Login screen', () => {
     expect(screen.getByTestId('server-url-bottom-sheet')).toBeTruthy();
   });
 });
+
+describe('the second-factor sheet on the login screen', () => {
+  const { default: useAuthStore } = jest.requireActual('@/stores/auth/store') as typeof import('@/stores/auth/store');
+  const verify = (source: 'password' | 'sso') => ({ kind: 'verify' as const, methods: ['totp' as const], enrolled: ['totp' as const], preferred: 'totp' as const, expiresAt: null, source });
+
+  beforeEach(() => {
+    mockAuthStatus.current = 'mfaRequired';
+  });
+  afterEach(() => {
+    mockAuthStatus.current = 'idle';
+    useAuthStore.setState({ mfaChallenge: null });
+  });
+
+  it('opens for a password sign-in that continues on a login transaction', () => {
+    useAuthStore.setState({ mfaChallenge: verify('password') });
+    render(<Login />);
+    expect(screen.getByTestId('login-mfa-sheet-open')).toBeTruthy();
+  });
+
+  it("leaves a single sign-on's second factor to the SSO screen on top of it", () => {
+    // Both screens are mounted while the SSO screen is shown; two sheets would each stage their own setup key.
+    useAuthStore.setState({ mfaChallenge: verify('sso') });
+    render(<Login />);
+    expect(screen.queryByTestId('login-mfa-sheet-open')).toBeNull();
+  });
+});
diff --git a/src/app/login/__tests__/sso-brokered.test.tsx b/src/app/login/__tests__/sso-brokered.test.tsx
new file mode 100644
index 00000000..8591d555
--- /dev/null
+++ b/src/app/login/__tests__/sso-brokered.test.tsx
@@ -0,0 +1,150 @@
+import { act, fireEvent, render } from '@testing-library/react-native';
+import React from 'react';
+
+import useAuthStore from '@/stores/auth/store';
+
+import SsoLogin from '../sso';
+
+const mockPromptAsync = jest.fn();
+const mockOidcOptions = jest.fn();
+const mockStartSaml = jest.fn();
+const mockSamlOptions = jest.fn();
+jest.mock('expo-router', () => ({ Stack: { Screen: () => null }, useRouter: () => ({ replace: jest.fn(), push: jest.fn() }) }));
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/components/ui', () => ({ FocusAwareStatusBar: () => null }));
+jest.mock('@/hooks/use-analytics', () => ({ useAnalytics: () => ({ trackEvent: jest.fn() }) }));
+jest.mock('@/lib/auth', () => ({ useAuth: () => ({ status: 'signedOut', error: null, isAuthenticated: false }) }));
+jest.mock('@/hooks/use-oidc-login', () => ({
+  isValidSsoUrl: () => true,
+  useOidcLogin: (options: unknown) => {
+    mockOidcOptions(options);
+    return { promptAsync: mockPromptAsync, request: null, response: null };
+  },
+}));
+jest.mock('@/hooks/use-saml-login', () => ({
+  useSamlLogin: (options: unknown) => {
+    mockSamlOptions(options);
+    return { startSamlLogin: mockStartSaml };
+  },
+}));
+jest.mock('@/components/auth/login-mfa-sheet', () => ({ LoginMfaSheet: () => null }));
+jest.mock('@/components/ui/modal', () => {
+  const { View } = require('react-native');
+  const Part = ({ children }: any) => <View>{children}</View>;
+  return {
+    Modal: ({ isOpen, children }: any) => (isOpen ? <View>{children}</View> : null),
+    ModalBackdrop: () => null,
+    ModalBody: Part,
+    ModalContent: Part,
+    ModalFooter: Part,
+    ModalHeader: Part,
+  };
+});
+jest.mock('@/components/auth/login-otp-modal', () => ({ LoginOtpModal: () => null }));
+jest.mock('@/app/login/sso-section', () => {
+  const { Pressable, Text } = require('react-native');
+  return {
+    SsoDepartmentForm: ({ onSsoConfigResolved }: any) => (
+      <Pressable testID="resolve" onPress={() => onSsoConfigResolved('user1', (globalThis as any).__ssoConfig)}>
+        <Text>resolve</Text>
+      </Pressable>
+    ),
+    SsoLoginButtons: ({ onOidcPress, onSamlPress }: any) => (
+      <>
+        <Pressable testID="oidc" onPress={onOidcPress}>
+          <Text>oidc</Text>
+        </Pressable>
+        <Pressable testID="saml" onPress={onSamlPress}>
+          <Text>saml</Text>
+        </Pressable>
+      </>
+    ),
+  };
+});
+
+const config = (brokered: boolean) => ({
+  ssoEnabled: true,
+  providerType: 'oidc',
+  authority: 'https://idp.example',
+  clientId: 'c',
+  metadataUrl: null,
+  entityId: null,
+  allowLocalLogin: true,
+  requireSso: false,
+  requireMfa: false,
+  oidcRedirectUri: '',
+  oidcScopes: '',
+  departmentId: 42,
+  departmentToken: brokered ? 'dept-token' : null,
+  brokeredSsoAvailable: brokered,
+});
+
+describe('SSO sign-in through the broker (passkey plan section 7.7.2)', () => {
+  const loginWithBrokeredSso = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    loginWithBrokeredSso.mockResolvedValue({ outcome: 'signed_in' });
+    useAuthStore.setState({ loginWithBrokeredSso });
+  });
+
+  it('goes through the broker with the department token when it is available', async () => {
+    (globalThis as any).__ssoConfig = config(true);
+    const { getByTestId } = render(<SsoLogin />);
+    fireEvent.press(getByTestId('resolve'));
+    await act(async () => fireEvent.press(getByTestId('oidc')));
+    expect(loginWithBrokeredSso).toHaveBeenCalledWith({ departmentToken: 'dept-token' });
+    expect(mockPromptAsync).not.toHaveBeenCalled();
+
+    await act(async () => fireEvent.press(getByTestId('saml')));
+    expect(loginWithBrokeredSso).toHaveBeenCalledTimes(2);
+  });
+
+  it('keeps the app-side OIDC flow for a server without the broker, naming the department by its token', async () => {
+    (globalThis as any).__ssoConfig = { ...config(false), departmentToken: 'dept-token' };
+    const { getByTestId } = render(<SsoLogin />);
+    fireEvent.press(getByTestId('resolve'));
+    await act(async () => fireEvent.press(getByTestId('oidc')));
+    expect(loginWithBrokeredSso).not.toHaveBeenCalled();
+    expect(mockPromptAsync).toHaveBeenCalled();
+    // The exchange names the department by discovery's token: the server reads no department from a username.
+    expect(mockOidcOptions).toHaveBeenLastCalledWith(expect.objectContaining({ departmentToken: 'dept-token' }));
+  });
+
+  it("starts SAML without the broker on the server's own start page, never the IdP's metadata document", async () => {
+    const start = 'https://api.example/api/v4/connect/saml-mobile-login?departmentToken=t';
+    (globalThis as any).__ssoConfig = { ...config(false), providerType: 'saml2', metadataUrl: 'https://idp.example/metadata', samlLoginUrl: start, departmentToken: 'dept-token' };
+    const { getByTestId, queryByText } = render(<SsoLogin />);
+    fireEvent.press(getByTestId('resolve'));
+    await act(async () => fireEvent.press(getByTestId('saml')));
+    expect(loginWithBrokeredSso).not.toHaveBeenCalled();
+    expect(mockStartSaml).toHaveBeenCalled();
+    expect(mockSamlOptions).toHaveBeenLastCalledWith({ signInUrl: start, departmentToken: 'dept-token' });
+    expect(queryByText('login.errorModal.message')).toBeNull();
+  });
+
+  it('says SAML cannot start where the server names no start page', async () => {
+    (globalThis as any).__ssoConfig = { ...config(false), providerType: 'saml2', metadataUrl: 'https://idp.example/metadata', samlLoginUrl: null };
+    const { getByTestId, queryByText } = render(<SsoLogin />);
+    fireEvent.press(getByTestId('resolve'));
+    await act(async () => fireEvent.press(getByTestId('saml')));
+    expect(mockStartSaml).not.toHaveBeenCalled();
+    expect(queryByText('login.errorModal.message')).not.toBeNull();
+  });
+
+  it('says SAML cannot start on the web edition, which the relay cannot return to', async () => {
+    const { Platform } = require('react-native');
+    const os = Platform.OS;
+    Platform.OS = 'web';
+    try {
+      (globalThis as any).__ssoConfig = { ...config(false), providerType: 'saml2', samlLoginUrl: 'https://api.example/api/v4/connect/saml-mobile-login?departmentToken=t' };
+      const { getByTestId, queryByText } = render(<SsoLogin />);
+      fireEvent.press(getByTestId('resolve'));
+      await act(async () => fireEvent.press(getByTestId('saml')));
+      expect(mockStartSaml).not.toHaveBeenCalled();
+      expect(queryByText('login.errorModal.message')).not.toBeNull();
+    } finally {
+      Platform.OS = os;
+    }
+  });
+});
diff --git a/src/app/login/index.tsx b/src/app/login/index.tsx
index ddd8e9af..4737d7e2 100644
--- a/src/app/login/index.tsx
+++ b/src/app/login/index.tsx
@@ -5,6 +5,7 @@ import React, { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
 import type { LoginFormProps } from '@/app/login/login-form';
+import { LoginMfaSheet } from '@/components/auth/login-mfa-sheet';
 import { LoginOtpModal } from '@/components/auth/login-otp-modal';
 import { ServerUrlBottomSheet } from '@/components/settings/server-url-bottom-sheet';
 import { FocusAwareStatusBar } from '@/components/ui';
@@ -15,6 +16,8 @@ import { useAnalytics } from '@/hooks/use-analytics';
 import { useAuth } from '@/lib/auth';
 import { Env } from '@/lib/env';
 import { logger } from '@/lib/logging';
+import { isMfaErrorCode, mfaErrorKey } from '@/lib/mfa/messages';
+import useAuthStore from '@/stores/auth/store';
 
 import { LoginForm } from './login-form';
 
@@ -28,7 +31,10 @@ export default function Login() {
   const { t } = useTranslation();
   const router = useRouter();
   const { login, status, error, isAuthenticated } = useAuth();
+  const mfaChallenge = useAuthStore((s) => s.mfaChallenge);
   const { trackEvent } = useAnalytics();
+  // A sign-in that ended (expired, too many attempts, policy changed) says why in the member's language.
+  const displayError = isMfaErrorCode(error) ? t(mfaErrorKey(error)) : error;
 
   // Track analytics when view becomes visible
   useFocusEffect(
@@ -117,13 +123,22 @@ export default function Login() {
     <>
       <FocusAwareStatusBar />
 
-      <LoginForm onSubmit={onLocalLoginSubmit} isLoading={status === 'loading'} onSsoPress={() => router.push('/login/sso')} onServerUrlPress={() => setIsServerUrlSheetVisible(true)} {...(error ? { error } : {})} />
+      <LoginForm
+        onSubmit={onLocalLoginSubmit}
+        isLoading={status === 'loading'}
+        onSsoPress={() => router.push('/login/sso')}
+        onServerUrlPress={() => setIsServerUrlSheetVisible(true)}
+        {...(displayError ? { error: displayError } : {})}
+      />
 
       {isServerUrlSheetVisible ? <ServerUrlBottomSheet isOpen={isServerUrlSheetVisible} onClose={() => setIsServerUrlSheetVisible(false)} /> : null}
 
-      {/* Two-factor challenge: token endpoint answered mfa_required / invalid_totp */}
+      {/* Second factor on the login transaction: the methods this sign-in accepts, or the setup the department requires. An SSO sign-in's second factor is the SSO screen's, on top of this one */}
+      <LoginMfaSheet isOpen={status === 'mfaRequired' && mfaChallenge != null && mfaChallenge.kind !== 'legacy' && mfaChallenge.source !== 'sso'} onLostFactor={() => router.push('/login/recovery')} />
+
+      {/* Two-factor challenge on an older server: token endpoint answered mfa_required / invalid_totp with no transaction */}
       <LoginOtpModal
-        isOpen={status === 'mfaRequired' && !otpDismissed && pendingCredentials != null}
+        isOpen={status === 'mfaRequired' && mfaChallenge?.kind === 'legacy' && !otpDismissed && pendingCredentials != null}
         isSubmitting={status === 'loading'}
         invalidCode={error === 'invalid_totp'}
         onSubmit={onOtpSubmit}
@@ -140,7 +155,7 @@ export default function Login() {
             </ModalHeader>
             <ModalBody>
               <Text>{t('login.errorModal.message')}</Text>
-              {error ? <Text className="mt-2 text-sm text-gray-500">{error}</Text> : null}
+              {displayError ? <Text className="mt-2 text-sm text-gray-500">{displayError}</Text> : null}
             </ModalBody>
             <ModalFooter>
               <Button
diff --git a/src/app/login/recovery.tsx b/src/app/login/recovery.tsx
new file mode 100644
index 00000000..7e96c452
--- /dev/null
+++ b/src/app/login/recovery.tsx
@@ -0,0 +1,204 @@
+import * as Linking from 'expo-linking';
+import { Stack, useRouter } from 'expo-router';
+import React, { useCallback, useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { ScrollView } from 'react-native';
+
+import { RecoveryCodes } from '@/components/mfa/recovery-codes';
+import { FocusAwareStatusBar } from '@/components/ui';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Checkbox, CheckboxIndicator, CheckboxLabel } from '@/components/ui/checkbox';
+import { Heading } from '@/components/ui/heading';
+import { Input, InputField } from '@/components/ui/input';
+import { Spinner } from '@/components/ui/spinner';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+import { mfaErrorKey } from '@/lib/mfa/messages';
+import type { PasskeyData, TotpSetupData } from '@/lib/mfa/types';
+import { abandonFactorRecovery, finishFactorRecovery, hasLoginTransaction, recoveryReplacementKey } from '@/stores/auth/login-mfa';
+import useAuthStore from '@/stores/auth/store';
+
+type Step = 'code' | 'replace' | 'done' | 'help';
+
+/**
+ * "I lost my authenticator" (passkey plan sections 5.4 and 6.3). A recovery code, after the password or single sign-on,
+ * opens a restricted recovery: a new authenticator is staged and activated only when a code from it verifies, lost
+ * passkeys can be removed, and every session ends. Without a recovery code the page says who can help; nothing here
+ * waives MFA.
+ */
+export default function FactorRecovery() {
+  const { t } = useTranslation();
+  const router = useRouter();
+  const [step, setStep] = useState<Step>(() => (hasLoginTransaction() ? 'code' : 'help'));
+  const [code, setCode] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [errorCode, setErrorCode] = useState<string | null>(null);
+  const [passkeys, setPasskeys] = useState<PasskeyData[]>([]);
+  const [remove, setRemove] = useState<string[]>([]);
+  const [key, setKey] = useState<TotpSetupData | null>(null);
+  const [recoveryCodes, setRecoveryCodes] = useState<string[]>([]);
+
+  useEffect(() => {
+    if (step !== 'replace' || key) {
+      return;
+    }
+    void recoveryReplacementKey().then((result) => ('SharedKey' in result ? setKey(result) : setErrorCode(result.code)));
+  }, [step, key]);
+
+  const begin = useCallback(async () => {
+    setBusy(true);
+    setErrorCode(null);
+    const started = await useAuthStore.getState().beginFactorRecovery(code);
+    setBusy(false);
+    setCode('');
+    if ('passkeys' in started) {
+      setPasskeys(started.passkeys);
+      setStep('replace');
+    } else if (started.restart) {
+      setStep('help');
+      setErrorCode(started.code);
+    } else {
+      setErrorCode(started.code);
+    }
+  }, [code]);
+
+  const finish = useCallback(async () => {
+    setBusy(true);
+    setErrorCode(null);
+    const done = await finishFactorRecovery(code, remove);
+    setBusy(false);
+    setCode('');
+    if ('recoveryCodes' in done) {
+      setRecoveryCodes(done.recoveryCodes);
+      setStep('done');
+    } else {
+      setErrorCode(done.code);
+      if (done.ended) {
+        setStep('help');
+      }
+    }
+  }, [code, remove]);
+
+  const cancel = useCallback(async () => {
+    await abandonFactorRecovery();
+    router.replace('/login');
+  }, [router]);
+
+  const togglePasskey = (id: string) => setRemove((current) => (current.includes(id) ? current.filter((x) => x !== id) : [...current, id]));
+
+  return (
+    <>
+      <FocusAwareStatusBar />
+      <Stack.Screen options={{ title: t('mfa.recovery.title') }} />
+      <ScrollView contentContainerStyle={{ padding: 24 }} keyboardShouldPersistTaps="handled">
+        <VStack space="md">
+          <Heading size="md">{t('mfa.recovery.title')}</Heading>
+
+          {step === 'code' ? (
+            <>
+              <Text size="sm">{t('mfa.recovery.code_body')}</Text>
+              <Input variant="outline" size="lg" isDisabled={busy}>
+                <InputField
+                  testID="recovery-code-input"
+                  value={code}
+                  onChangeText={setCode}
+                  placeholder={t('mfa.login.recovery_placeholder')}
+                  autoCapitalize="none"
+                  autoCorrect={false}
+                  aria-label={t('mfa.login.recovery_placeholder')}
+                />
+              </Input>
+              <Button action="primary" onPress={() => void begin()} isDisabled={busy || code.trim().length === 0} testID="recovery-begin">
+                {busy ? <Spinner size="small" /> : <ButtonText>{t('mfa.recovery.begin')}</ButtonText>}
+              </Button>
+              <Button variant="link" action="secondary" onPress={() => setStep('help')} testID="recovery-no-code">
+                <ButtonText>{t('mfa.recovery.no_code')}</ButtonText>
+              </Button>
+            </>
+          ) : null}
+
+          {step === 'replace' ? (
+            <>
+              <Text size="sm">{t('mfa.recovery.replace_body')}</Text>
+              {key ? (
+                <VStack space="sm">
+                  <Text selectable className="font-mono text-lg" testID="recovery-shared-key">
+                    {key.SharedKey}
+                  </Text>
+                  <Button variant="outline" action="secondary" size="sm" onPress={() => void Linking.openURL(key.AuthenticatorUri)}>
+                    <ButtonText>{t('mfa.setup.open_app')}</ButtonText>
+                  </Button>
+                </VStack>
+              ) : (
+                <Spinner size="small" />
+              )}
+              {passkeys.length > 0 ? (
+                <VStack space="xs" testID="recovery-passkeys">
+                  <Text size="sm" className="font-semibold">
+                    {t('mfa.recovery.remove_passkeys')}
+                  </Text>
+                  {passkeys.map((passkey) => (
+                    <Checkbox
+                      key={passkey.PasskeyId}
+                      value={passkey.PasskeyId}
+                      isChecked={remove.includes(passkey.PasskeyId)}
+                      onChange={() => togglePasskey(passkey.PasskeyId)}
+                      testID={`recovery-passkey-${passkey.PasskeyId}`}
+                    >
+                      <CheckboxIndicator />
+                      <CheckboxLabel>{passkey.DisplayName}</CheckboxLabel>
+                    </Checkbox>
+                  ))}
+                </VStack>
+              ) : null}
+              <Input variant="outline" size="lg" isDisabled={busy}>
+                <InputField
+                  testID="recovery-new-code"
+                  value={code}
+                  onChangeText={setCode}
+                  placeholder={t('mfa.login.code_placeholder')}
+                  keyboardType="number-pad"
+                  maxLength={8}
+                  autoComplete="one-time-code"
+                  textContentType="oneTimeCode"
+                  aria-label={t('mfa.login.code_placeholder')}
+                />
+              </Input>
+              <Button action="primary" onPress={() => void finish()} isDisabled={busy || !key || code.trim().length === 0} testID="recovery-finish">
+                {busy ? <Spinner size="small" /> : <ButtonText>{t('mfa.recovery.finish')}</ButtonText>}
+              </Button>
+              <Button variant="outline" action="secondary" onPress={() => void cancel()} isDisabled={busy} testID="recovery-cancel">
+                <ButtonText>{t('mfa.recovery.cancel')}</ButtonText>
+              </Button>
+            </>
+          ) : null}
+
+          {step === 'done' ? (
+            <>
+              <Text size="sm">{t('mfa.recovery.done_body')}</Text>
+              <RecoveryCodes codes={recoveryCodes} />
+              <Button action="primary" onPress={() => router.replace('/login')} testID="recovery-sign-in">
+                <ButtonText>{t('mfa.recovery.sign_in')}</ButtonText>
+              </Button>
+            </>
+          ) : null}
+
+          {step === 'help' ? (
+            <>
+              <Text size="sm">{t('mfa.recovery.help_body')}</Text>
+              <Button action="primary" onPress={() => router.replace('/login')} testID="recovery-back">
+                <ButtonText>{t('mfa.recovery.back_to_sign_in')}</ButtonText>
+              </Button>
+            </>
+          ) : null}
+
+          {errorCode ? (
+            <Text size="sm" className="text-error-600" testID="recovery-error" accessibilityLiveRegion="polite" accessibilityRole="alert" role="alert">
+              {t(mfaErrorKey(errorCode))}
+            </Text>
+          ) : null}
+        </VStack>
+      </ScrollView>
+    </>
+  );
+}
diff --git a/src/app/login/sso.tsx b/src/app/login/sso.tsx
index 1e7b437b..329cca74 100644
--- a/src/app/login/sso.tsx
+++ b/src/app/login/sso.tsx
@@ -1,9 +1,10 @@
 import { Stack, useRouter } from 'expo-router';
 import React, { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { View } from 'react-native';
+import { Platform, View } from 'react-native';
 
 import { SsoDepartmentForm, SsoLoginButtons } from '@/app/login/sso-section';
+import { LoginMfaSheet } from '@/components/auth/login-mfa-sheet';
 import { LoginOtpModal } from '@/components/auth/login-otp-modal';
 import { FocusAwareStatusBar } from '@/components/ui';
 import { Button, ButtonText } from '@/components/ui/button';
@@ -28,6 +29,7 @@ export default function SsoLogin() {
   // screen's prompt on that status alone means retrySsoWithOtp fires with no pending SSO
   // exchange, which drops the user into an error state instead of a code prompt.
   const isSsoMfaPending = useAuthStore((s) => s.isSsoMfaPending);
+  const mfaChallenge = useAuthStore((s) => s.mfaChallenge);
   const { trackEvent } = useAnalytics();
 
   const [ssoPhase, setSsoPhase] = useState<SsoPhase>('department');
@@ -40,13 +42,13 @@ export default function SsoLogin() {
   const oidc = useOidcLogin({
     authority: ssoConfig?.authority ?? '',
     clientId: ssoConfig?.clientId ?? '',
-    departmentCode: username,
+    departmentToken: ssoConfig?.departmentToken ?? '',
   });
 
-  // SAML hook
+  // SAML without the broker starts on the server's page (discovery's SamlLoginUrl), which sends the browser on to the IdP.
   const saml = useSamlLogin({
-    idpSsoUrl: ssoConfig?.metadataUrl ?? ssoConfig?.authority ?? '',
-    departmentCode: username,
+    signInUrl: ssoConfig?.samlLoginUrl ?? '',
+    departmentToken: ssoConfig?.departmentToken ?? '',
   });
 
   // Redirect to app on successful auth
@@ -117,7 +119,18 @@ export default function SsoLogin() {
     setSsoPhase('department');
   }, []);
 
+  // Brokered SSO (passkey plan section 7.7.2): the Resgrid broker talks to the provider, and only a one-time code comes
+  // back to this app. The app-side OIDC and SAML flows below remain for servers without the broker.
+  const startBrokeredSso = useCallback(async () => {
+    trackEvent('sso_brokered_started', { timestamp: new Date().toISOString() });
+    await useAuthStore.getState().loginWithBrokeredSso(ssoConfig?.departmentToken ? { departmentToken: ssoConfig.departmentToken } : { username });
+  }, [ssoConfig, trackEvent, username]);
+
   const handleOidcPress = useCallback(() => {
+    if (ssoConfig?.brokeredSsoAvailable) {
+      void startBrokeredSso();
+      return;
+    }
     const authorityUrl = ssoConfig?.authority ?? '';
     if (!isValidSsoUrl(authorityUrl)) {
       logger.error({ message: 'SSO: refusing OIDC login with invalid or insecure authority URL' });
@@ -125,17 +138,22 @@ export default function SsoLogin() {
       return;
     }
     void oidc.promptAsync();
-  }, [oidc, ssoConfig]);
+  }, [oidc, ssoConfig, startBrokeredSso]);
 
   const handleSamlPress = useCallback(() => {
-    const samlUrl = ssoConfig?.metadataUrl ?? ssoConfig?.authority ?? '';
-    if (!isValidSsoUrl(samlUrl)) {
-      logger.error({ message: 'SSO: refusing SAML login with invalid or insecure IdP URL' });
+    if (ssoConfig?.brokeredSsoAvailable) {
+      void startBrokeredSso();
+      return;
+    }
+    // Without the broker, SAML returns through this app's own scheme, which only the native app receives, and it needs the
+    // server's start page (an older server names none). The relay's callback is handled by the root layout.
+    if (Platform.OS === 'web' || !ssoConfig?.samlLoginUrl) {
+      logger.error({ message: 'SSO: SAML sign-in cannot start here without brokered sign-in' });
       setIsErrorModalVisible(true);
       return;
     }
     void saml.startSamlLogin();
-  }, [saml, ssoConfig]);
+  }, [saml, ssoConfig, startBrokeredSso]);
 
   const ssoEnabled = ssoConfig?.ssoEnabled ?? false;
 
@@ -158,7 +176,7 @@ export default function SsoLogin() {
           onOidcPress={handleOidcPress}
           onSamlPress={handleSamlPress}
           onChangeDepartment={handleChangeDepartment}
-          oidcRequestReady={!!oidc.request}
+          oidcRequestReady={ssoConfig.brokeredSsoAvailable || !!oidc.request}
           isLoading={status === 'loading'}
         />
       ) : (
@@ -173,6 +191,9 @@ export default function SsoLogin() {
         </View>
       )}
 
+      {/* Second factor after a brokered sign-in, on the login transaction the broker's redemption started */}
+      <LoginMfaSheet isOpen={status === 'mfaRequired' && mfaChallenge?.source === 'sso' && mfaChallenge.kind !== 'legacy'} onLostFactor={() => router.push('/login/recovery')} />
+
       {/* Two-factor challenge: SSO exchange answered mfa_required / invalid_totp */}
       <LoginOtpModal
         isOpen={status === 'mfaRequired' && isSsoMfaPending && !otpDismissed}
diff --git a/src/app/onboarding.tsx b/src/app/onboarding.tsx
index 3555000a..e3ef6809 100644
--- a/src/app/onboarding.tsx
+++ b/src/app/onboarding.tsx
@@ -1,72 +1,12 @@
-import { useFocusEffect } from 'expo-router';
-import { useRouter } from 'expo-router';
-import { Bell, ChevronRight, MapPin, Users } from 'lucide-react-native';
-import { useColorScheme } from 'nativewind';
-import React, { useCallback, useMemo, useRef, useState } from 'react';
+import { useFocusEffect, useRouter } from 'expo-router';
+import { Bell, MapPin, Users } from 'lucide-react-native';
+import React, { useCallback, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import type { GestureResponderEvent } from 'react-native';
-import { Dimensions, Image, ScrollView, StyleSheet } from 'react-native';
-import Animated, { useAnimatedStyle, useSharedValue, withTiming } from 'react-native-reanimated';
 
-import { FocusAwareStatusBar, SafeAreaView, View } from '@/components/ui';
-import { Pressable } from '@/components/ui/pressable';
-import { Text } from '@/components/ui/text';
+import { OnboardingScreen } from '@/components/onboarding/onboarding-screen';
 import { useAnalytics } from '@/hooks/use-analytics';
 import { useIsFirstTime } from '@/lib/storage';
 
-const { width } = Dimensions.get('window');
-const SWIPE_THRESHOLD = 60;
-
-// Color constants
-const COLORS = {
-  primary: '#FF7B1A',
-  text: {
-    light: {
-      primary: '#1f2937',
-      secondary: '#6b7280',
-    },
-    dark: {
-      primary: '#ffffff',
-      secondary: '#d1d5db',
-    },
-  },
-};
-
-// Static styles
-const styles = StyleSheet.create({
-  onboardingContainer: {
-    height: 400,
-    justifyContent: 'center',
-    alignItems: 'center',
-    paddingHorizontal: 32,
-  },
-  iconContainer: {
-    marginBottom: 32,
-    alignItems: 'center',
-  },
-  title: {
-    fontSize: 28,
-    fontWeight: 'bold',
-    textAlign: 'center',
-    marginBottom: 16,
-  },
-  description: {
-    fontSize: 16,
-    textAlign: 'center',
-    lineHeight: 24,
-  },
-  flexContainer: {
-    flex: 1,
-    minHeight: 400,
-  },
-});
-
-interface OnboardingItemProps {
-  title: string;
-  description: string;
-  icon: React.ReactNode;
-}
-
 interface OnboardingSlide {
   titleKey: string;
   descriptionKey: string;
@@ -77,75 +17,26 @@ const onboardingData: OnboardingSlide[] = [
   {
     titleKey: 'onboarding.slides.responder.title',
     descriptionKey: 'onboarding.slides.responder.description',
-    icon: <MapPin size={80} color={COLORS.primary} />,
+    icon: <MapPin size={56} color={'#FF7B1A'} />,
   },
   {
     titleKey: 'onboarding.slides.notifications.title',
     descriptionKey: 'onboarding.slides.notifications.description',
-    icon: <Bell size={80} color={COLORS.primary} />,
+    icon: <Bell size={56} color={'#FF7B1A'} />,
   },
   {
     titleKey: 'onboarding.slides.calls.title',
     descriptionKey: 'onboarding.slides.calls.description',
-    icon: <Users size={80} color={COLORS.primary} />,
+    icon: <Users size={56} color={'#FF7B1A'} />,
   },
 ];
 
-const OnboardingItem: React.FC<OnboardingItemProps> = ({ title, description, icon }) => {
-  const { colorScheme } = useColorScheme();
-
-  // Compute dynamic colors once using useMemo
-  const textColors = useMemo(() => {
-    const isDark = colorScheme === 'dark';
-    return {
-      title: isDark ? COLORS.text.dark.primary : COLORS.text.light.primary,
-      description: isDark ? COLORS.text.dark.secondary : COLORS.text.light.secondary,
-    };
-  }, [colorScheme]);
-
-  return (
-    <View style={[styles.onboardingContainer, { width }]}>
-      <View style={styles.iconContainer}>{icon}</View>
-      <Text style={[styles.title, { color: textColors.title }]}>{title}</Text>
-      <Text style={[styles.description, { color: textColors.description }]}>{description}</Text>
-    </View>
-  );
-};
-
-const Pagination: React.FC<{ currentIndex: number; items: OnboardingSlide[] }> = ({ currentIndex, items }) => {
-  return (
-    <View className="mt-8 flex-row justify-center">
-      {items.map((item, index) => (
-        <View key={item.titleKey} className={`mx-1 h-2.5 rounded-full ${currentIndex === index ? 'w-6 bg-primary-500' : 'w-2.5 bg-primary-300'}`} />
-      ))}
-    </View>
-  );
-};
-
 export default function Onboarding() {
   const { t } = useTranslation();
-  const [_, setIsFirstTime] = useIsFirstTime();
-  //const { setIsOnboarding } = useAuthStore();
+  const [, setIsFirstTime] = useIsFirstTime();
   const { trackEvent } = useAnalytics();
   const router = useRouter();
   const [currentIndex, setCurrentIndex] = useState(0);
-  const swipeStartXRef = useRef<number | null>(null);
-  const buttonOpacity = useSharedValue(0);
-  const { colorScheme } = useColorScheme();
-
-  // Initialize button opacity when reaching the last slide
-  React.useEffect(() => {
-    if (currentIndex === onboardingData.length - 1) {
-      buttonOpacity.value = withTiming(1, { duration: 500 });
-    } else {
-      buttonOpacity.value = withTiming(0, { duration: 300 });
-    }
-  }, [currentIndex, buttonOpacity]);
-
-  //useEffect(() => {
-  //  setIsOnboarding();
-  //}, [setIsOnboarding]);
-
   // Analytics: Track when the onboarding page is viewed
   useFocusEffect(
     useCallback(() => {
@@ -217,45 +108,6 @@ export default function Onboarding() {
     }
   }, [currentIndex, goToSlide, trackEvent, getSlideTitle]);
 
-  const handleSlideTouchStart = useCallback((event: GestureResponderEvent) => {
-    swipeStartXRef.current = typeof event.nativeEvent.pageX === 'number' ? event.nativeEvent.pageX : null;
-  }, []);
-
-  const handleSlideTouchEnd = useCallback(
-    (event: GestureResponderEvent) => {
-      const startX = swipeStartXRef.current;
-      const endX = typeof event.nativeEvent.pageX === 'number' ? event.nativeEvent.pageX : null;
-
-      swipeStartXRef.current = null;
-
-      if (startX === null || endX === null) {
-        return;
-      }
-
-      const deltaX = endX - startX;
-
-      if (deltaX <= -SWIPE_THRESHOLD) {
-        if (currentIndex < onboardingData.length - 1) {
-          goToSlide(currentIndex + 1);
-        } else {
-          handleGetStarted();
-        }
-      }
-
-      if (deltaX >= SWIPE_THRESHOLD && currentIndex > 0) {
-        goToSlide(currentIndex - 1);
-      }
-    },
-    [currentIndex, goToSlide, handleGetStarted]
-  );
-
-  const buttonAnimatedStyle = useAnimatedStyle(() => {
-    return {
-      opacity: buttonOpacity.value,
-      transform: [{ translateY: (1 - buttonOpacity.value) * 20 }],
-    };
-  });
-
   const handleSkip = useCallback(() => {
     // Analytics: Track skip button clicks
     trackEvent('onboarding_skip_clicked', {
@@ -269,73 +121,21 @@ export default function Onboarding() {
     router.replace('/login');
   }, [trackEvent, currentIndex, setIsFirstTime, router, getSlideTitle]);
 
-  const handleSkipBottom = useCallback(() => {
-    // Analytics: Track skip button clicks
-    trackEvent('onboarding_skip_clicked', {
-      timestamp: new Date().toISOString(),
-      currentSlide: currentIndex,
-      slideTitle: getSlideTitle(currentIndex),
-    });
-
-    setIsFirstTime(false);
-    router.replace('/login');
-  }, [trackEvent, currentIndex, setIsFirstTime, router, getSlideTitle]);
-
-  const actionTextColor = colorScheme === 'dark' ? '#000000' : '#FFFFFF';
   const currentSlide = onboardingData[currentIndex];
-
   return (
-    <SafeAreaView className="flex-1">
-      <FocusAwareStatusBar hidden={true} />
-      <ScrollView contentContainerStyle={{ flexGrow: 1 }} showsVerticalScrollIndicator={false} bounces={false}>
-        <View className="w-full items-center justify-center px-10 pt-20">
-          <Image style={{ width: '96%' }} resizeMode="contain" source={colorScheme === 'dark' ? require('@assets/images/Resgrid_JustText_White.png') : require('@assets/images/Resgrid_JustText.png')} />
-
-          {/* Skip button in upper right corner */}
-          <Pressable onPress={handleSkip} className="absolute right-8 top-4" testID="skip-button-top" accessibilityRole="button" accessibilityLabel={t('onboarding.skip')}>
-            <Text className="text-base font-semibold text-primary-500">{t('onboarding.skip')}</Text>
-          </Pressable>
-        </View>
-
-        <View style={styles.flexContainer}>
-          <View testID="onboarding-flatlist" onTouchStart={handleSlideTouchStart} onTouchEnd={handleSlideTouchEnd}>
-            <OnboardingItem key={currentSlide.titleKey} title={t(currentSlide.titleKey)} description={t(currentSlide.descriptionKey)} icon={currentSlide.icon} />
-          </View>
-        </View>
-
-        <Pagination currentIndex={currentIndex} items={onboardingData} />
-
-        <View className="mb-8 mt-4 px-8">
-          {currentIndex < onboardingData.length - 1 ? (
-            <View className="flex-row items-center justify-between">
-              <Pressable onPress={handleSkipBottom} accessibilityRole="button" accessibilityLabel={t('onboarding.skip')}>
-                <Text className="text-gray-500">{t('onboarding.skip')}</Text>
-              </Pressable>
-
-              <Pressable accessibilityRole="button" accessibilityLabel={t('common.next')} className="h-11 flex-row items-center justify-center rounded bg-primary-500 px-6" onPress={nextSlide} testID="next-button">
-                <Text style={{ color: actionTextColor }} className="text-base font-semibold">
-                  {t('common.next')}
-                </Text>
-                <ChevronRight size={20} color={colorScheme === 'dark' ? 'black' : 'white'} />
-              </Pressable>
-            </View>
-          ) : (
-            <Animated.View style={buttonAnimatedStyle}>
-              <Pressable
-                accessibilityRole="button"
-                accessibilityLabel={t('onboarding.get_started')}
-                className="h-11 w-full flex-row items-center justify-center rounded bg-primary-500"
-                testID="get-started-button"
-                onPress={handleGetStarted}
-              >
-                <Text style={{ color: actionTextColor }} className="text-base font-semibold">
-                  {t('onboarding.get_started')}
-                </Text>
-              </Pressable>
-            </Animated.View>
-          )}
-        </View>
-      </ScrollView>
-    </SafeAreaView>
+    <OnboardingScreen
+      title={t(currentSlide.titleKey)}
+      description={t(currentSlide.descriptionKey)}
+      icon={currentSlide.icon}
+      currentIndex={currentIndex}
+      total={onboardingData.length}
+      skipLabel={t('onboarding.skip')}
+      nextLabel={t('common.next')}
+      finishLabel={t('onboarding.get_started')}
+      onSkip={handleSkip}
+      onNext={nextSlide}
+      onFinish={handleGetStarted}
+      onSlideChange={goToSlide}
+    />
   );
 }
diff --git a/src/app/sso-return.tsx b/src/app/sso-return.tsx
new file mode 100644
index 00000000..31f24861
--- /dev/null
+++ b/src/app/sso-return.tsx
@@ -0,0 +1,32 @@
+import { useRouter } from 'expo-router';
+import * as WebBrowser from 'expo-web-browser';
+import React, { useEffect } from 'react';
+import { Platform, View } from 'react-native';
+
+import { Spinner } from '@/components/ui/spinner';
+
+// The page the Resgrid SSO broker returns to (passkey plan section 7.7.2). The browser auth session that opened the
+// provider reads the one-time code from this URL; on the web this popup hands it back and closes. Nothing is read or
+// stored here, and a stray visit simply goes back.
+WebBrowser.maybeCompleteAuthSession();
+
+export default function SsoReturn() {
+  const router = useRouter();
+
+  useEffect(() => {
+    if (Platform.OS === 'web') {
+      return;
+    }
+    if (router.canGoBack()) {
+      router.back();
+    } else {
+      router.replace('/login');
+    }
+  }, [router]);
+
+  return (
+    <View className="flex-1 items-center justify-center" testID="sso-return">
+      <Spinner size="large" />
+    </View>
+  );
+}
diff --git a/src/components/auth/__tests__/login-mfa-sheet.test.tsx b/src/components/auth/__tests__/login-mfa-sheet.test.tsx
new file mode 100644
index 00000000..fc33f7e6
--- /dev/null
+++ b/src/components/auth/__tests__/login-mfa-sheet.test.tsx
@@ -0,0 +1,159 @@
+import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
+import React from 'react';
+
+import type { MfaChallenge } from '@/lib/mfa/types';
+import useAuthStore from '@/stores/auth/store';
+
+import { LoginMfaSheet } from '../login-mfa-sheet';
+
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/components/ui/modal', () => {
+  const { View } = require('react-native');
+  return {
+    Modal: ({ isOpen, children, ...props }: any) => (isOpen ? <View {...props}>{children}</View> : null),
+    ModalBackdrop: () => null,
+    ModalBody: ({ children }: any) => <View>{children}</View>,
+    ModalContent: ({ children }: any) => <View>{children}</View>,
+    ModalFooter: ({ children }: any) => <View>{children}</View>,
+    ModalHeader: ({ children }: any) => <View>{children}</View>,
+  };
+});
+jest.mock('@/lib/mfa/passkey', () => ({ passkeysSupported: jest.fn(() => true) }));
+jest.mock('expo-linking', () => ({ openURL: jest.fn() }));
+
+const challenge = (overrides: Partial<MfaChallenge> = {}): MfaChallenge => ({
+  kind: 'verify',
+  methods: ['totp', 'passkey', 'passkey_approval', 'federated'],
+  enrolled: ['totp', 'passkey', 'passkey_approval', 'federated'],
+  preferred: 'totp',
+  expiresAt: null,
+  source: 'password',
+  ...overrides,
+});
+
+describe('LoginMfaSheet', () => {
+  const verifyLoginMfa = jest.fn();
+  const requestLoginApproval = jest.fn();
+  const waitForLoginApproval = jest.fn();
+  const cancelLoginApproval = jest.fn();
+  const cancelLoginMfa = jest.fn();
+  const loginSetupOptions = jest.fn();
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    verifyLoginMfa.mockResolvedValue({ ok: true, recovery: false });
+    useAuthStore.setState({ mfaChallenge: challenge(), verifyLoginMfa, requestLoginApproval, waitForLoginApproval, cancelLoginApproval, cancelLoginMfa, loginSetupOptions });
+  });
+
+  it('offers every method this sign-in accepts and submits a code', async () => {
+    const { getByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    expect(getByTestId('login-mfa-passkey')).toBeTruthy();
+    expect(getByTestId('login-mfa-approval')).toBeTruthy();
+    expect(getByTestId('login-mfa-provider')).toBeTruthy();
+
+    fireEvent.changeText(getByTestId('login-mfa-code'), '123456');
+    await act(async () => fireEvent.press(getByTestId('login-mfa-submit')));
+    expect(verifyLoginMfa).toHaveBeenCalledWith({ method: 'totp', code: '123456' });
+  });
+
+  it('offers only the accepted methods the member has', () => {
+    useAuthStore.setState({ mfaChallenge: challenge({ enrolled: ['totp', 'passkey'] }) });
+    const { getByTestId, queryByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    expect(getByTestId('login-mfa-code')).toBeTruthy();
+    expect(getByTestId('login-mfa-passkey')).toBeTruthy();
+    expect(queryByTestId('login-mfa-approval')).toBeNull();
+    expect(queryByTestId('login-mfa-provider')).toBeNull();
+  });
+
+  it('shows a member who signs in only through the provider no code box', () => {
+    useAuthStore.setState({ mfaChallenge: challenge({ methods: ['totp', 'federated'], enrolled: ['federated'], preferred: 'federated' }) });
+    const { getByTestId, queryByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    expect(getByTestId('login-mfa-provider')).toBeTruthy();
+    expect(queryByTestId('login-mfa-code')).toBeNull();
+    expect(queryByTestId('login-mfa-recovery-toggle')).toBeNull();
+  });
+
+  it('keeps every accepted method from a server that sends no member list', () => {
+    useAuthStore.setState({ mfaChallenge: challenge({ enrolled: [] }) });
+    const { getByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    expect(getByTestId('login-mfa-approval')).toBeTruthy();
+    expect(getByTestId('login-mfa-provider')).toBeTruthy();
+  });
+
+  it('offers only what the server lists, and uses a recovery code on request', async () => {
+    useAuthStore.setState({ mfaChallenge: challenge({ methods: ['totp'] }) });
+    const { queryByTestId, getByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    expect(queryByTestId('login-mfa-passkey')).toBeNull();
+    expect(queryByTestId('login-mfa-approval')).toBeNull();
+
+    fireEvent.press(getByTestId('login-mfa-recovery-toggle'));
+    fireEvent.changeText(getByTestId('login-mfa-code'), 'ABCD-EFGH');
+    await act(async () => fireEvent.press(getByTestId('login-mfa-submit')));
+    expect(verifyLoginMfa).toHaveBeenCalledWith({ method: 'recovery_code', code: 'ABCD-EFGH' });
+  });
+
+  it('shows why a code failed, in the member\'s language', async () => {
+    verifyLoginMfa.mockResolvedValue({ ok: false, code: 'invalid_totp', restart: false });
+    const { getByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    fireEvent.changeText(getByTestId('login-mfa-code'), '000000');
+    await act(async () => fireEvent.press(getByTestId('login-mfa-submit')));
+    expect(getByTestId('login-mfa-error').props.children).toBe('mfa.errors.invalid_totp');
+  });
+
+  it('lets the member try again when a step fails unexpectedly', async () => {
+    verifyLoginMfa.mockRejectedValueOnce(new Error('boom'));
+    const { getByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    fireEvent.changeText(getByTestId('login-mfa-code'), '000000');
+    await act(async () => fireEvent.press(getByTestId('login-mfa-submit')));
+    expect(getByTestId('login-mfa-error').props.children).toBe('mfa.errors.unknown_error');
+
+    fireEvent.changeText(getByTestId('login-mfa-code'), '123456');
+    await act(async () => fireEvent.press(getByTestId('login-mfa-submit')));
+    expect(verifyLoginMfa).toHaveBeenLastCalledWith({ method: 'totp', code: '123456' });
+  });
+
+  it('shows the approval number on this screen and finishes once Responder approves', async () => {
+    requestLoginApproval.mockResolvedValue({ ApprovalRequestId: 'ap-1', MatchNumber: '42', ExpiresIn: 120 });
+    let decide: (value: string) => void = () => undefined;
+    waitForLoginApproval.mockReturnValue(new Promise((resolve) => (decide = resolve)));
+
+    const { getByTestId, queryByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    await act(async () => fireEvent.press(getByTestId('login-mfa-approval')));
+    expect(getByTestId('mfa-approval-number').props.children).toBe('42');
+    expect(queryByTestId('login-mfa-code')).toBeNull();
+
+    await act(async () => decide('approved'));
+    await waitFor(() => expect(verifyLoginMfa).toHaveBeenCalledWith({ method: 'passkey_approval', approvalRequestId: 'ap-1' }));
+  });
+
+  it('stops waiting and cancels the request when the member stops', async () => {
+    requestLoginApproval.mockResolvedValue({ ApprovalRequestId: 'ap-1', MatchNumber: '42', ExpiresIn: 120 });
+    waitForLoginApproval.mockReturnValue(new Promise(() => undefined));
+    const { getByTestId, queryByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    await act(async () => fireEvent.press(getByTestId('login-mfa-approval')));
+    await act(async () => fireEvent.press(getByTestId('mfa-approval-cancel')));
+    expect(cancelLoginApproval).toHaveBeenCalledWith('ap-1');
+    expect(queryByTestId('mfa-approval-panel')).toBeNull();
+  });
+
+  it('sets up the required authenticator with a new key before signing in', async () => {
+    useAuthStore.setState({ mfaChallenge: challenge({ kind: 'setup', methods: ['totp'], enrolled: [] }) });
+    loginSetupOptions.mockResolvedValue({ SharedKey: 'ABCD EFGH', AuthenticatorUri: 'otpauth://totp/x', ExpiresIn: 600 });
+    const { getByTestId, queryByTestId } = render(<LoginMfaSheet isOpen onLostFactor={jest.fn()} />);
+    await waitFor(() => expect(getByTestId('mfa-setup-shared-key').props.children).toBe('ABCD EFGH'));
+    expect(queryByTestId('login-mfa-lost')).toBeNull();
+
+    fireEvent.changeText(getByTestId('login-mfa-code'), '123456');
+    await act(async () => fireEvent.press(getByTestId('login-mfa-submit')));
+    expect(verifyLoginMfa).toHaveBeenCalledWith({ method: 'setup', code: '123456' });
+  });
+
+  it('cancels the sign-in and offers the lost-authenticator path', async () => {
+    const onLostFactor = jest.fn();
+    const { getByTestId } = render(<LoginMfaSheet isOpen onLostFactor={onLostFactor} />);
+    fireEvent.press(getByTestId('login-mfa-lost'));
+    expect(onLostFactor).toHaveBeenCalled();
+    await act(async () => fireEvent.press(getByTestId('login-mfa-cancel')));
+    expect(cancelLoginMfa).toHaveBeenCalled();
+  });
+});
diff --git a/src/components/auth/login-mfa-sheet.tsx b/src/components/auth/login-mfa-sheet.tsx
new file mode 100644
index 00000000..aa159fca
--- /dev/null
+++ b/src/components/auth/login-mfa-sheet.tsx
@@ -0,0 +1,287 @@
+import * as Linking from 'expo-linking';
+import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { ApprovalPanel } from '@/components/mfa/approval-panel';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Heading } from '@/components/ui/heading';
+import { Input, InputField } from '@/components/ui/input';
+import { Modal, ModalBackdrop, ModalBody, ModalContent, ModalFooter, ModalHeader } from '@/components/ui/modal';
+import { Pressable } from '@/components/ui/pressable';
+import { Spinner } from '@/components/ui/spinner';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+import { mfaErrorKey } from '@/lib/mfa/messages';
+import { passkeysSupported } from '@/lib/mfa/passkey';
+import type { MfaMethod, TotpSetupData } from '@/lib/mfa/types';
+import useAuthStore from '@/stores/auth/store';
+
+interface LoginMfaSheetProps {
+  isOpen: boolean;
+  /** "I lost my authenticator": start the restricted recovery with a recovery code. */
+  onLostFactor: () => void;
+}
+
+type Mode = 'choose' | 'recovery';
+
+/**
+ * The second step of signing in on a login transaction (passkey plan section 7.5): the methods this sign-in accepts, as
+ * equal choices with the member's last one first. It also carries setting up the authenticator a department requires
+ * (section 6.2). Codes live only in local state and are cleared after every attempt; nothing here is logged or stored.
+ */
+export const LoginMfaSheet: React.FC<LoginMfaSheetProps> = ({ isOpen, onLostFactor }) => {
+  const { t } = useTranslation();
+  const challenge = useAuthStore((s) => s.mfaChallenge);
+  const [mode, setMode] = useState<Mode>('choose');
+  const [code, setCode] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [errorCode, setErrorCode] = useState<string | null>(null);
+  const [approval, setApproval] = useState<{ id: string; number: string } | null>(null);
+  const [setup, setSetup] = useState<TotpSetupData | null>(null);
+  const approvalAbort = useRef<AbortController | null>(null);
+
+  const isSetup = challenge?.kind === 'setup';
+  const methods = useMemo<MfaMethod[]>(() => {
+    // The accepted methods the member has (plan section 7.5, as Core Web shows them): the server lists the two apart, and a
+    // method the member lacks could only fail. A server that sends no member list keeps the full one.
+    const enrolled = challenge?.enrolled ?? [];
+    const usable = (challenge?.methods ?? []).filter((m) => enrolled.length === 0 || enrolled.includes(m));
+    const available = usable.filter((m) => m !== 'passkey' || passkeysSupported());
+    const preferred = challenge?.preferred;
+    return preferred && available.includes(preferred) ? [preferred, ...available.filter((m) => m !== preferred)] : available;
+  }, [challenge]);
+  const recoveryAvailable = !isSetup && (challenge?.enrolled ?? []).includes('totp');
+
+  const stopApproval = useCallback(() => {
+    approvalAbort.current?.abort();
+    approvalAbort.current = null;
+  }, []);
+
+  useEffect(() => {
+    if (!isOpen) {
+      stopApproval();
+      setMode('choose');
+      setCode('');
+      setErrorCode(null);
+      setApproval(null);
+      setSetup(null);
+      setBusy(false);
+    }
+  }, [isOpen, stopApproval]);
+
+  useEffect(() => stopApproval, [stopApproval]);
+
+  // Setting up the required authenticator: a new key, activated only when a code from it verifies.
+  useEffect(() => {
+    if (!isOpen || !isSetup || setup) {
+      return;
+    }
+    let cancelled = false;
+    void useAuthStore
+      .getState()
+      .loginSetupOptions()
+      .then((result) => {
+        if (cancelled) {
+          return;
+        }
+        if ('SharedKey' in result) {
+          setSetup(result);
+        } else {
+          setErrorCode(result.code);
+        }
+      });
+    return () => {
+      cancelled = true;
+    };
+  }, [isOpen, isSetup, setup]);
+
+  const run = useCallback(async (action: () => Promise<{ ok: boolean; code?: string }>) => {
+    setBusy(true);
+    setErrorCode(null);
+    try {
+      const result = await action();
+      if (!result.ok) {
+        setErrorCode(result.code ?? 'unknown_error');
+      }
+    } catch {
+      setErrorCode('unknown_error');
+    } finally {
+      setBusy(false);
+    }
+  }, []);
+
+  const submitCode = useCallback(() => {
+    const submitted = code.trim();
+    if (submitted.length === 0) {
+      return;
+    }
+    setCode('');
+    const method = isSetup ? 'setup' : mode === 'recovery' ? 'recovery_code' : 'totp';
+    void run(async () => {
+      const result = await useAuthStore.getState().verifyLoginMfa({ method, code: submitted });
+      return result.ok ? { ok: true } : { ok: false, code: result.code };
+    });
+  }, [code, isSetup, mode, run]);
+
+  const verifyWithPasskey = useCallback(() => {
+    void run(async () => {
+      const result = await useAuthStore.getState().verifyLoginMfa({ method: 'passkey' });
+      return result.ok ? { ok: true } : { ok: false, code: result.code };
+    });
+  }, [run]);
+
+  const verifyWithProvider = useCallback(() => {
+    void run(async () => {
+      const result = await useAuthStore.getState().verifyLoginMfa({ method: 'federated' });
+      return result.ok ? { ok: true } : { ok: false, code: result.code };
+    });
+  }, [run]);
+
+  const verifyWithApproval = useCallback(async () => {
+    setBusy(true);
+    setErrorCode(null);
+    const store = useAuthStore.getState();
+    const started = await store.requestLoginApproval();
+    if (!('ApprovalRequestId' in started)) {
+      setBusy(false);
+      setErrorCode(started.code);
+      return;
+    }
+
+    setApproval({ id: started.ApprovalRequestId, number: started.MatchNumber });
+    const controller = new AbortController();
+    approvalAbort.current = controller;
+    const decided = await store.waitForLoginApproval(started.ApprovalRequestId, controller.signal);
+    if (decided === 'aborted') {
+      return;
+    }
+    setApproval(null);
+    if (decided !== 'approved') {
+      setBusy(false);
+      setErrorCode(decided === 'denied' ? 'approval_denied' : decided === 'unavailable' ? 'service_unavailable' : 'approval_expired');
+      return;
+    }
+    const result = await store.verifyLoginMfa({ method: 'passkey_approval', approvalRequestId: started.ApprovalRequestId });
+    setBusy(false);
+    if (!result.ok) {
+      setErrorCode(result.code);
+    }
+  }, []);
+
+  const cancelApproval = useCallback(() => {
+    const current = approval;
+    stopApproval();
+    setApproval(null);
+    setBusy(false);
+    if (current) {
+      void useAuthStore.getState().cancelLoginApproval(current.id);
+    }
+  }, [approval, stopApproval]);
+
+  const cancelSignIn = useCallback(() => {
+    cancelApproval();
+    useAuthStore.getState().cancelLoginMfa();
+  }, [cancelApproval]);
+
+  const showsCodeInput = isSetup ? !!setup : mode === 'recovery' || methods.includes('totp');
+
+  return (
+    <Modal isOpen={isOpen} onClose={cancelSignIn} testID="login-mfa-sheet">
+      <ModalBackdrop />
+      <ModalContent>
+        <ModalHeader>
+          <Heading size="md">{isSetup ? t('mfa.setup.title') : t('mfa.login.title')}</Heading>
+        </ModalHeader>
+        <ModalBody>
+          <VStack space="md">
+            <Text size="sm">{isSetup ? t('mfa.setup.body') : mode === 'recovery' ? t('mfa.login.recovery_body') : t('mfa.login.body')}</Text>
+
+            {isSetup && setup ? (
+              <VStack space="sm" testID="mfa-setup-key">
+                <Text size="sm" className="font-semibold">
+                  {t('mfa.setup.key_label')}
+                </Text>
+                <Text selectable className="font-mono text-lg" testID="mfa-setup-shared-key">
+                  {setup.SharedKey}
+                </Text>
+                <Button variant="outline" action="secondary" size="sm" onPress={() => void Linking.openURL(setup.AuthenticatorUri)} testID="mfa-setup-open-app">
+                  <ButtonText>{t('mfa.setup.open_app')}</ButtonText>
+                </Button>
+              </VStack>
+            ) : null}
+
+            {approval ? <ApprovalPanel matchNumber={approval.number} onCancel={cancelApproval} /> : null}
+
+            {!approval && showsCodeInput ? (
+              <Input variant="outline" size="lg" isDisabled={busy}>
+                <InputField
+                  testID="login-mfa-code"
+                  value={code}
+                  onChangeText={setCode}
+                  placeholder={mode === 'recovery' ? t('mfa.login.recovery_placeholder') : t('mfa.login.code_placeholder')}
+                  keyboardType={mode === 'recovery' ? 'default' : 'number-pad'}
+                  autoCapitalize="none"
+                  autoCorrect={false}
+                  maxLength={mode === 'recovery' ? 32 : 8}
+                  autoComplete={mode === 'recovery' ? 'off' : 'one-time-code'}
+                  textContentType={mode === 'recovery' ? 'none' : 'oneTimeCode'}
+                  onSubmitEditing={submitCode}
+                  accessibilityLabel={mode === 'recovery' ? t('mfa.login.recovery_placeholder') : t('mfa.login.code_placeholder')}
+                  aria-label={mode === 'recovery' ? t('mfa.login.recovery_placeholder') : t('mfa.login.code_placeholder')}
+                />
+              </Input>
+            ) : null}
+
+            {!approval && showsCodeInput ? (
+              <Button action="primary" onPress={submitCode} isDisabled={busy || code.trim().length === 0} testID="login-mfa-submit">
+                {busy ? <Spinner size="small" /> : <ButtonText>{t('mfa.login.verify')}</ButtonText>}
+              </Button>
+            ) : null}
+
+            {!approval && !isSetup && mode === 'choose' && methods.includes('passkey') ? (
+              <Button variant="outline" action="secondary" onPress={verifyWithPasskey} isDisabled={busy} testID="login-mfa-passkey">
+                <ButtonText>{t('mfa.login.use_passkey')}</ButtonText>
+              </Button>
+            ) : null}
+            {!approval && !isSetup && mode === 'choose' && methods.includes('passkey_approval') ? (
+              <Button variant="outline" action="secondary" onPress={() => void verifyWithApproval()} isDisabled={busy} testID="login-mfa-approval">
+                <ButtonText>{t('mfa.login.use_approval')}</ButtonText>
+              </Button>
+            ) : null}
+            {!approval && !isSetup && mode === 'choose' && methods.includes('federated') ? (
+              <Button variant="outline" action="secondary" onPress={verifyWithProvider} isDisabled={busy} testID="login-mfa-provider">
+                <ButtonText>{t('mfa.login.use_provider')}</ButtonText>
+              </Button>
+            ) : null}
+
+            {errorCode ? (
+              <Text size="sm" className="text-error-600" testID="login-mfa-error" accessibilityLiveRegion="polite" accessibilityRole="alert" role="alert">
+                {t(mfaErrorKey(errorCode))}
+              </Text>
+            ) : null}
+
+            {!approval && recoveryAvailable ? (
+              <Pressable onPress={() => setMode(mode === 'recovery' ? 'choose' : 'recovery')} testID="login-mfa-recovery-toggle" accessibilityRole="button">
+                <Text size="sm" className="text-primary-600">
+                  {mode === 'recovery' ? t('mfa.login.use_other_method') : t('mfa.login.use_recovery_code')}
+                </Text>
+              </Pressable>
+            ) : null}
+            {!approval && !isSetup ? (
+              <Pressable onPress={onLostFactor} testID="login-mfa-lost" accessibilityRole="button">
+                <Text size="sm" className="text-primary-600">
+                  {t('mfa.login.lost_factor')}
+                </Text>
+              </Pressable>
+            ) : null}
+          </VStack>
+        </ModalBody>
+        <ModalFooter>
+          <Button variant="outline" action="secondary" onPress={cancelSignIn} isDisabled={busy && !approval} testID="login-mfa-cancel">
+            <ButtonText>{t('common.cancel')}</ButtonText>
+          </Button>
+        </ModalFooter>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/src/components/checklists/__tests__/checklist-run-sheet.test.tsx b/src/components/checklists/__tests__/checklist-run-sheet.test.tsx
index 6d68a78d..5c7e957a 100644
--- a/src/components/checklists/__tests__/checklist-run-sheet.test.tsx
+++ b/src/components/checklists/__tests__/checklist-run-sheet.test.tsx
@@ -7,11 +7,22 @@ jest.mock('expo-location', () => ({ requestForegroundPermissionsAsync: jest.fn()
 jest.mock('expo-file-system/legacy', () => ({ cacheDirectory: 'file:///cache/', deleteAsync: jest.fn() }));
 jest.mock('@/api/checklists/checklists', () => ({ attestChecklistRun: jest.fn() }));
 jest.mock('@/components/checklists/signature-pad', () => ({ ChecklistSignaturePad: () => null }));
-jest.mock('@/components/ui/button', () => { const { Pressable, Text } = require('react-native'); return { Button: ({ isDisabled, ...props }: { isDisabled?: boolean }) => <Pressable {...props} disabled={isDisabled} accessibilityState={{ disabled: !!isDisabled }} />, ButtonText: Text }; });
+jest.mock('@/components/ui/button', () => {
+  const { Pressable, Text } = require('react-native');
+  return { Button: ({ isDisabled, ...props }: { isDisabled?: boolean }) => <Pressable {...props} disabled={isDisabled} accessibilityState={{ disabled: !!isDisabled }} />, ButtonText: Text };
+});
 jest.mock('@/components/ui/text', () => ({ Text: require('react-native').Text }));
 jest.mock('react-native-safe-area-context', () => ({ SafeAreaView: require('react-native').View }));
-jest.mock('@/stores/auth/store', () => { const { create } = jest.requireActual('zustand'); return { __esModule: true, default: create(() => ({ userId: 'author' })) }; });
-jest.mock('@/stores/checklists/store', () => { const { create } = jest.requireActual('zustand'); return { useChecklistsStore: create(() => ({ active: null, update: jest.fn().mockResolvedValue(undefined), queue: jest.fn().mockResolvedValue(undefined), close: jest.fn(), addImage: jest.fn().mockResolvedValue(undefined) })) }; });
+jest.mock('@/stores/auth/store', () => {
+  const { create } = jest.requireActual('zustand');
+  return { __esModule: true, default: create(() => ({ userId: 'author' })) };
+});
+jest.mock('@/stores/checklists/store', () => {
+  const { create } = jest.requireActual('zustand');
+  return {
+    useChecklistsStore: create(() => ({ active: null, update: jest.fn().mockResolvedValue(undefined), queue: jest.fn().mockResolvedValue(undefined), close: jest.fn(), addImage: jest.fn().mockResolvedValue(undefined) })),
+  };
+});
 import React from 'react';
 import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
 import * as ImagePicker from 'expo-image-picker';
@@ -21,32 +32,73 @@ import { ChecklistRunSheet } from '@/components/checklists/checklist-run-sheet';
 import { draft } from '@/lib/checklists/__tests__/fixtures';
 import { useChecklistsStore } from '@/stores/checklists/store';
 
-beforeEach(() => { jest.clearAllMocks(); const local = draft(); local.queued = false; useChecklistsStore.setState({ active: local }); });
-it.each([0,1,2,3,4,5,6,7,8,9])('renders question type %i with localized controls', type => {
-  const local = draft(); local.queued = false; local.run.Form.Sections[0].Items[0].Type = type; local.run.Form.Sections[0].Items[0].Options = ['Synthetic option'];
-  useChecklistsStore.setState({ active: local }); const screen = render(<ChecklistRunSheet />);
+beforeEach(() => {
+  jest.clearAllMocks();
+  const local = draft();
+  local.queued = false;
+  useChecklistsStore.setState({ active: local });
+});
+it.each([0, 1, 2, 3, 4, 5, 6, 7, 8, 9])('renders question type %i with localized controls', (type) => {
+  const local = draft();
+  local.queued = false;
+  local.run.Form.Sections[0].Items[0].Type = type;
+  local.run.Form.Sections[0].Items[0].Options = ['Synthetic option'];
+  useChecklistsStore.setState({ active: local });
+  const screen = render(<ChecklistRunSheet />);
   expect(screen.getByText('Ready (checklists.labels.Required)')).toBeTruthy();
-  if ([3,4,5,7].includes(type)) { fireEvent.changeText(screen.getByLabelText('checklists.labels.Answer'), '12'); expect(useChecklistsStore.getState().update).toHaveBeenCalledWith(expect.objectContaining({ Answers: [expect.objectContaining({ Value: '12' })] })); }
-  if ([0,1,2,6].includes(type)) { fireEvent.press(screen.getByText(type===0 ? 'checklists.labels.Pass' : type===1 ? 'checklists.labels.Yes' : type===2 ? 'checklists.labels.Checked' : 'Synthetic option')); expect(useChecklistsStore.getState().update).toHaveBeenCalled(); }
-  if (type===8) expect(screen.getByText('checklists.labels.Photo')).toBeTruthy();
-  if (type===9) expect(screen.getByText('checklists.labels.Signature')).toBeTruthy();
+  if ([3, 4, 5].includes(type)) {
+    fireEvent.changeText(screen.getByLabelText('checklists.labels.Answer'), '12');
+    expect(useChecklistsStore.getState().update).toHaveBeenCalledWith(expect.objectContaining({ Answers: [expect.objectContaining({ Value: '12' })] }));
+  }
+  if ([0, 1, 2, 6].includes(type)) {
+    fireEvent.press(screen.getByText(type === 0 ? 'checklists.labels.Pass' : type === 1 ? 'checklists.labels.Yes' : type === 2 ? 'checklists.labels.Checked' : 'Synthetic option'));
+    expect(useChecklistsStore.getState().update).toHaveBeenCalled();
+  }
+  if (type === 8) expect(screen.getByText('checklists.labels.Photo')).toBeTruthy();
+  if (type === 9) expect(screen.getByText('checklists.labels.Signature')).toBeTruthy();
   screen.unmount();
 });
 it('queues progress and submission through the durable store', async () => {
-  const screen=render(<ChecklistRunSheet />); fireEvent.press(screen.getByText('checklists.labels.SaveProgress'));
-  await waitFor(()=>expect(useChecklistsStore.getState().queue).toHaveBeenCalledWith(false));
-  fireEvent.press(screen.getByText('checklists.labels.SubmitRun')); await waitFor(()=>expect(useChecklistsStore.getState().queue).toHaveBeenCalledWith(true)); screen.unmount();
+  const screen = render(<ChecklistRunSheet />);
+  fireEvent.press(screen.getByText('checklists.labels.SaveProgress'));
+  await waitFor(() => expect(useChecklistsStore.getState().queue).toHaveBeenCalledWith(false));
+  fireEvent.press(screen.getByText('checklists.labels.SubmitRun'));
+  await waitFor(() => expect(useChecklistsStore.getState().queue).toHaveBeenCalledWith(true));
+  screen.unmount();
 });
 it('normalizes photo bytes and deletes only app cache copies after encrypted persistence', async () => {
-  const local=draft(); local.queued=false; local.run.Form.Sections[0].Items[0].Type=8; useChecklistsStore.setState({active:local});
-  jest.mocked(ImagePicker.requestMediaLibraryPermissionsAsync).mockResolvedValue({granted:true} as never);
-  jest.mocked(ImagePicker.launchImageLibraryAsync).mockResolvedValue({canceled:false,assets:[{uri:'file:///gallery/original.heic',width:4000,height:3000}]} as never);
-  jest.mocked(manipulateAsync).mockResolvedValue({uri:'file:///cache/converted.jpg',width:2048,height:1536,base64:'synthetic-image'});
-  const screen=render(<ChecklistRunSheet />); fireEvent.press(screen.getByText('checklists.labels.Photo'));
-  await waitFor(()=>expect(useChecklistsStore.getState().addImage).toHaveBeenCalledWith(expect.objectContaining({base64:'synthetic-image',contentType:'image/jpeg'})));
-  expect(FileSystem.deleteAsync).toHaveBeenCalledWith('file:///cache/converted.jpg',{idempotent:true}); expect(FileSystem.deleteAsync).not.toHaveBeenCalledWith('file:///gallery/original.heic',expect.anything()); screen.unmount();
+  const local = draft();
+  local.queued = false;
+  local.run.Form.Sections[0].Items[0].Type = 8;
+  useChecklistsStore.setState({ active: local });
+  jest.mocked(ImagePicker.requestMediaLibraryPermissionsAsync).mockResolvedValue({ granted: true } as never);
+  jest.mocked(ImagePicker.launchImageLibraryAsync).mockResolvedValue({ canceled: false, assets: [{ uri: 'file:///gallery/original.heic', width: 4000, height: 3000 }] } as never);
+  jest.mocked(manipulateAsync).mockResolvedValue({ uri: 'file:///cache/converted.jpg', width: 2048, height: 1536, base64: 'synthetic-image' });
+  const screen = render(<ChecklistRunSheet />);
+  fireEvent.press(screen.getByText('checklists.labels.Photo'));
+  await waitFor(() => expect(useChecklistsStore.getState().addImage).toHaveBeenCalledWith(expect.objectContaining({ base64: 'synthetic-image', contentType: 'image/jpeg' })));
+  expect(FileSystem.deleteAsync).toHaveBeenCalledWith('file:///cache/converted.jpg', { idempotent: true });
+  expect(FileSystem.deleteAsync).not.toHaveBeenCalledWith('file:///gallery/original.heic', expect.anything());
+  screen.unmount();
 });
 it('removes entered values from the screen as soon as the store conceals the draft', () => {
-  const screen=render(<ChecklistRunSheet />); act(() => useChecklistsStore.setState({active:null})); screen.rerender(<ChecklistRunSheet />);
-  expect(screen.queryByText('Synthetic readiness check')).toBeNull(); screen.unmount();
+  const screen = render(<ChecklistRunSheet />);
+  act(() => useChecklistsStore.setState({ active: null }));
+  screen.rerender(<ChecklistRunSheet />);
+  expect(screen.queryByText('Synthetic readiness check')).toBeNull();
+  screen.unmount();
+});
+
+it('saves a date answer selected from the calendar', () => {
+  const local = draft();
+  local.queued = false;
+  local.run.Form.Sections[0].Items[0].Type = 7;
+  local.input.Answers = [{ ItemId: local.run.Form.Sections[0].Items[0].Id, Status: 1, Value: '2024-02-01' }];
+  useChecklistsStore.setState({ active: local });
+  const screen = render(<ChecklistRunSheet />);
+  fireEvent.press(screen.getByTestId('checklist-answer-date'));
+  fireEvent.press(screen.getByTestId('checklist-answer-date-day-29'));
+  fireEvent.press(screen.getByTestId('checklist-answer-date-done'));
+  expect(useChecklistsStore.getState().update).toHaveBeenCalledWith(expect.objectContaining({ Answers: [expect.objectContaining({ Value: '2024-02-29', Status: 1 })] }));
+  screen.unmount();
 });
diff --git a/src/components/checklists/checklist-run-sheet.tsx b/src/components/checklists/checklist-run-sheet.tsx
index d2785334..15cae066 100644
--- a/src/components/checklists/checklist-run-sheet.tsx
+++ b/src/components/checklists/checklist-run-sheet.tsx
@@ -10,6 +10,7 @@ import { SafeAreaView } from 'react-native-safe-area-context';
 
 import { attestChecklistRun, getChecklistImage } from '@/api/checklists/checklists';
 import { ChecklistSignaturePad } from '@/components/checklists/signature-pad';
+import { DateTimeField } from '@/components/common/date-time-field';
 import { Button, ButtonText } from '@/components/ui/button';
 import { Text } from '@/components/ui/text';
 import { checklistFailed, isChecklistRequired, visibleChecklistItems } from '@/lib/checklists/form';
@@ -132,7 +133,10 @@ export const ChecklistRunSheet: React.FC = () => {
                   <ButtonText>{item.Type === 6 ? label : t(`checklists.labels.${label}`)}</ButtonText>
                 </Button>
               ))}
-              {[3, 4, 5, 7].includes(item.Type) ? (
+              {item.Type === 7 ? (
+                <DateTimeField value={answer?.Value ?? ''} onChange={(Value) => change({ Status: Value ? 1 : 0, Value })} label={item.Name} disabled={!editable || busy} testID="checklist-answer-date" />
+              ) : null}
+              {[3, 4, 5].includes(item.Type) ? (
                 <TextInput
                   accessibilityLabel={t('checklists.labels.Answer')}
                   className="rounded border border-outline-300 p-3 text-typography-900"
@@ -140,7 +144,7 @@ export const ChecklistRunSheet: React.FC = () => {
                   multiline={item.Type === 5}
                   keyboardType={[3, 4].includes(item.Type) ? 'decimal-pad' : 'default'}
                   value={answer?.Value ?? ''}
-                  placeholder={item.Type === 7 ? 'YYYY-MM-DD' : (item.Units ?? '')}
+                  placeholder={item.Units ?? ''}
                   onChangeText={(Value) => change({ Status: Value ? 1 : 0, Value })}
                 />
               ) : null}
diff --git a/src/components/common/__tests__/date-time-field.test.tsx b/src/components/common/__tests__/date-time-field.test.tsx
new file mode 100644
index 00000000..4cec15c3
--- /dev/null
+++ b/src/components/common/__tests__/date-time-field.test.tsx
@@ -0,0 +1,74 @@
+import { fireEvent, render } from '@testing-library/react-native';
+import React from 'react';
+import { TextInput } from 'react-native';
+
+import { DateTimeField } from '@/components/common/date-time-field';
+
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key, i18n: { language: 'en' } }) }));
+jest.mock('react-native-safe-area-context', () => ({ SafeAreaView: require('react-native').View }));
+
+it('selects a leap day using the calendar and commits only on Done', () => {
+  const onChange = jest.fn();
+  const screen = render(<DateTimeField value="2024-02-01" label="Issued on" onChange={onChange} testID="date" />);
+  expect(screen.UNSAFE_queryAllByType(TextInput)).toHaveLength(0);
+  fireEvent.press(screen.getByTestId('date'));
+  expect(screen.queryByTestId('date-day-30')).toBeNull();
+  fireEvent.press(screen.getByTestId('date-day-29'));
+  expect(onChange).not.toHaveBeenCalled();
+  fireEvent.press(screen.getByTestId('date-done'));
+  expect(onChange).toHaveBeenCalledWith('2024-02-29');
+  screen.unmount();
+});
+
+it('changes month and year without rolling an end-of-month value into another month', () => {
+  const onChange = jest.fn();
+  const screen = render(<DateTimeField value="2024-01-31" label="Expires on" onChange={onChange} testID="date" />);
+  fireEvent.press(screen.getByTestId('date'));
+  fireEvent.press(screen.getByTestId('date-year'));
+  fireEvent.press(screen.getByTestId('date-year-2025'));
+  fireEvent.press(screen.getByTestId('date-month'));
+  fireEvent.press(screen.getByTestId('date-month-1'));
+  expect(screen.queryByTestId('date-day-29')).toBeNull();
+  fireEvent.press(screen.getByTestId('date-day-28'));
+  fireEvent.press(screen.getByTestId('date-done'));
+  expect(onChange).toHaveBeenCalledWith('2025-02-28');
+  screen.unmount();
+});
+
+it('cancels without changing the value, supports clearing, and prevents disabled edits', () => {
+  const onChange = jest.fn();
+  const screen = render(<DateTimeField value="2026-09-26" label="Date" onChange={onChange} testID="date" />);
+  fireEvent.press(screen.getByTestId('date'));
+  fireEvent.press(screen.getByTestId('date-day-15'));
+  fireEvent.press(screen.getByTestId('date-cancel'));
+  expect(onChange).not.toHaveBeenCalled();
+  fireEvent.press(screen.getByTestId('date'));
+  fireEvent.press(screen.getByTestId('date-clear'));
+  expect(onChange).toHaveBeenCalledWith('');
+  screen.rerender(<DateTimeField value="2026-09-26" label="Date" onChange={onChange} testID="date" disabled />);
+  fireEvent.press(screen.getByTestId('date'));
+  expect(screen.queryByTestId('date-done')).toBeNull();
+  screen.unmount();
+});
+
+it('picks clock hours and minutes without a keyboard or clearing a required time', () => {
+  const onChange = jest.fn();
+  const screen = render(<DateTimeField mode="time" value="08:00" label="End" onChange={onChange} testID="time" clearable={false} />);
+  fireEvent.press(screen.getByTestId('time'));
+  expect(screen.UNSAFE_queryAllByType(TextInput)).toHaveLength(0);
+  expect(screen.queryByTestId('time-clear')).toBeNull();
+  fireEvent.press(screen.getByTestId('time-hour-23'));
+  fireEvent.press(screen.getByTestId('time-minute-59'));
+  fireEvent.press(screen.getByTestId('time-done'));
+  expect(onChange).toHaveBeenCalledWith('23:59');
+  screen.unmount();
+});
+
+it('preserves a record timestamp when confirming its date and time without changes', () => {
+  const onChange = jest.fn();
+  const screen = render(<DateTimeField mode="datetime" value="2026-09-26T21:15:00.000Z" label="Date and time" onChange={onChange} testID="date" />);
+  fireEvent.press(screen.getByTestId('date'));
+  fireEvent.press(screen.getByTestId('date-done'));
+  expect(onChange).toHaveBeenCalledWith('2026-09-26T21:15:00.000Z');
+  screen.unmount();
+});
diff --git a/src/components/common/date-time-field.tsx b/src/components/common/date-time-field.tsx
new file mode 100644
index 00000000..d6aec6c7
--- /dev/null
+++ b/src/components/common/date-time-field.tsx
@@ -0,0 +1,204 @@
+import React, { useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Modal, Pressable, ScrollView, View } from 'react-native';
+import { SafeAreaView } from 'react-native-safe-area-context';
+
+import { Text } from '@/components/ui/text';
+import { parsePickerValue, pickerDate, type PickerMode, pickerTime, serializePickerValue } from '@/lib/date-time-picker';
+
+interface DateTimeFieldProps {
+  value: string;
+  onChange: (value: string) => void;
+  label: string;
+  mode?: PickerMode;
+  disabled?: boolean;
+  clearable?: boolean;
+  testID?: string;
+}
+
+// A page of 24 years, kept within years 1-9999.
+const yearPageStart = (start: number) => Math.max(1, Math.min(9976, start));
+
+// One picker for native and web. No keyboard entry; cancel never commits the draft.
+// Date-only and clock-only values keep their calendar day/clock across time zones.
+export const DateTimeField = ({ value, onChange, label, mode = 'date', disabled = false, clearable = true, testID = 'date-time-field' }: DateTimeFieldProps) => {
+  const { t, i18n } = useTranslation();
+  const locale = i18n?.language ?? 'en';
+  const [open, setOpen] = useState(false);
+  const [draft, setDraft] = useState(() => parsePickerValue(value, mode));
+  const [month, setMonth] = useState(draft.getMonth());
+  const [year, setYear] = useState(draft.getFullYear());
+  const [view, setView] = useState<'days' | 'months' | 'years'>('days');
+  const [yearPage, setYearPage] = useState(() => yearPageStart(year - 11));
+  const selected = parsePickerValue(value, mode);
+  const display = !value ? label : mode === 'time' ? pickerTime(selected) : mode === 'date' ? selected.toLocaleDateString(locale) : selected.toLocaleString(locale);
+  const show = () => {
+    if (disabled) return;
+    const next = parsePickerValue(value, mode);
+    setDraft(next);
+    setMonth(next.getMonth());
+    setYear(next.getFullYear());
+    setYearPage(yearPageStart(next.getFullYear() - 11));
+    setView('days');
+    setOpen(true);
+  };
+  const commit = (next: string) => {
+    if (!disabled) onChange(next);
+    setOpen(false);
+  };
+  const calendarDate = (day: number) => {
+    const date = new Date(draft);
+    date.setDate(1);
+    date.setFullYear(year, month, day);
+    return date;
+  };
+  const monthEnd = calendarDate(1);
+  monthEnd.setMonth(month + 1, 0);
+  const move = (direction: number) => {
+    if (view === 'years') {
+      setYearPage((page) => yearPageStart(page + direction * 24));
+      return;
+    }
+    const next = calendarDate(1);
+    next.setMonth(month + direction);
+    if (next.getFullYear() < 1 || next.getFullYear() > 9999) return;
+    setMonth(next.getMonth());
+    setYear(next.getFullYear());
+  };
+  const choice = (text: string, id: string, onPress: () => void, chosen = false, accessibilityLabel = text) => (
+    <Pressable
+      key={id}
+      testID={`${testID}-${id}`}
+      accessibilityRole="button"
+      accessibilityLabel={accessibilityLabel}
+      accessibilityState={{ selected: chosen }}
+      onPress={onPress}
+      className={chosen ? 'min-h-11 items-center justify-center rounded bg-primary-600 px-2 py-3' : 'min-h-11 items-center justify-center rounded px-2 py-3'}
+    >
+      <Text className={chosen ? 'text-center text-white' : 'text-center text-typography-900'}>{text}</Text>
+    </Pressable>
+  );
+  const clockColumn = (part: 'hour' | 'minute', count: number, current: number) => (
+    <View className="flex-1">
+      <Text className="text-center font-semibold">{t(`dateTimePicker.${part}`)}</Text>
+      <ScrollView nestedScrollEnabled style={{ height: 192 }} contentOffset={{ x: 0, y: current * 48 }}>
+        {Array.from({ length: count }, (_, number) =>
+          choice(
+            String(number).padStart(2, '0'),
+            `${part}-${number}`,
+            () => {
+              const next = new Date(draft);
+              if (part === 'hour') next.setHours(number, next.getMinutes(), 0, 0);
+              else next.setMinutes(number, 0, 0);
+              setDraft(next);
+            },
+            current === number
+          )
+        )}
+      </ScrollView>
+    </View>
+  );
+  return (
+    <View>
+      <Pressable
+        testID={testID}
+        accessibilityRole="button"
+        accessibilityLabel={label}
+        accessibilityValue={{ text: value }}
+        accessibilityState={{ disabled }}
+        disabled={disabled}
+        onPress={show}
+        className="min-h-11 justify-center rounded border border-outline-300 bg-background-0 px-3 py-2"
+      >
+        {value ? <Text className="text-xs text-typography-500">{label}</Text> : null}
+        <Text className={disabled ? 'text-typography-500' : 'text-typography-900'}>{display}</Text>
+      </Pressable>
+      {open && !disabled ? (
+        <Modal visible transparent animationType="fade" onRequestClose={() => setOpen(false)}>
+          <SafeAreaView className="flex-1 justify-center bg-black/50 p-4">
+            <View accessibilityViewIsModal className="max-h-[95%] w-full max-w-lg self-center rounded-xl bg-background-0 p-4">
+              <Text accessibilityRole="header" className="mb-2 text-lg font-bold">
+                {label}
+              </Text>
+              <ScrollView>
+                {mode !== 'time' ? (
+                  <View>
+                    <View className="flex-row items-center justify-between">
+                      {choice('‹', 'previous', () => move(-1), false, t('common.previous'))}
+                      {choice(calendarDate(1).toLocaleDateString(locale, { month: 'long' }), 'month', () => setView(view === 'months' ? 'days' : 'months'))}
+                      {choice(String(year), 'year', () => setView(view === 'years' ? 'days' : 'years'))}
+                      {choice('›', 'next', () => move(1), false, t('common.next'))}
+                    </View>
+                    {view === 'years' ? (
+                      <View className="flex-row flex-wrap">
+                        {Array.from({ length: 24 }, (_, index) => yearPage + index).map((number) => (
+                          <View key={number} style={{ width: '25%' }}>
+                            {choice(
+                              String(number),
+                              `year-${number}`,
+                              () => {
+                                setYear(number);
+                                setView('days');
+                              },
+                              year === number
+                            )}
+                          </View>
+                        ))}
+                      </View>
+                    ) : view === 'months' ? (
+                      <View className="flex-row flex-wrap">
+                        {Array.from({ length: 12 }, (_, number) => (
+                          <View key={number} style={{ width: '33.333%' }}>
+                            {choice(
+                              new Date(2024, number, 1).toLocaleDateString(locale, { month: 'short' }),
+                              `month-${number}`,
+                              () => {
+                                setMonth(number);
+                                setView('days');
+                              },
+                              month === number
+                            )}
+                          </View>
+                        ))}
+                      </View>
+                    ) : (
+                      <View className="flex-row flex-wrap">
+                        {Array.from({ length: 7 }, (_, day) => (
+                          <View key={`weekday-${day}`} style={{ width: '14.2857%' }}>
+                            <Text className="py-2 text-center text-xs text-typography-500">{new Date(2024, 0, 7 + day).toLocaleDateString(locale, { weekday: 'short' })}</Text>
+                          </View>
+                        ))}
+                        {Array.from({ length: calendarDate(1).getDay() }, (_, index) => (
+                          <View key={`blank-${index}`} style={{ width: '14.2857%' }} />
+                        ))}
+                        {Array.from({ length: monthEnd.getDate() }, (_, index) => index + 1).map((day) => {
+                          const date = calendarDate(day);
+                          return (
+                            <View key={day} style={{ width: '14.2857%' }}>
+                              {choice(String(day), `day-${day}`, () => setDraft(date), pickerDate(date) === pickerDate(draft), date.toLocaleDateString(locale, { dateStyle: 'full' }))}
+                            </View>
+                          );
+                        })}
+                      </View>
+                    )}
+                  </View>
+                ) : null}
+                {mode !== 'date' ? (
+                  <View className="mt-3 flex-row" style={{ gap: 16 }}>
+                    {clockColumn('hour', 24, draft.getHours())}
+                    {clockColumn('minute', 60, draft.getMinutes())}
+                  </View>
+                ) : null}
+              </ScrollView>
+              <View className="mt-3 flex-row justify-between">
+                {clearable ? choice(t('dateTimePicker.clear'), 'clear', () => commit('')) : <View />}
+                {choice(t('common.cancel'), 'cancel', () => setOpen(false))}
+                {choice(t('common.done'), 'done', () => commit(serializePickerValue(draft, mode)), true)}
+              </View>
+            </View>
+          </SafeAreaView>
+        </Modal>
+      ) : null}
+    </View>
+  );
+};
diff --git a/src/components/data-protection/__tests__/step-up-modal.test.tsx b/src/components/data-protection/__tests__/step-up-modal.test.tsx
new file mode 100644
index 00000000..1ab01d2f
--- /dev/null
+++ b/src/components/data-protection/__tests__/step-up-modal.test.tsx
@@ -0,0 +1,129 @@
+import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
+import React from 'react';
+
+import { dataProtectionStore } from '@/stores/data-protection/store';
+
+import { StepUpModal } from '../step-up-modal';
+
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/components/ui/modal', () => {
+  const { View } = require('react-native');
+  return {
+    Modal: ({ isOpen, children, ...props }: any) => (isOpen ? <View {...props}>{children}</View> : null),
+    ModalBackdrop: () => null,
+    ModalBody: ({ children }: any) => <View>{children}</View>,
+    ModalContent: ({ children }: any) => <View>{children}</View>,
+    ModalFooter: ({ children }: any) => <View>{children}</View>,
+    ModalHeader: ({ children }: any) => <View>{children}</View>,
+  };
+});
+
+describe('StepUpModal with every method', () => {
+  const store = {
+    loadStepUpMethods: jest.fn(),
+    verifyOtp: jest.fn(),
+    verifyPasskey: jest.fn(),
+    verifyFederated: jest.fn(),
+    requestApproval: jest.fn(),
+    waitForApproval: jest.fn(),
+    completeApproval: jest.fn(),
+    cancelApproval: jest.fn(),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    dataProtectionStore.setState({ ...store, stepUpMethods: ['totp', 'passkey', 'passkey_approval', 'federated'], lastError: null, isVerifying: false });
+  });
+
+  it('loads the methods on open and offers each', () => {
+    const { getByTestId } = render(<StepUpModal isOpen onClose={jest.fn()} />);
+    expect(store.loadStepUpMethods).toHaveBeenCalled();
+    expect(getByTestId('step-up-code-input')).toBeTruthy();
+    expect(getByTestId('step-up-passkey')).toBeTruthy();
+    expect(getByTestId('step-up-approval')).toBeTruthy();
+    expect(getByTestId('step-up-provider')).toBeTruthy();
+  });
+
+  it('closes after a passkey or the provider verifies', async () => {
+    store.verifyPasskey.mockResolvedValue(true);
+    const onVerified = jest.fn();
+    const onClose = jest.fn();
+    const { getByTestId } = render(<StepUpModal isOpen onClose={onClose} onVerified={onVerified} />);
+    await act(async () => fireEvent.press(getByTestId('step-up-passkey')));
+    expect(onVerified).toHaveBeenCalled();
+    expect(onClose).toHaveBeenCalled();
+
+    store.verifyFederated.mockResolvedValue(false);
+    onClose.mockClear();
+    await act(async () => fireEvent.press(getByTestId('step-up-provider')));
+    expect(onClose).not.toHaveBeenCalled();
+  });
+
+  it('shows the approval number and finishes when Responder approves', async () => {
+    store.requestApproval.mockResolvedValue({ id: 'ap-1', number: '42' });
+    store.waitForApproval.mockResolvedValue('approved');
+    store.completeApproval.mockResolvedValue(true);
+    const onClose = jest.fn();
+    const { getByTestId } = render(<StepUpModal isOpen onClose={onClose} />);
+    await act(async () => fireEvent.press(getByTestId('step-up-approval')));
+    await waitFor(() => expect(store.completeApproval).toHaveBeenCalledWith('ap-1'));
+    expect(onClose).toHaveBeenCalled();
+  });
+
+  it('starts one approval request however often it is pressed', async () => {
+    let start: (value: { id: string; number: string }) => void = () => undefined;
+    store.requestApproval.mockReturnValue(new Promise((resolve) => (start = resolve)));
+    store.waitForApproval.mockReturnValue(new Promise(() => undefined));
+    const { getByTestId } = render(<StepUpModal isOpen onClose={jest.fn()} />);
+
+    fireEvent.press(getByTestId('step-up-approval'));
+    fireEvent.press(getByTestId('step-up-approval'));
+    expect(store.requestApproval).toHaveBeenCalledTimes(1);
+
+    await act(async () => start({ id: 'ap-1', number: '42' }));
+    expect(store.waitForApproval).toHaveBeenCalledTimes(1);
+  });
+
+  it('withdraws a request that arrives after the prompt closed, without waiting on it', async () => {
+    let start: (value: { id: string; number: string }) => void = () => undefined;
+    store.requestApproval.mockReturnValue(new Promise((resolve) => (start = resolve)));
+    const onClose = jest.fn();
+    const { getByTestId, rerender } = render(<StepUpModal isOpen onClose={onClose} />);
+
+    fireEvent.press(getByTestId('step-up-approval'));
+    rerender(<StepUpModal isOpen={false} onClose={onClose} />);
+    await act(async () => start({ id: 'ap-1', number: '42' }));
+
+    expect(store.cancelApproval).toHaveBeenCalledWith('ap-1');
+    expect(store.waitForApproval).not.toHaveBeenCalled();
+    expect(store.completeApproval).not.toHaveBeenCalled();
+    expect(onClose).not.toHaveBeenCalled();
+  });
+
+  it('withdraws the waiting request on the server when the prompt closes', async () => {
+    store.requestApproval.mockResolvedValue({ id: 'ap-1', number: '42' });
+    store.waitForApproval.mockImplementation((_id: string, signal: AbortSignal) => new Promise((resolve) => signal.addEventListener('abort', () => resolve('aborted'))));
+    const onClose = jest.fn();
+    const { getByTestId, rerender } = render(<StepUpModal isOpen onClose={onClose} />);
+    await act(async () => fireEvent.press(getByTestId('step-up-approval')));
+    expect(getByTestId('mfa-approval-number').props.children).toBe('42');
+
+    await act(async () => rerender(<StepUpModal isOpen={false} onClose={onClose} />));
+    expect(store.cancelApproval).toHaveBeenCalledWith('ap-1');
+    expect(store.completeApproval).not.toHaveBeenCalled();
+  });
+
+  it('shows a method\'s refusal in the member\'s language', () => {
+    dataProtectionStore.setState({ lastError: 'passkey_cancelled' });
+    const { getByTestId } = render(<StepUpModal isOpen onClose={jest.fn()} />);
+    expect(getByTestId('step-up-error').props.children).toBe('mfa.errors.passkey_cancelled');
+  });
+
+  it('offers only the code on an older server', () => {
+    dataProtectionStore.setState({ stepUpMethods: ['totp'] });
+    const { queryByTestId, getByTestId } = render(<StepUpModal isOpen onClose={jest.fn()} />);
+    expect(getByTestId('step-up-code-input')).toBeTruthy();
+    expect(queryByTestId('step-up-passkey')).toBeNull();
+    expect(queryByTestId('step-up-approval')).toBeNull();
+  });
+});
diff --git a/src/components/data-protection/step-up-modal.tsx b/src/components/data-protection/step-up-modal.tsx
index 5c2ace95..4a3374c4 100644
--- a/src/components/data-protection/step-up-modal.tsx
+++ b/src/components/data-protection/step-up-modal.tsx
@@ -1,6 +1,7 @@
-import React, { useCallback, useEffect, useState } from 'react';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
+import { ApprovalPanel } from '@/components/mfa/approval-panel';
 import { Button, ButtonText } from '@/components/ui/button';
 import { Heading } from '@/components/ui/heading';
 import { Input, InputField } from '@/components/ui/input';
@@ -8,6 +9,7 @@ import { Modal, ModalBackdrop, ModalBody, ModalContent, ModalFooter, ModalHeader
 import { Spinner } from '@/components/ui/spinner';
 import { Text } from '@/components/ui/text';
 import { VStack } from '@/components/ui/vstack';
+import { mfaErrorKey } from '@/lib/mfa/messages';
 import { dataProtectionStore } from '@/stores/data-protection/store';
 
 interface StepUpModalProps {
@@ -28,12 +30,101 @@ export const StepUpModal: React.FC<StepUpModalProps> = ({ isOpen, onClose, onVer
   const [code, setCode] = useState('');
   const isVerifying = dataProtectionStore((state) => state.isVerifying);
   const lastError = dataProtectionStore((state) => state.lastError);
+  const methods = dataProtectionStore((state) => state.stepUpMethods);
+  const [approval, setApproval] = useState<{ id: string; number: string } | null>(null);
+  const [approvalBusy, setApprovalBusy] = useState(false);
+  const approvalAbort = useRef<AbortController | null>(null);
+  // The request still waiting in the member's Responder; withdrawn on the server when this prompt closes first.
+  const approvalId = useRef<string | null>(null);
 
+  /** Stops waiting for Responder and withdraws a request that is still waiting there. */
+  const stopApproval = useCallback(() => {
+    approvalAbort.current?.abort();
+    approvalAbort.current = null;
+    const waiting = approvalId.current;
+    approvalId.current = null;
+    if (waiting) {
+      void dataProtectionStore.getState().cancelApproval(waiting);
+    }
+  }, []);
+
+  // The methods this member has and the department accepts for protected data (passkey plan section 8.1).
   useEffect(() => {
-    if (!isOpen) {
+    if (isOpen) {
+      void dataProtectionStore.getState().loadStepUpMethods();
+    } else {
       setCode('');
+      stopApproval();
+      setApproval(null);
+    }
+  }, [isOpen, stopApproval]);
+
+  useEffect(() => stopApproval, [stopApproval]);
+
+  const finished = useCallback(
+    (ok: boolean) => {
+      if (ok) {
+        onVerified?.();
+        onClose();
+      }
+    },
+    [onClose, onVerified]
+  );
+
+  const handlePasskey = useCallback(async () => finished(await dataProtectionStore.getState().verifyPasskey()), [finished]);
+
+  const handleProvider = useCallback(async () => finished(await dataProtectionStore.getState().verifyFederated()), [finished]);
+
+  const handleApproval = useCallback(async () => {
+    // One request at a time: a second press while the first is on its way would start another one on the server.
+    if (approvalAbort.current) {
+      return;
     }
-  }, [isOpen]);
+    const controller = new AbortController();
+    approvalAbort.current = controller;
+    setApprovalBusy(true);
+    try {
+      const store = dataProtectionStore.getState();
+      const started = await store.requestApproval();
+      if (!started) {
+        return;
+      }
+      if (controller.signal.aborted) {
+        // The prompt closed while the request was on its way: nothing waits for it now, so withdraw it.
+        void store.cancelApproval(started.id);
+        return;
+      }
+      approvalId.current = started.id;
+      setApproval(started);
+      const decided = await store.waitForApproval(started.id, controller.signal);
+      if (decided === 'aborted' || controller.signal.aborted) {
+        return;
+      }
+      approvalId.current = null;
+      setApproval(null);
+      if (decided !== 'approved') {
+        dataProtectionStore.setState({ lastError: decided === 'denied' ? 'approval_denied' : 'approval_expired' });
+        return;
+      }
+      const ok = await store.completeApproval(started.id);
+      // A prompt closed meanwhile reveals nothing.
+      if (!controller.signal.aborted) {
+        finished(ok);
+      }
+    } finally {
+      if (approvalAbort.current === controller) {
+        approvalAbort.current = null;
+      }
+      setApprovalBusy(false);
+    }
+  }, [finished]);
+
+  const cancelApproval = useCallback(() => {
+    stopApproval();
+    setApproval(null);
+  }, [stopApproval]);
+
+  const offersCode = methods == null || methods.includes('totp');
 
   const handleVerify = useCallback(async () => {
     const submitted = code.trim();
@@ -61,8 +152,11 @@ export const StepUpModal: React.FC<StepUpModalProps> = ({ isOpen, onClose, onVer
         return t('data_protection.step_up_unavailable', 'Protected data is not available on this server yet. Contact your administrator.');
       case 'unknown':
         return t('data_protection.step_up_failed', 'Verification failed. Check your connection and try again.');
-      default:
+      case null:
+      case undefined:
         return null;
+      default:
+        return t(mfaErrorKey(lastError));
     }
   })();
 
@@ -76,25 +170,43 @@ export const StepUpModal: React.FC<StepUpModalProps> = ({ isOpen, onClose, onVer
         <ModalBody>
           <VStack space="md">
             <Text size="sm">{t('data_protection.step_up_body', 'This information is protected. Enter the current code from your authenticator app to view it for a limited time.')}</Text>
-            <Input variant="outline" size="lg" isDisabled={isVerifying}>
-              <InputField
-                testID="step-up-code-input"
-                value={code}
-                onChangeText={setCode}
-                placeholder={t('data_protection.step_up_placeholder', '6-digit code')}
-                keyboardType="number-pad"
-                maxLength={8}
-                autoFocus
-                autoComplete="one-time-code"
-                textContentType="oneTimeCode"
-                onSubmitEditing={handleVerify}
-                // A placeholder is not a label: it is announced once and then disappears the
-                // moment the member types, leaving the field unnamed for the rest of the entry.
-                accessibilityLabel={t('data_protection.step_up_placeholder', '6-digit code')}
-                accessibilityHint={t('data_protection.step_up_body')}
-                aria-label={t('data_protection.step_up_placeholder', '6-digit code')}
-              />
-            </Input>
+            {approval ? <ApprovalPanel matchNumber={approval.number} onCancel={cancelApproval} /> : null}
+            {!approval && offersCode ? (
+              <Input variant="outline" size="lg" isDisabled={isVerifying}>
+                <InputField
+                  testID="step-up-code-input"
+                  value={code}
+                  onChangeText={setCode}
+                  placeholder={t('data_protection.step_up_placeholder', '6-digit code')}
+                  keyboardType="number-pad"
+                  maxLength={8}
+                  autoFocus
+                  autoComplete="one-time-code"
+                  textContentType="oneTimeCode"
+                  onSubmitEditing={handleVerify}
+                  // A placeholder is not a label: it is announced once and then disappears the
+                  // moment the member types, leaving the field unnamed for the rest of the entry.
+                  accessibilityLabel={t('data_protection.step_up_placeholder', '6-digit code')}
+                  accessibilityHint={t('data_protection.step_up_body')}
+                  aria-label={t('data_protection.step_up_placeholder', '6-digit code')}
+                />
+              </Input>
+            ) : null}
+            {!approval && methods?.includes('passkey') ? (
+              <Button variant="outline" action="secondary" onPress={() => void handlePasskey()} isDisabled={isVerifying || approvalBusy} testID="step-up-passkey">
+                <ButtonText>{t('mfa.login.use_passkey')}</ButtonText>
+              </Button>
+            ) : null}
+            {!approval && methods?.includes('passkey_approval') ? (
+              <Button variant="outline" action="secondary" onPress={() => void handleApproval()} isDisabled={isVerifying || approvalBusy} testID="step-up-approval">
+                <ButtonText>{t('mfa.login.use_approval')}</ButtonText>
+              </Button>
+            ) : null}
+            {!approval && methods?.includes('federated') ? (
+              <Button variant="outline" action="secondary" onPress={() => void handleProvider()} isDisabled={isVerifying || approvalBusy} testID="step-up-provider">
+                <ButtonText>{t('mfa.login.use_provider')}</ButtonText>
+              </Button>
+            ) : null}
             {errorText ? (
               // Announced on appearance: the error arrives while focus is still in the field, so
               // a screen reader would otherwise never reach it.
@@ -108,9 +220,11 @@ export const StepUpModal: React.FC<StepUpModalProps> = ({ isOpen, onClose, onVer
           <Button variant="outline" action="secondary" onPress={onClose} isDisabled={isVerifying} testID="step-up-cancel">
             <ButtonText>{t('common.cancel', 'Cancel')}</ButtonText>
           </Button>
-          <Button action="primary" onPress={handleVerify} isDisabled={isVerifying || code.trim().length === 0} testID="step-up-submit">
-            {isVerifying ? <Spinner size="small" /> : <ButtonText>{t('data_protection.step_up_verify', 'Verify')}</ButtonText>}
-          </Button>
+          {offersCode && !approval ? (
+            <Button action="primary" onPress={handleVerify} isDisabled={isVerifying || code.trim().length === 0} testID="step-up-submit">
+              {isVerifying ? <Spinner size="small" /> : <ButtonText>{t('data_protection.step_up_verify', 'Verify')}</ButtonText>}
+            </Button>
+          ) : null}
         </ModalFooter>
       </ModalContent>
     </Modal>
diff --git a/src/components/maps/__tests__/picker-department-map-center.test.tsx b/src/components/maps/__tests__/picker-department-map-center.test.tsx
index c903f76a..8543821f 100644
--- a/src/components/maps/__tests__/picker-department-map-center.test.tsx
+++ b/src/components/maps/__tests__/picker-department-map-center.test.tsx
@@ -121,6 +121,10 @@ const CONFIGURED_CENTER: GetConfigResultData = {
   UnitLocationMinMeters: 0,
   AnalyticsApiKey: '',
   AnalyticsHost: '',
+  MapDayStyleUrl: '',
+  MapNightStyleUrl: '',
+  AppMapboxAccessToken: '',
+  IsDepartmentMapOverride: false,
 };
 
 const lastCamera = () => mockCameraProps[mockCameraProps.length - 1];
diff --git a/src/components/maps/full-screen-location-picker.tsx b/src/components/maps/full-screen-location-picker.tsx
index 00a454db..956ff980 100644
--- a/src/components/maps/full-screen-location-picker.tsx
+++ b/src/components/maps/full-screen-location-picker.tsx
@@ -9,9 +9,10 @@ import { useSafeAreaInsets } from 'react-native-safe-area-context';
 import { Box } from '@/components/ui/box';
 import { Button, ButtonText } from '@/components/ui/button';
 import { Text } from '@/components/ui/text';
-import { Env } from '@/lib/env';
 import { logger } from '@/lib/logging';
 import { useDepartmentMapCenter } from '@/lib/map-center';
+import { useDepartmentMapStyle } from '@/lib/map-style';
+import { useMapboxAccessToken } from '@/lib/mapbox-token';
 import { locationService } from '@/services/location';
 import { useLocationStore } from '@/stores/app/location-store';
 
@@ -21,7 +22,7 @@ import { useLocationStore } from '@/stores/app/location-store';
  * A full-screen location picker that allows users to select a location on a map.
  *
  * Debugging steps if component gets stuck in "Loading" state:
- * 1. Check if Mapbox is configured (RESPOND_MAPBOX_PUBKEY in environment)
+ * 1. Check if Mapbox is configured (server-supplied token in config, or RESPOND_MAPBOX_PUBKEY in environment)
  * 2. Check device location permissions
  * 3. Check console logs for detailed debugging information
  * 4. Ensure device location services are enabled
@@ -48,6 +49,7 @@ const FullScreenLocationPicker: React.FC<FullScreenLocationPickerProps> = ({ ini
   // Read reactively: config often lands after this mounts, and a one-shot read would leave the map
   // parked on the bootstrap fallback for the rest of the session.
   const departmentMapCenter = useDepartmentMapCenter();
+  const mapStyle = useDepartmentMapStyle();
   const latitude = useLocationStore((state) => state.latitude);
   const longitude = useLocationStore((state) => state.longitude);
   const setLocation = useLocationStore((state) => state.setLocation);
@@ -63,8 +65,8 @@ const FullScreenLocationPicker: React.FC<FullScreenLocationPickerProps> = ({ ini
   const [isMapReady, setIsMapReady] = useState(false);
   const isMountedRef = useRef(true);
 
-  // Check if Mapbox is properly configured
-  const isMapboxConfigured = Boolean(Env.RESPOND_MAPBOX_PUBKEY && Env.RESPOND_MAPBOX_PUBKEY.trim() !== '');
+  // Check if Mapbox is properly configured (server-supplied token, else the built-in one)
+  const isMapboxConfigured = Boolean(useMapboxAccessToken());
 
   // Helper function to get current location from device
   const getCurrentLocationFromDevice = React.useCallback(async () => {
@@ -377,6 +379,7 @@ const FullScreenLocationPicker: React.FC<FullScreenLocationPickerProps> = ({ ini
       {currentLocation ? (
         <Mapbox.MapView
           ref={mapRef}
+          styleURL={mapStyle}
           style={styles.map}
           logoEnabled={false}
           attributionEnabled={true}
@@ -402,6 +405,7 @@ const FullScreenLocationPicker: React.FC<FullScreenLocationPickerProps> = ({ ini
         // Default map view centered on the department when no location is available
         <Mapbox.MapView
           ref={mapRef}
+          styleURL={mapStyle}
           style={styles.map}
           logoEnabled={false}
           attributionEnabled={true}
diff --git a/src/components/maps/full-screen-map-modal.tsx b/src/components/maps/full-screen-map-modal.tsx
index efb037d2..6f263e9e 100644
--- a/src/components/maps/full-screen-map-modal.tsx
+++ b/src/components/maps/full-screen-map-modal.tsx
@@ -7,7 +7,8 @@ import { useSafeAreaInsets } from 'react-native-safe-area-context';
 
 import { Box } from '@/components/ui/box';
 import { Text } from '@/components/ui/text';
-import { Env } from '@/lib/env';
+import { useDepartmentMapStyle } from '@/lib/map-style';
+import { useMapboxAccessToken } from '@/lib/mapbox-token';
 
 interface FullScreenMapModalProps {
   isOpen: boolean;
@@ -30,8 +31,10 @@ interface FullScreenMapModalProps {
 const FullScreenMapModal: React.FC<FullScreenMapModalProps> = ({ isOpen, onClose, latitude, longitude, address, zoom = 15, showUserLocation = false, polygon, accentColor = '#ef4444' }) => {
   const { t } = useTranslation();
   const insets = useSafeAreaInsets();
+  const mapStyle = useDepartmentMapStyle();
 
-  const isMapboxConfigured = Boolean(Env.RESPOND_MAPBOX_PUBKEY && Env.RESPOND_MAPBOX_PUBKEY.trim() !== '');
+  // Server-supplied token, else the built-in one
+  const isMapboxConfigured = Boolean(useMapboxAccessToken());
 
   const polygonShape = React.useMemo(() => {
     if (!polygon || polygon.length < 3) {
@@ -80,7 +83,7 @@ const FullScreenMapModal: React.FC<FullScreenMapModalProps> = ({ isOpen, onClose
     <Modal visible={isOpen} animationType="slide" presentationStyle="fullScreen" onRequestClose={onClose}>
       <View style={styles.container} testID="full-screen-map-modal">
         {isMapboxConfigured ? (
-          <Mapbox.MapView style={styles.map} logoEnabled={false} attributionEnabled={false} compassEnabled={true} zoomEnabled={true} scrollEnabled={true} rotateEnabled={true} pitchEnabled={true}>
+          <Mapbox.MapView styleURL={mapStyle} style={styles.map} logoEnabled={false} attributionEnabled={false} compassEnabled={true} zoomEnabled={true} scrollEnabled={true} rotateEnabled={true} pitchEnabled={true}>
             {polygonBounds ? <Mapbox.Camera bounds={polygonBounds} animationDuration={0} /> : <Mapbox.Camera zoomLevel={zoom} centerCoordinate={[longitude, latitude]} animationDuration={0} />}
             {polygonShape ? (
               <Mapbox.ShapeSource id="fullScreenAreaPolygon" shape={polygonShape as GeoJSON.Feature}>
diff --git a/src/components/maps/location-picker.tsx b/src/components/maps/location-picker.tsx
index b7146748..0bc3ae36 100644
--- a/src/components/maps/location-picker.tsx
+++ b/src/components/maps/location-picker.tsx
@@ -8,8 +8,9 @@ import { StyleSheet, TouchableOpacity } from 'react-native';
 import { Box } from '@/components/ui/box';
 import { Button, ButtonText } from '@/components/ui/button';
 import { Text } from '@/components/ui/text';
-import { Env } from '@/lib/env';
 import { useDepartmentMapCenter } from '@/lib/map-center';
+import { useDepartmentMapStyle } from '@/lib/map-style';
+import { useMapboxAccessToken } from '@/lib/mapbox-token';
 
 interface LocationPickerProps {
   initialLocation?:
@@ -30,6 +31,7 @@ const LocationPicker: React.FC<LocationPickerProps> = ({ initialLocation, onLoca
   // Read reactively: config often lands after this mounts, and a one-shot read would leave the map
   // parked on the bootstrap fallback for the rest of the session.
   const departmentMapCenter = useDepartmentMapCenter();
+  const mapStyle = useDepartmentMapStyle();
   const [currentLocation, setCurrentLocation] = useState<{
     latitude: number;
     longitude: number;
@@ -38,8 +40,8 @@ const LocationPicker: React.FC<LocationPickerProps> = ({ initialLocation, onLoca
   const [mapError, setMapError] = useState<string | null>(null);
   const [hasAttemptedLocationFetch, setHasAttemptedLocationFetch] = useState(false);
 
-  // Check if Mapbox is properly configured
-  const isMapboxConfigured = Boolean(Env.RESPOND_MAPBOX_PUBKEY && Env.RESPOND_MAPBOX_PUBKEY.trim() !== '');
+  // Check if Mapbox is properly configured (server-supplied token, else the built-in one)
+  const isMapboxConfigured = Boolean(useMapboxAccessToken());
 
   useEffect(() => {
     if (!isMapboxConfigured) {
@@ -142,6 +144,7 @@ const LocationPicker: React.FC<LocationPickerProps> = ({ initialLocation, onLoca
       {currentLocation ? (
         <Mapbox.MapView
           ref={mapRef}
+          styleURL={mapStyle}
           style={styles.map}
           logoEnabled={false}
           attributionEnabled={false}
@@ -164,6 +167,7 @@ const LocationPicker: React.FC<LocationPickerProps> = ({ initialLocation, onLoca
         // Default map view centered on the department until the user has a location
         <Mapbox.MapView
           ref={mapRef}
+          styleURL={mapStyle}
           style={styles.map}
           logoEnabled={false}
           attributionEnabled={false}
diff --git a/src/components/maps/map-panel.tsx b/src/components/maps/map-panel.tsx
index be15516f..9cdf29b0 100644
--- a/src/components/maps/map-panel.tsx
+++ b/src/components/maps/map-panel.tsx
@@ -1,7 +1,7 @@
 import Mapbox from '@rnmapbox/maps';
 import { useFocusEffect, useRouter } from 'expo-router';
 import { NavigationIcon } from 'lucide-react-native';
-import React, { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+import React, { useCallback, useEffect, useRef, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { Animated, StyleSheet, TouchableOpacity, View } from 'react-native';
 
@@ -12,8 +12,8 @@ import { useMapLiveLocations } from '@/hooks/use-map-live-locations';
 import { useMapSignalRUpdates } from '@/hooks/use-map-signalr-updates';
 import { logger } from '@/lib/logging';
 import { getPinEntityId } from '@/lib/map-pin-ids';
+import { useDepartmentMapStyle } from '@/lib/map-style';
 import { isPoiMarker } from '@/lib/poi';
-import { onSortOptions } from '@/lib/utils';
 import { type MapMakerInfoData } from '@/models/v4/mapping/getMapDataAndMarkersData';
 import { type PoiResultData } from '@/models/v4/mapping/poiResultData';
 import { useLocationStore } from '@/stores/app/location-store';
@@ -50,16 +50,7 @@ export const MapPanel: React.FC<MapPanelProps> = ({ focusedPoi }) => {
   const heading = useLocationStore((state) => state.heading);
   const isMapLocked = useLocationStore((state) => state.isMapLocked);
 
-  const mapOptions = useMemo(() => {
-    return Object.keys(Mapbox.StyleURL)
-      .map((key) => ({
-        label: key,
-        data: (Mapbox.StyleURL as Record<string, string>)[key],
-      }))
-      .sort(onSortOptions);
-  }, []);
-
-  const styleURL = mapOptions[0]?.data;
+  const styleURL = useDepartmentMapStyle();
   const pulseAnim = useRef(new Animated.Value(1)).current;
   const isFollowingUser = isScreenFocused && isMapLocked && focusedPoi == null;
   const isInteractionLocked = isMapLocked && focusedPoi == null;
diff --git a/src/components/maps/static-map.tsx b/src/components/maps/static-map.tsx
index 67fb8b0a..80e01fbe 100644
--- a/src/components/maps/static-map.tsx
+++ b/src/components/maps/static-map.tsx
@@ -5,6 +5,7 @@ import { Pressable, StyleSheet } from 'react-native';
 
 import { Box } from '@/components/ui/box';
 import { Text } from '@/components/ui/text';
+import { useDepartmentMapStyle } from '@/lib/map-style';
 
 interface StaticMapProps {
   latitude: number;
@@ -18,6 +19,7 @@ interface StaticMapProps {
 
 const StaticMap: React.FC<StaticMapProps> = ({ latitude, longitude, address, zoom = 15, height = 200, showUserLocation = false, onPress }) => {
   const { t } = useTranslation();
+  const mapStyle = useDepartmentMapStyle();
   if (!latitude || !longitude) {
     return (
       <Box style={[styles.container, { height }]} className="items-center justify-center bg-gray-200">
@@ -30,7 +32,7 @@ const StaticMap: React.FC<StaticMapProps> = ({ latitude, longitude, address, zoo
     <Box style={[styles.container, { height }]}>
       {/* Locked preview: all gestures disabled — the map must not fight the parent
           ScrollView. Interaction happens in the full-screen modal opened via onPress. */}
-      <Mapbox.MapView style={styles.map} logoEnabled={false} attributionEnabled={false} compassEnabled={false} zoomEnabled={false} scrollEnabled={false} rotateEnabled={false} pitchEnabled={false}>
+      <Mapbox.MapView styleURL={mapStyle} style={styles.map} logoEnabled={false} attributionEnabled={false} compassEnabled={false} zoomEnabled={false} scrollEnabled={false} rotateEnabled={false} pitchEnabled={false}>
         <Mapbox.Camera zoomLevel={zoom} centerCoordinate={[longitude, latitude]} animationDuration={0} />
         {/* Marker for the location — an empty child renders an invisible annotation */}
         <Mapbox.PointAnnotation id="destinationPoint" coordinate={[longitude, latitude]} title={address || 'Location'}>
diff --git a/src/components/maps/static-map.web.tsx b/src/components/maps/static-map.web.tsx
index 0d06d34c..56783771 100644
--- a/src/components/maps/static-map.web.tsx
+++ b/src/components/maps/static-map.web.tsx
@@ -5,6 +5,7 @@ import { Pressable, StyleSheet } from 'react-native';
 
 import { Box } from '@/components/ui/box';
 import { Text } from '@/components/ui/text';
+import { useDepartmentMapStyle } from '@/lib/map-style';
 
 interface StaticMapProps {
   latitude: number;
@@ -18,6 +19,7 @@ interface StaticMapProps {
 
 const StaticMap: React.FC<StaticMapProps> = ({ latitude, longitude, address, zoom = 15, height = 200, showUserLocation = false, onPress }) => {
   const { t } = useTranslation();
+  const mapStyle = useDepartmentMapStyle();
   const [userCoordinate, setUserCoordinate] = useState<[number, number] | null>(null);
 
   useEffect(() => {
@@ -52,7 +54,9 @@ const StaticMap: React.FC<StaticMapProps> = ({ latitude, longitude, address, zoo
 
   return (
     <div style={{ width: '100%', height, position: 'relative', overflow: 'hidden' }}>
-      <Mapbox.MapView style={{ flex: 1, width: '100%', height }} zoomEnabled={false} scrollEnabled={false} rotateEnabled={false} pitchEnabled={false}>
+      {/* The web MapView reads styleURL only when it mounts, so key on it to rebuild when config
+          lands or the theme flips. */}
+      <Mapbox.MapView key={mapStyle} styleURL={mapStyle} style={{ flex: 1, width: '100%', height }} zoomEnabled={false} scrollEnabled={false} rotateEnabled={false} pitchEnabled={false}>
         <Mapbox.Camera zoomLevel={zoom} centerCoordinate={[longitude, latitude]} animationDuration={0} />
         <Mapbox.MarkerView coordinate={[longitude, latitude]}>
           <div
diff --git a/src/components/mfa/__tests__/account-verify-modal.test.tsx b/src/components/mfa/__tests__/account-verify-modal.test.tsx
new file mode 100644
index 00000000..c5298b9e
--- /dev/null
+++ b/src/components/mfa/__tests__/account-verify-modal.test.tsx
@@ -0,0 +1,72 @@
+import { act, fireEvent, render, waitFor } from '@testing-library/react-native';
+import React from 'react';
+
+import * as api from '@/api/mfa/account-security';
+import { getPasskeyAssertion } from '@/lib/mfa/passkey';
+import { PasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+
+import { AccountVerifyModal } from '../account-verify-modal';
+
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/api/mfa/account-security');
+jest.mock('@/lib/mfa/passkey', () => ({ getPasskeyAssertion: jest.fn(), passkeysSupported: jest.fn(() => true) }));
+jest.mock('@/lib/mfa/sso-browser', () => ({ runSsoRoundTrip: jest.fn() }));
+jest.mock('@/components/ui/modal', () => {
+  const { View } = require('react-native');
+  return {
+    Modal: ({ isOpen, children, ...props }: any) => (isOpen ? <View {...props}>{children}</View> : null),
+    ModalBackdrop: () => null,
+    ModalBody: ({ children }: any) => <View>{children}</View>,
+    ModalContent: ({ children }: any) => <View>{children}</View>,
+    ModalFooter: ({ children }: any) => <View>{children}</View>,
+    ModalHeader: ({ children }: any) => <View>{children}</View>,
+  };
+});
+
+const mocked = api as jest.Mocked<typeof api>;
+const assertion = getPasskeyAssertion as jest.Mock;
+const options = (requestId: string): api.StepUpOptionsData => ({
+  Methods: ['totp', 'passkey'],
+  Preferred: 'passkey',
+  EnrollmentRequired: false,
+  WindowMinutes: 5,
+  Passkey: { RequestId: requestId, Options: { challenge: requestId } },
+});
+
+describe('AccountVerifyModal: a fresh second factor before an account change', () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it("verifies with this app's passkey on the ceremony the options started", async () => {
+    mocked.getStepUpOptions.mockResolvedValue(options('req-1'));
+    assertion.mockResolvedValue({ id: 'cred' });
+    mocked.verifyStepUp.mockResolvedValue({ VerifiedAt: 'now', ExpiresAt: 'later' });
+    const onDone = jest.fn();
+
+    const { getByTestId } = render(<AccountVerifyModal proof="step_up" onDone={onDone} />);
+    await waitFor(() => expect(getByTestId('account-verify-passkey')).toBeTruthy());
+    await act(async () => fireEvent.press(getByTestId('account-verify-passkey')));
+
+    expect(assertion).toHaveBeenCalledWith({ challenge: 'req-1' });
+    expect(mocked.verifyStepUp).toHaveBeenCalledWith({ Operation: 'account_security', Method: 'passkey', RequestId: 'req-1', Credential: { id: 'cred' } });
+    expect(onDone).toHaveBeenCalledWith(true);
+    expect(mocked.getStepUpOptions).toHaveBeenCalledTimes(1);
+  });
+
+  it('asks for a fresh ceremony on a retry: the first one is spent whatever happened', async () => {
+    mocked.getStepUpOptions.mockResolvedValueOnce(options('req-1')).mockResolvedValueOnce(options('req-2'));
+    assertion.mockRejectedValueOnce(new PasskeyCeremonyError('failed')).mockResolvedValueOnce({ id: 'cred' });
+    mocked.verifyStepUp.mockResolvedValue({ VerifiedAt: 'now', ExpiresAt: 'later' });
+    const onDone = jest.fn();
+
+    const { getByTestId } = render(<AccountVerifyModal proof="step_up" onDone={onDone} />);
+    await waitFor(() => expect(getByTestId('account-verify-passkey')).toBeTruthy());
+    await act(async () => fireEvent.press(getByTestId('account-verify-passkey')));
+    expect(getByTestId('account-verify-error')).toBeTruthy();
+    expect(onDone).not.toHaveBeenCalled();
+
+    await act(async () => fireEvent.press(getByTestId('account-verify-passkey')));
+    expect(mocked.getStepUpOptions).toHaveBeenCalledTimes(2);
+    expect(mocked.verifyStepUp).toHaveBeenCalledWith(expect.objectContaining({ Method: 'passkey', RequestId: 'req-2' }));
+    expect(onDone).toHaveBeenCalledWith(true);
+  });
+});
diff --git a/src/components/mfa/account-verify-modal.tsx b/src/components/mfa/account-verify-modal.tsx
new file mode 100644
index 00000000..9bd1cb63
--- /dev/null
+++ b/src/components/mfa/account-verify-modal.tsx
@@ -0,0 +1,161 @@
+import React, { useCallback, useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { beginSsoReauthentication, getStepUpOptions, reauthenticateWithPassword, redeemSsoReauthentication, type StepUpOptionsData, verifyStepUp } from '@/api/mfa/account-security';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Heading } from '@/components/ui/heading';
+import { Input, InputField } from '@/components/ui/input';
+import { Modal, ModalBackdrop, ModalBody, ModalContent, ModalFooter, ModalHeader } from '@/components/ui/modal';
+import { Spinner } from '@/components/ui/spinner';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+import { toMfaProblem } from '@/lib/mfa/errors';
+import { mfaErrorKey } from '@/lib/mfa/messages';
+import { getPasskeyAssertion, passkeysSupported } from '@/lib/mfa/passkey';
+import { isPasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { runSsoRoundTrip } from '@/lib/mfa/sso-browser';
+
+/** What the server asked for before a change: the first factor again, or a fresh second factor for account security. */
+export type AccountProof = 'reauthenticate' | 'step_up';
+
+interface AccountVerifyModalProps {
+  proof: AccountProof | null;
+  onDone: (verified: boolean) => void;
+}
+
+const STEP_UP_OPERATION = 'account_security';
+
+/**
+ * The fresh proof the server asks for before a sign-in method changes (passkey plan sections 6.2 and 7.6 row 14): the
+ * password (or the department's identity provider, for a member who signs in there), or a code or passkey for this app.
+ * Never approval or the provider's MFA for account changes. Secrets live only in local state.
+ */
+export const AccountVerifyModal: React.FC<AccountVerifyModalProps> = ({ proof, onDone }) => {
+  const { t } = useTranslation();
+  const [secret, setSecret] = useState('');
+  const [busy, setBusy] = useState(false);
+  const [errorCode, setErrorCode] = useState<string | null>(null);
+  const [useProvider, setUseProvider] = useState(false);
+  const [options, setOptions] = useState<StepUpOptionsData | null>(null);
+
+  useEffect(() => {
+    setSecret('');
+    setErrorCode(null);
+    setUseProvider(false);
+    setOptions(null);
+    if (proof === 'step_up') {
+      void getStepUpOptions(STEP_UP_OPERATION)
+        .then(setOptions)
+        .catch((error: unknown) => setErrorCode(toMfaProblem(error).code));
+    }
+  }, [proof]);
+
+  const attempt = useCallback(
+    async (action: () => Promise<unknown>) => {
+      setBusy(true);
+      setErrorCode(null);
+      try {
+        await action();
+        onDone(true);
+      } catch (error) {
+        const code = isPasskeyCeremonyError(error) ? `passkey_${error.reason}` : toMfaProblem(error).code;
+        if (code === 'sso_reauthentication_required') {
+          setUseProvider(true);
+        }
+        setErrorCode(code);
+      } finally {
+        setSecret('');
+        setBusy(false);
+      }
+    },
+    [onDone]
+  );
+
+  const submitPassword = () => void attempt(() => reauthenticateWithPassword(secret));
+
+  const submitProvider = () =>
+    void attempt(async () => {
+      const trip = await runSsoRoundTrip((secrets) => beginSsoReauthentication(secrets));
+      if (!trip.ok) {
+        throw Object.assign(new Error('sso'), { response: { status: 400, data: { type: trip.code ?? `sso_${trip.reason}` } } });
+      }
+      await redeemSsoReauthentication(trip.trip.ssoTransactionId, trip.trip.ssoCode, trip.trip.codeVerifier);
+    });
+
+  const submitCode = () => void attempt(() => verifyStepUp({ Operation: STEP_UP_OPERATION, Method: 'totp', Code: secret.trim() }));
+
+  const submitPasskey = () =>
+    void attempt(async () => {
+      // The ceremony the options started answers one attempt: whatever the outcome, a retry asks for a fresh one.
+      const started = options?.Passkey ?? null;
+      if (started) {
+        setOptions((current) => (current ? { ...current, Passkey: null } : current));
+      }
+      const ceremony = started ?? (await getStepUpOptions(STEP_UP_OPERATION)).Passkey;
+      if (!ceremony) {
+        throw Object.assign(new Error('passkey'), { response: { status: 400, data: { type: 'passkeys_unavailable' } } });
+      }
+      const credential = await getPasskeyAssertion(ceremony.Options);
+      await verifyStepUp({ Operation: STEP_UP_OPERATION, Method: 'passkey', RequestId: ceremony.RequestId, Credential: credential });
+    });
+
+  const reauth = proof === 'reauthenticate';
+  const offersCode = !reauth && (options?.Methods ?? ['totp']).includes('totp');
+  const offersPasskey = !reauth && (options?.Methods ?? []).includes('passkey') && passkeysSupported();
+
+  return (
+    <Modal isOpen={proof !== null} onClose={() => onDone(false)} testID="account-verify-modal">
+      <ModalBackdrop />
+      <ModalContent>
+        <ModalHeader>
+          <Heading size="md">{reauth ? t('mfa.account.reauth_title') : t('mfa.account.step_up_title')}</Heading>
+        </ModalHeader>
+        <ModalBody>
+          <VStack space="md">
+            <Text size="sm">{reauth ? (useProvider ? t('mfa.account.reauth_provider_body') : t('mfa.account.reauth_body')) : t('mfa.account.step_up_body')}</Text>
+            {(reauth && !useProvider) || offersCode ? (
+              <Input variant="outline" size="lg" isDisabled={busy}>
+                <InputField
+                  testID="account-verify-secret"
+                  value={secret}
+                  onChangeText={setSecret}
+                  secureTextEntry={reauth}
+                  keyboardType={reauth ? 'default' : 'number-pad'}
+                  autoCapitalize="none"
+                  autoComplete={reauth ? 'current-password' : 'one-time-code'}
+                  placeholder={reauth ? t('mfa.account.password_placeholder') : t('mfa.login.code_placeholder')}
+                  aria-label={reauth ? t('mfa.account.password_placeholder') : t('mfa.login.code_placeholder')}
+                />
+              </Input>
+            ) : null}
+            {offersPasskey ? (
+              <Button variant="outline" action="secondary" onPress={submitPasskey} isDisabled={busy} testID="account-verify-passkey">
+                <ButtonText>{t('mfa.login.use_passkey')}</ButtonText>
+              </Button>
+            ) : null}
+            {reauth && useProvider ? (
+              <Button variant="outline" action="secondary" onPress={submitProvider} isDisabled={busy} testID="account-verify-provider">
+                <ButtonText>{t('mfa.login.use_provider')}</ButtonText>
+              </Button>
+            ) : null}
+            {errorCode ? (
+              <Text size="sm" className="text-error-600" testID="account-verify-error" accessibilityLiveRegion="polite" accessibilityRole="alert" role="alert">
+                {t(mfaErrorKey(errorCode))}
+              </Text>
+            ) : null}
+          </VStack>
+        </ModalBody>
+        <ModalFooter>
+          <Button variant="outline" action="secondary" onPress={() => onDone(false)} isDisabled={busy} testID="account-verify-cancel">
+            <ButtonText>{t('common.cancel')}</ButtonText>
+          </Button>
+          {(reauth && !useProvider) || offersCode ? (
+            <Button action="primary" onPress={reauth ? submitPassword : submitCode} isDisabled={busy || secret.trim().length === 0} testID="account-verify-submit">
+              {busy ? <Spinner size="small" /> : <ButtonText>{t('mfa.login.verify')}</ButtonText>}
+            </Button>
+          ) : null}
+        </ModalFooter>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/src/components/mfa/approval-panel.tsx b/src/components/mfa/approval-panel.tsx
new file mode 100644
index 00000000..426ed6b2
--- /dev/null
+++ b/src/components/mfa/approval-panel.tsx
@@ -0,0 +1,39 @@
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box } from '@/components/ui/box';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+
+interface ApprovalPanelProps {
+  /** The two-digit number the member types in Responder; shown on this screen only. */
+  matchNumber: string;
+  onCancel: () => void;
+}
+
+/**
+ * "Approve with Responder" while it waits (passkey plan section 7.9): the number to type in Responder, and a way to stop
+ * waiting. The number is never pushed to Responder, so it only works for someone who can see this screen.
+ */
+export const ApprovalPanel: React.FC<ApprovalPanelProps> = ({ matchNumber, onCancel }) => {
+  const { t } = useTranslation();
+  return (
+    <Box className="rounded-lg bg-background-50 p-4" testID="mfa-approval-panel">
+      <VStack space="sm" className="items-center">
+        <Text size="sm" className="text-center">
+          {t('mfa.approval.number_label')}
+        </Text>
+        <Text className="text-4xl font-bold tracking-widest" testID="mfa-approval-number" accessibilityLabel={t('mfa.approval.number_accessibility', { number: matchNumber })}>
+          {matchNumber}
+        </Text>
+        <Text size="sm" className="text-center text-typography-500" accessibilityLiveRegion="polite">
+          {t('mfa.approval.waiting')}
+        </Text>
+        <Button variant="outline" action="secondary" size="sm" onPress={onCancel} testID="mfa-approval-cancel">
+          <ButtonText>{t('mfa.approval.cancel')}</ButtonText>
+        </Button>
+      </VStack>
+    </Box>
+  );
+};
diff --git a/src/components/mfa/recovery-codes-modal.tsx b/src/components/mfa/recovery-codes-modal.tsx
new file mode 100644
index 00000000..330265e9
--- /dev/null
+++ b/src/components/mfa/recovery-codes-modal.tsx
@@ -0,0 +1,35 @@
+import React from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { RecoveryCodes } from '@/components/mfa/recovery-codes';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Heading } from '@/components/ui/heading';
+import { Modal, ModalBackdrop, ModalBody, ModalContent, ModalFooter, ModalHeader } from '@/components/ui/modal';
+import useAuthStore from '@/stores/auth/store';
+
+/**
+ * After an authenticator was set up during sign-in (passkey plan section 6.2): the new recovery codes, once. Mounted at
+ * the app shell so it shows on whatever screen the sign-in lands on.
+ */
+export const RecoveryCodesModal: React.FC = () => {
+  const { t } = useTranslation();
+  const codes = useAuthStore((s) => s.pendingRecoveryCodes);
+  const dismiss = useAuthStore((s) => s.dismissRecoveryCodes);
+
+  return (
+    <Modal isOpen={!!codes && codes.length > 0} onClose={dismiss} testID="mfa-recovery-codes-modal">
+      <ModalBackdrop />
+      <ModalContent>
+        <ModalHeader>
+          <Heading size="md">{t('mfa.recovery_codes.title')}</Heading>
+        </ModalHeader>
+        <ModalBody>{codes ? <RecoveryCodes codes={codes} /> : null}</ModalBody>
+        <ModalFooter>
+          <Button action="primary" onPress={dismiss} testID="mfa-recovery-codes-done">
+            <ButtonText>{t('mfa.recovery_codes.saved')}</ButtonText>
+          </Button>
+        </ModalFooter>
+      </ModalContent>
+    </Modal>
+  );
+};
diff --git a/src/components/mfa/recovery-codes.tsx b/src/components/mfa/recovery-codes.tsx
new file mode 100644
index 00000000..3668cdde
--- /dev/null
+++ b/src/components/mfa/recovery-codes.tsx
@@ -0,0 +1,42 @@
+import * as Clipboard from 'expo-clipboard';
+import React, { useCallback, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+
+import { Box } from '@/components/ui/box';
+import { Button, ButtonText } from '@/components/ui/button';
+import { Text } from '@/components/ui/text';
+import { VStack } from '@/components/ui/vstack';
+
+interface RecoveryCodesProps {
+  codes: string[];
+}
+
+/**
+ * New recovery codes, shown once (passkey plan section 6.1). They are in memory only; the member copies or writes them
+ * down now, because nothing can show them again.
+ */
+export const RecoveryCodes: React.FC<RecoveryCodesProps> = ({ codes }) => {
+  const { t } = useTranslation();
+  const [copied, setCopied] = useState(false);
+
+  const copy = useCallback(async () => {
+    await Clipboard.setStringAsync(codes.join('\n'));
+    setCopied(true);
+  }, [codes]);
+
+  return (
+    <VStack space="sm" testID="mfa-recovery-codes">
+      <Text size="sm">{t('mfa.recovery_codes.body')}</Text>
+      <Box className="rounded-lg bg-background-50 p-3">
+        {codes.map((code) => (
+          <Text key={code} selectable className="font-mono text-base" testID="mfa-recovery-code">
+            {code}
+          </Text>
+        ))}
+      </Box>
+      <Button variant="outline" action="secondary" size="sm" onPress={() => void copy()} testID="mfa-recovery-codes-copy">
+        <ButtonText>{copied ? t('mfa.recovery_codes.copied') : t('mfa.recovery_codes.copy')}</ButtonText>
+      </Button>
+    </VStack>
+  );
+};
diff --git a/src/components/onboarding/__tests__/onboarding-screen.test.tsx b/src/components/onboarding/__tests__/onboarding-screen.test.tsx
new file mode 100644
index 00000000..b3628878
--- /dev/null
+++ b/src/components/onboarding/__tests__/onboarding-screen.test.tsx
@@ -0,0 +1,92 @@
+import { fireEvent, render } from '@testing-library/react-native';
+import React from 'react';
+import { ScrollView } from 'react-native';
+
+import { OnboardingScreen } from '../onboarding-screen';
+
+let mockWindow = { width: 320, height: 568, fontScale: 1, scale: 1 };
+jest.mock('nativewind', () => ({ useColorScheme: () => ({ colorScheme: 'light' }), cssInterop: jest.fn() }));
+jest.mock('@/components/ui', () => {
+  const { View } = require('react-native');
+  return { View, SafeAreaView: View, FocusAwareStatusBar: () => null };
+});
+jest.mock('@/components/ui/text', () => ({ Text: require('react-native').Text }));
+jest.mock('@/components/ui/pressable', () => ({ Pressable: require('react-native').Pressable }));
+jest.mock('lucide-react-native', () => ({ ChevronRight: () => null }));
+
+const props = {
+  title: 'Resgrid Responder',
+  description: 'Stay connected to your department.',
+  icon: null,
+  currentIndex: 0,
+  total: 3,
+  skipLabel: 'Skip',
+  nextLabel: 'Next',
+  finishLabel: 'Get started',
+  onSkip: jest.fn(),
+  onNext: jest.fn(),
+  onFinish: jest.fn(),
+  onSlideChange: jest.fn(),
+};
+
+beforeEach(() => {
+  jest.clearAllMocks();
+  mockWindow = { width: 320, height: 568, fontScale: 1, scale: 1 };
+  jest.spyOn(require('react-native'), 'useWindowDimensions').mockImplementation(() => mockWindow);
+});
+
+it.each([
+  [320, 568, 1, 'column'],
+  [844, 390, 1, 'row'],
+  [768, 1024, 1, 'row'],
+  [1024, 768, 2, 'column'],
+] as const)('supports %s × %s with font scale %s', (width, height, fontScale, direction) => {
+  mockWindow = { width, height, fontScale, scale: 1 };
+  const screen = render(<OnboardingScreen {...props} />);
+  expect(Object.assign({}, ...screen.getByTestId('onboarding-content').props.style.flat(Infinity)).flexDirection).toBe(direction);
+  const title = screen.UNSAFE_getAllByType(require('react-native').Text).find((node) => node.props.children === props.title)!;
+  expect(title.props.className).toContain(width < 360 ? 'leading-[36px]' : 'leading-[44px]');
+  expect(title.props.numberOfLines).toBeUndefined();
+  expect(screen.UNSAFE_getByType(ScrollView).props.contentContainerStyle.flexGrow).toBe(1);
+  fireEvent.press(screen.getByTestId('next-button'));
+  expect(props.onNext).toHaveBeenCalledTimes(1);
+  screen.unmount();
+});
+
+it('reflows after rotation without resetting the selected step', () => {
+  const screen = render(<OnboardingScreen {...props} currentIndex={1} />);
+  mockWindow = { width: 844, height: 390, fontScale: 1, scale: 1 };
+  screen.rerender(<OnboardingScreen {...props} currentIndex={1} />);
+  const safeArea = screen.UNSAFE_getAllByType(require('react-native').View).find((view) => view.props.onLayout);
+  fireEvent(safeArea!, 'layout', { nativeEvent: { layout: { width: 844 } } });
+  expect(Object.assign({}, ...screen.getByTestId('onboarding-content').props.style.flat(Infinity)).flexDirection).toBe('row');
+  expect(screen.getByRole('progressbar').props.accessibilityValue.now).toBe(2);
+  screen.unmount();
+});
+
+it('ignores vertical scrolling and clamps swipes at the last step without completing', () => {
+  const screen = render(<OnboardingScreen {...props} currentIndex={2} />);
+  const content = screen.getByTestId('onboarding-flatlist');
+  fireEvent(content, 'touchStart', { nativeEvent: { pageX: 280, pageY: 100 } });
+  fireEvent(content, 'touchEnd', { nativeEvent: { pageX: 180, pageY: 400 } });
+  expect(props.onSlideChange).not.toHaveBeenCalled();
+  fireEvent(content, 'touchStart', { nativeEvent: { pageX: 280, pageY: 100 } });
+  fireEvent(content, 'touchEnd', { nativeEvent: { pageX: 80, pageY: 110 } });
+  expect(props.onSlideChange).toHaveBeenCalledWith(2);
+  expect(props.onFinish).not.toHaveBeenCalled();
+  fireEvent.press(screen.getByTestId('get-started-button'));
+  expect(props.onFinish).toHaveBeenCalledTimes(1);
+  screen.unmount();
+});
+
+it('starts each step at the top of the page', () => {
+  const scrollTo = jest.fn();
+  const screen = render(<OnboardingScreen {...props} />, { createNodeMock: (element) => (element.type === 'RNScrollView' ? { scrollTo } : null) });
+  scrollTo.mockClear();
+  screen.rerender(<OnboardingScreen {...props} currentIndex={1} />);
+  expect(scrollTo).toHaveBeenCalledWith({ y: 0, animated: false });
+  scrollTo.mockClear();
+  screen.rerender(<OnboardingScreen {...props} currentIndex={1} />);
+  expect(scrollTo).not.toHaveBeenCalled();
+  screen.unmount();
+});
diff --git a/src/components/onboarding/onboarding-screen.tsx b/src/components/onboarding/onboarding-screen.tsx
new file mode 100644
index 00000000..86adcddc
--- /dev/null
+++ b/src/components/onboarding/onboarding-screen.tsx
@@ -0,0 +1,152 @@
+import { ChevronRight } from 'lucide-react-native';
+import { useColorScheme } from 'nativewind';
+import React, { useEffect, useRef, useState } from 'react';
+import type { GestureResponderEvent } from 'react-native';
+import { Image, ScrollView, StyleSheet, useWindowDimensions } from 'react-native';
+
+import { FocusAwareStatusBar, SafeAreaView, View } from '@/components/ui';
+import { Pressable } from '@/components/ui/pressable';
+import { Text } from '@/components/ui/text';
+
+interface OnboardingScreenProps {
+  title: string;
+  description: string;
+  icon: React.ReactNode;
+  currentIndex: number;
+  total: number;
+  skipLabel: string;
+  nextLabel: string;
+  finishLabel: string;
+  onSkip: () => void;
+  onNext: () => void;
+  onFinish: () => void;
+  onSlideChange: (index: number) => void;
+}
+
+/** Content grows with text size; the whole page remains scrollable on short screens. */
+export const OnboardingScreen: React.FC<OnboardingScreenProps> = ({ title, description, icon, currentIndex, total, skipLabel, nextLabel, finishLabel, onSkip, onNext, onFinish, onSlideChange }) => {
+  const { width, height, fontScale } = useWindowDimensions();
+  const [containerWidth, setContainerWidth] = useState(width);
+  const { colorScheme } = useColorScheme();
+  const start = useRef<{ x: number; y: number } | null>(null);
+  const scroll = useRef<ScrollView>(null);
+  const availableWidth = Math.min(width, containerWidth);
+  const horizontal = availableWidth >= 680 && fontScale < 1.5;
+  const compact = height < 500;
+  const last = currentIndex === total - 1;
+  const actionColor = colorScheme === 'dark' ? 'black' : 'white';
+
+  // The page stays mounted between steps (so focus stays on Next); each step starts at its top, not where the last one was scrolled to.
+  useEffect(() => {
+    scroll.current?.scrollTo({ y: 0, animated: false });
+  }, [currentIndex]);
+
+  const handleTouchStart = (event: GestureResponderEvent) => {
+    start.current = { x: event.nativeEvent.pageX, y: event.nativeEvent.pageY ?? 0 };
+  };
+  const handleTouchEnd = (event: GestureResponderEvent) => {
+    const origin = start.current;
+    start.current = null;
+    if (!origin) return;
+    const dx = event.nativeEvent.pageX - origin.x;
+    const dy = (event.nativeEvent.pageY ?? 0) - origin.y;
+    // Vertical scrolling must not accidentally advance or complete onboarding.
+    if (Math.abs(dx) < 60 || Math.abs(dx) <= Math.abs(dy) * 1.5) return;
+    onSlideChange(Math.max(0, Math.min(total - 1, currentIndex + (dx < 0 ? 1 : -1))));
+  };
+
+  return (
+    <SafeAreaView className="flex-1 bg-background-50" onLayout={(event) => setContainerWidth(event.nativeEvent.layout.width)}>
+      <FocusAwareStatusBar hidden={true} />
+      <ScrollView ref={scroll} bounces={false} contentContainerStyle={styles.scroll}>
+        <View style={[styles.page, { paddingHorizontal: availableWidth < 360 ? 16 : 24, paddingVertical: compact ? 12 : 24 }]}>
+          <View style={styles.header}>
+            <Image accessible={false} style={styles.logo} resizeMode="contain" source={colorScheme === 'dark' ? require('@assets/images/Resgrid_JustText_White.png') : require('@assets/images/Resgrid_JustText.png')} />
+            <Pressable testID="skip-button-top" accessibilityRole="button" accessibilityLabel={skipLabel} onPress={onSkip} style={styles.skip}>
+              <Text className="text-base font-semibold leading-6 text-typography-600">{skipLabel}</Text>
+            </Pressable>
+          </View>
+
+          <View
+            style={[styles.main, { paddingVertical: compact ? 16 : 32 }]}
+            testID="onboarding-flatlist"
+            onTouchStart={handleTouchStart}
+            onTouchEnd={handleTouchEnd}
+            onTouchCancel={() => {
+              start.current = null;
+            }}
+          >
+            <View testID="onboarding-content" className="border border-outline-100 bg-background-0" style={[styles.card, horizontal ? styles.horizontal : styles.vertical]}>
+              <View
+                accessible={false}
+                accessibilityElementsHidden
+                importantForAccessibility="no-hide-descendants"
+                className="bg-primary-50"
+                style={[styles.artwork, { width: horizontal ? 180 : compact ? 112 : 160, height: horizontal ? 180 : compact ? 112 : 160 }]}
+              >
+                <View className="border border-primary-200 bg-background-0" style={styles.icon}>
+                  {icon}
+                </View>
+              </View>
+              <View style={styles.copy}>
+                <Text
+                  accessibilityRole="header"
+                  className={`font-bold text-typography-950 ${availableWidth < 360 ? 'text-[28px] leading-[36px]' : 'text-[34px] leading-[44px]'}`}
+                  style={[styles.title, { textAlign: horizontal ? 'left' : 'center' }]}
+                >
+                  {title}
+                </Text>
+                <Text className="text-[17px] leading-[28px] text-typography-600" style={[styles.description, { textAlign: horizontal ? 'left' : 'center' }]}>
+                  {description}
+                </Text>
+              </View>
+            </View>
+          </View>
+
+          <View style={styles.footer}>
+            <View accessible accessibilityRole="progressbar" accessibilityValue={{ min: 1, max: total, now: currentIndex + 1 }} style={styles.progress}>
+              {Array.from({ length: total }, (_, index) => (
+                <View key={index} className={index === currentIndex ? 'bg-primary-500' : 'bg-outline-200'} style={[styles.dot, { width: index === currentIndex ? 28 : 8 }]} />
+              ))}
+            </View>
+            <Pressable
+              testID={last ? 'get-started-button' : 'next-button'}
+              accessibilityRole="button"
+              accessibilityLabel={last ? finishLabel : nextLabel}
+              onPress={last ? onFinish : onNext}
+              className="bg-primary-500"
+              style={styles.action}
+            >
+              <Text className="text-base font-semibold leading-6" style={{ color: actionColor, flexShrink: 1, textAlign: 'center' }}>
+                {last ? finishLabel : nextLabel}
+              </Text>
+              <ChevronRight size={20} color={actionColor} />
+            </Pressable>
+          </View>
+        </View>
+      </ScrollView>
+    </SafeAreaView>
+  );
+};
+
+const styles = StyleSheet.create({
+  scroll: { flexGrow: 1 },
+  page: { flexGrow: 1, width: '100%', maxWidth: 960, alignSelf: 'center' },
+  header: { flexDirection: 'row', alignItems: 'center', justifyContent: 'space-between', gap: 16 },
+  logo: { width: 136, height: 36, flexShrink: 1 },
+  skip: { minHeight: 48, justifyContent: 'center', paddingHorizontal: 12, flexShrink: 1 },
+  main: { flexGrow: 1, justifyContent: 'center' },
+  card: { borderRadius: 28, padding: 24, gap: 28, alignItems: 'center', width: '100%' },
+  horizontal: { flexDirection: 'row', padding: 32, gap: 40 },
+  vertical: { flexDirection: 'column' },
+  artwork: { borderRadius: 999, alignItems: 'center', justifyContent: 'center', flexShrink: 0 },
+  icon: { width: 104, height: 104, borderRadius: 32, justifyContent: 'center', alignItems: 'center' },
+  copy: { flexShrink: 1, minWidth: 0, width: '100%', gap: 16 },
+  // Explicit line heights override the Text component's default body line height.
+  title: { alignSelf: 'stretch', paddingVertical: 4 },
+  description: { alignSelf: 'stretch' },
+  footer: { width: '100%', maxWidth: 480, alignSelf: 'center', gap: 24 },
+  progress: { flexDirection: 'row', justifyContent: 'center', alignItems: 'center', gap: 8, minHeight: 16 },
+  dot: { height: 8, borderRadius: 4 },
+  action: { minHeight: 56, borderRadius: 16, paddingVertical: 16, paddingHorizontal: 24, flexDirection: 'row', justifyContent: 'center', alignItems: 'center', gap: 8 },
+});
diff --git a/src/components/operations/__tests__/time-report-picker.test.tsx b/src/components/operations/__tests__/time-report-picker.test.tsx
new file mode 100644
index 00000000..d4936a64
--- /dev/null
+++ b/src/components/operations/__tests__/time-report-picker.test.tsx
@@ -0,0 +1,56 @@
+import { fireEvent, render } from '@testing-library/react-native';
+import React from 'react';
+
+import { TimeReportEditor } from '@/components/operations/time-report-editor';
+import { newEntry } from '@/lib/operations/time';
+import { type TimeReport, TimeReportStatus, TimeSubjectType } from '@/models/v4/operations';
+
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('@/components/operations/option-select', () => ({ OptionSelect: () => null }));
+jest.mock('react-native-safe-area-context', () => ({ SafeAreaView: require('react-native').View }));
+
+const subject = { type: TimeSubjectType.Personnel, id: 'person-1', label: 'Crew member' };
+const props = () => ({
+  dateKey: '2026-09-26',
+  report: { CanAct: true, Status: TimeReportStatus.Draft } as TimeReport,
+  entries: [newEntry(subject, '2026-09-26', 0, { StartLocal: '2026-09-26T22:00:00', EndLocal: '2026-09-26T23:00:00' })],
+  subjects: [subject],
+  names: { 'person-1': 'Crew member' },
+  scopeLabel: 'Crew member',
+  isCrew: false,
+  coveredBy: null,
+  issues: [],
+  warnings: [],
+  canCreate: true,
+  canApprove: false,
+  canWrite: () => true,
+  dirty: false,
+  busy: false,
+  onStart: jest.fn(),
+  onChange: jest.fn(),
+  onSave: jest.fn(),
+  onSubmit: jest.fn(),
+  onSign: jest.fn(),
+  onApprove: jest.fn(),
+});
+
+it('keeps overnight end times on the next day after picking a clock time', () => {
+  const options = props();
+  const screen = render(<TimeReportEditor {...options} />);
+  fireEvent.press(screen.getByTestId('operations-entry-end-0'));
+  fireEvent.press(screen.getByTestId('operations-entry-end-0-hour-2'));
+  fireEvent.press(screen.getByTestId('operations-entry-end-0-minute-30'));
+  fireEvent.press(screen.getByTestId('operations-entry-end-0-done'));
+  expect(options.onChange).toHaveBeenCalledWith([expect.objectContaining({ StartLocal: '2026-09-26T22:00:00', EndLocal: '2026-09-27T02:30' })]);
+  screen.unmount();
+});
+
+it('does not allow time edits on a submitted report', () => {
+  const options = props();
+  options.report.Status = TimeReportStatus.Submitted;
+  const screen = render(<TimeReportEditor {...options} />);
+  fireEvent.press(screen.getByTestId('operations-entry-start-0'));
+  expect(screen.queryByTestId('operations-entry-start-0-done')).toBeNull();
+  expect(options.onChange).not.toHaveBeenCalled();
+  screen.unmount();
+});
diff --git a/src/components/operations/time-report-editor.tsx b/src/components/operations/time-report-editor.tsx
index bed50fc4..a20c0cbd 100644
--- a/src/components/operations/time-report-editor.tsx
+++ b/src/components/operations/time-report-editor.tsx
@@ -1,6 +1,7 @@
-import React, { useEffect, useMemo, useState } from 'react';
+import React, { useMemo, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 
+import { DateTimeField } from '@/components/common/date-time-field';
 import { OptionSelect } from '@/components/operations/option-select';
 import { Button, ButtonText } from '@/components/ui/button';
 import { HStack } from '@/components/ui/hstack';
@@ -9,7 +10,7 @@ import { Switch } from '@/components/ui/switch';
 import { Text } from '@/components/ui/text';
 import { VStack } from '@/components/ui/vstack';
 import type { EntrySubject } from '@/lib/operations/time';
-import { applyToCrew, combineDateTime, dateOf, endLocalFor, entryHours, hoursBySubject, isClockTime, isReportEditable, newEntry, subjectIdOf, sumHours, timeOf } from '@/lib/operations/time';
+import { applyToCrew, combineDateTime, dateOf, endLocalFor, entryHours, hoursBySubject, isReportEditable, newEntry, subjectIdOf, sumHours, timeOf } from '@/lib/operations/time';
 import type { TimeEntry, TimeReport, TimeReportIssue } from '@/models/v4/operations';
 import { TimeEntryType, TimeReportScope, TimeReportStatus, TimeSubjectType } from '@/models/v4/operations';
 
@@ -41,31 +42,6 @@ interface TimeReportEditorProps {
   onApprove: () => void;
 }
 
-// Keeps the keystrokes local and only commits a complete HH:mm, so a half-typed time never lands
-// in the entry as an unparseable value.
-const ClockField = ({ value, onCommit, isDisabled, testID, label }: { value: string; onCommit: (clock: string) => void; isDisabled: boolean; testID: string; label: string }) => {
-  const [text, setText] = useState(value);
-  useEffect(() => {
-    setText(value);
-  }, [value]);
-  return (
-    <Input isDisabled={isDisabled} className="w-24">
-      <InputField
-        testID={testID}
-        accessibilityLabel={label}
-        value={text}
-        placeholder="HH:mm"
-        keyboardType="numbers-and-punctuation"
-        maxLength={5}
-        onChangeText={(next) => {
-          setText(next);
-          if (isClockTime(next)) onCommit(next);
-        }}
-      />
-    </Input>
-  );
-};
-
 const typeRank = (entry: TimeEntry) => (entry.SubjectType === TimeSubjectType.Unit ? 0 : entry.SubjectType === TimeSubjectType.Personnel ? 1 : 2);
 
 // A crew or individual time report for one day (the paper CTR / OF-288 analog). On a crew report the unit's
@@ -185,13 +161,23 @@ export const TimeReportEditor = ({
             />
             <HStack space="sm" className="items-center">
               <Text className="w-12">{t('operations.time.from')}</Text>
-              <ClockField label={t('operations.time.from')} value={timeOf(entry.StartLocal)} onCommit={(clock) => setStart(index, clock)} isDisabled={!rowEditable} testID={`operations-entry-start-${index}`} />
+              <DateTimeField
+                mode="time"
+                clearable={false}
+                label={t('operations.time.from')}
+                value={timeOf(entry.StartLocal)}
+                onChange={(clock) => setStart(index, clock)}
+                disabled={!rowEditable}
+                testID={`operations-entry-start-${index}`}
+              />
               <Text className="w-8">{t('operations.time.to')}</Text>
-              <ClockField
+              <DateTimeField
+                mode="time"
+                clearable={false}
                 label={t('operations.time.to')}
                 value={timeOf(entry.EndLocal)}
-                onCommit={(clock) => update(index, { EndLocal: endLocalFor(entry.StartLocal, clock) })}
-                isDisabled={!rowEditable}
+                onChange={(clock) => update(index, { EndLocal: endLocalFor(entry.StartLocal, clock) })}
+                disabled={!rowEditable}
                 testID={`operations-entry-end-${index}`}
               />
             </HStack>
diff --git a/src/components/records/__tests__/record-date-picker.test.tsx b/src/components/records/__tests__/record-date-picker.test.tsx
new file mode 100644
index 00000000..42a67754
--- /dev/null
+++ b/src/components/records/__tests__/record-date-picker.test.tsx
@@ -0,0 +1,22 @@
+import { fireEvent, render } from '@testing-library/react-native';
+import React from 'react';
+import { TextInput } from 'react-native';
+
+import { RecordField } from '@/components/records/record-field';
+import { RmsFieldClassification, RmsFieldType } from '@/models/v4/records';
+
+jest.mock('react-i18next', () => ({ useTranslation: () => ({ t: (key: string) => key }) }));
+jest.mock('react-native-safe-area-context', () => ({ SafeAreaView: require('react-native').View }));
+
+it.each([RmsFieldType.Date, RmsFieldType.DateTime])('renders record field type %i as a picker and preserves its value', (type) => {
+  const onChange = jest.fn();
+  const value = type === RmsFieldType.Date ? '2024-02-29' : '2024-02-29T21:30:00.000Z';
+  const screen = render(
+    <RecordField field={{ Key: 'date', Label: 'Date', Type: type, Classification: RmsFieldClassification.Standard }} value={{ Value: value } as never} required onChange={onChange} testID="record-date" />
+  );
+  expect(screen.UNSAFE_queryAllByType(TextInput)).toHaveLength(0);
+  fireEvent.press(screen.getByTestId('record-date-picker'));
+  fireEvent.press(screen.getByTestId('record-date-picker-done'));
+  expect(onChange).toHaveBeenCalledWith({ Value: value });
+  screen.unmount();
+});
diff --git a/src/components/records/record-field.tsx b/src/components/records/record-field.tsx
index 9a4436af..a2de482d 100644
--- a/src/components/records/record-field.tsx
+++ b/src/components/records/record-field.tsx
@@ -2,6 +2,7 @@ import { Lock } from 'lucide-react-native';
 import React, { useCallback } from 'react';
 import { useTranslation } from 'react-i18next';
 
+import { DateTimeField } from '@/components/common/date-time-field';
 import { Badge, BadgeText } from '@/components/ui/badge';
 import { Box } from '@/components/ui/box';
 import { Checkbox, CheckboxIcon, CheckboxIndicator, CheckboxLabel } from '@/components/ui/checkbox';
@@ -77,6 +78,10 @@ export const RecordField: React.FC<RecordFieldProps> = ({ field, value, required
   }
 
   switch (field.Type) {
+    case RmsFieldType.Date:
+    case RmsFieldType.DateTime:
+      return wrap(<DateTimeField value={text} onChange={setText} label={field.Label} mode={field.Type === RmsFieldType.Date ? 'date' : 'datetime'} disabled={disabled} testID={testID ? `${testID}-picker` : undefined} />);
+
     case RmsFieldType.LongText:
       return wrap(
         <Textarea isDisabled={disabled} isInvalid={invalid}>
diff --git a/src/hooks/__tests__/use-oidc-login.test.ts b/src/hooks/__tests__/use-oidc-login.test.ts
index c43f0796..04212b3f 100644
--- a/src/hooks/__tests__/use-oidc-login.test.ts
+++ b/src/hooks/__tests__/use-oidc-login.test.ts
@@ -80,7 +80,7 @@ describe('useOidcLogin', () => {
 
   it('returns request=null and response=null when authority is empty', () => {
     const { result } = renderHook(() =>
-      useOidcLogin({ authority: '', clientId: 'test', departmentCode: 'DEPT' }),
+      useOidcLogin({ authority: '', clientId: 'test', departmentToken: 'dept-token' }),
     );
 
     expect(result.current.request).toBeNull();
@@ -89,7 +89,7 @@ describe('useOidcLogin', () => {
 
   it('passes an empty authority to discovery when the authority URL is invalid', () => {
     renderHook(() =>
-      useOidcLogin({ authority: 'not a url', clientId: 'test', departmentCode: 'DEPT' }),
+      useOidcLogin({ authority: 'not a url', clientId: 'test', departmentToken: 'dept-token' }),
     );
 
     expect(mockedUseAutoDiscovery).toHaveBeenCalledWith('');
@@ -97,7 +97,7 @@ describe('useOidcLogin', () => {
 
   it('passes the authority to discovery when the authority URL is valid https', () => {
     renderHook(() =>
-      useOidcLogin({ authority: 'https://idp.example.com', clientId: 'test', departmentCode: 'DEPT' }),
+      useOidcLogin({ authority: 'https://idp.example.com', clientId: 'test', departmentToken: 'dept-token' }),
     );
 
     expect(mockedUseAutoDiscovery).toHaveBeenCalledWith('https://idp.example.com');
@@ -115,7 +115,7 @@ describe('useOidcLogin', () => {
       useOidcLogin({
         authority: 'https://idp.example.com',
         clientId: 'client123',
-        departmentCode: 'DEPT',
+        departmentToken: 'dept-token',
       }),
     );
 
@@ -138,7 +138,7 @@ describe('useOidcLogin', () => {
       useOidcLogin({
         authority: 'https://idp.example.com',
         clientId: 'client123',
-        departmentCode: 'DEPT',
+        departmentToken: 'dept-token',
       }),
     );
 
@@ -163,7 +163,7 @@ describe('useOidcLogin', () => {
       useOidcLogin({
         authority: 'https://idp.example.com',
         clientId: 'client123',
-        departmentCode: 'DEPT001',
+        departmentToken: 'dept-token',
       }),
     );
 
@@ -175,7 +175,7 @@ describe('useOidcLogin', () => {
     expect(mockLoginWithSso).toHaveBeenCalledWith({
       provider: 'oidc',
       externalToken: 'id.token.here',
-      departmentCode: 'DEPT001',
+      departmentToken: 'dept-token',
     });
     expect(ok!).toBe(true);
   });
diff --git a/src/hooks/__tests__/use-pending-approval-check.test.tsx b/src/hooks/__tests__/use-pending-approval-check.test.tsx
new file mode 100644
index 00000000..20f5604e
--- /dev/null
+++ b/src/hooks/__tests__/use-pending-approval-check.test.tsx
@@ -0,0 +1,53 @@
+import { act, renderHook, waitFor } from '@testing-library/react-native';
+import { AppState } from 'react-native';
+
+import { getPendingApproval } from '@/api/mfa/account-security';
+
+import { usePendingApprovalCheck } from '../use-pending-approval-check';
+
+const mockPush = jest.fn();
+let mockPathname = '/home';
+jest.mock('expo-router', () => ({ useRouter: () => ({ push: mockPush }), usePathname: () => mockPathname }));
+jest.mock('@/api/mfa/account-security', () => ({ getPendingApproval: jest.fn() }));
+jest.mock('@/lib/logging', () => ({ logger: { warn: jest.fn() } }));
+
+describe('usePendingApprovalCheck', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    mockPathname = '/home';
+    jest.spyOn(AppState, 'addEventListener').mockReturnValue({ remove: jest.fn() } as never);
+  });
+
+  it('opens the approval screen when a request is waiting', async () => {
+    (getPendingApproval as jest.Mock).mockResolvedValue({ ApprovalRequestId: 'ap-1' });
+    renderHook(() => usePendingApprovalCheck(true));
+    await waitFor(() => expect(mockPush).toHaveBeenCalledWith('/approve-sign-in'));
+  });
+
+  it('does nothing when signed out, when nothing waits, or when already there', async () => {
+    renderHook(() => usePendingApprovalCheck(false));
+    expect(getPendingApproval).not.toHaveBeenCalled();
+
+    (getPendingApproval as jest.Mock).mockResolvedValue(null);
+    renderHook(() => usePendingApprovalCheck(true));
+    await waitFor(() => expect(getPendingApproval).toHaveBeenCalled());
+    expect(mockPush).not.toHaveBeenCalled();
+
+    mockPathname = '/approve-sign-in';
+    (getPendingApproval as jest.Mock).mockResolvedValue({ ApprovalRequestId: 'ap-1' });
+    renderHook(() => usePendingApprovalCheck(true));
+    await waitFor(() => expect(getPendingApproval).toHaveBeenCalledTimes(2));
+    expect(mockPush).not.toHaveBeenCalled();
+  });
+
+  it('opens nothing when the member signs out while the lookup is on its way', async () => {
+    let answer: (value: unknown) => void = () => undefined;
+    (getPendingApproval as jest.Mock).mockReturnValue(new Promise((resolve) => (answer = resolve)));
+    const { rerender } = renderHook(({ enabled }) => usePendingApprovalCheck(enabled), { initialProps: { enabled: true } });
+    expect(getPendingApproval).toHaveBeenCalledTimes(1);
+
+    rerender({ enabled: false });
+    await act(async () => answer({ ApprovalRequestId: 'ap-1' }));
+    expect(mockPush).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/hooks/__tests__/use-saml-login.test.ts b/src/hooks/__tests__/use-saml-login.test.ts
index 2ed53034..fe9868f7 100644
--- a/src/hooks/__tests__/use-saml-login.test.ts
+++ b/src/hooks/__tests__/use-saml-login.test.ts
@@ -3,7 +3,7 @@ import * as Linking from 'expo-linking';
 import * as SecureStore from 'expo-secure-store';
 import * as WebBrowser from 'expo-web-browser';
 
-import { handleSamlCallbackUrl, PENDING_SAML_DEPT_CODE_KEY, useSamlLogin } from '../use-saml-login';
+import { handleSamlCallbackUrl, PENDING_SAML_DEPT_TOKEN_KEY, useSamlLogin } from '../use-saml-login';
 
 // Mock expo modules
 jest.mock('expo-linking', () => ({
@@ -95,7 +95,7 @@ describe('handleSamlCallbackUrl', () => {
   it('returns false when no pending login state exists', async () => {
     mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml' } });
     mockSecureGetItemAsync.mockResolvedValue(null);
-    mockGetItem.mockReturnValue('DEPT001');
+    mockGetItem.mockReturnValue('dept-token');
 
     const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml');
     expect(result).toBe(false);
@@ -106,7 +106,7 @@ describe('handleSamlCallbackUrl', () => {
   it('returns false when the pending login state is expired', async () => {
     mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml' } });
     mockSecureGetItemAsync.mockResolvedValue(validPendingState(Date.now() - 11 * 60 * 1000));
-    mockGetItem.mockReturnValue('DEPT001');
+    mockGetItem.mockReturnValue('dept-token');
 
     const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml');
     expect(result).toBe(false);
@@ -114,18 +114,27 @@ describe('handleSamlCallbackUrl', () => {
     expect(mockSecureDeleteItemAsync).toHaveBeenCalledWith('pending_saml_state');
   });
 
+  it('ignores the old state param: only the relay_state the server echoes counts', async () => {
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'test-state-uuid' } });
+    mockGetItem.mockReturnValue('dept-token');
+
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&state=test-state-uuid');
+    expect(result).toBe(false);
+    expect(mockLoginWithSso).not.toHaveBeenCalled();
+  });
+
   it('returns false when the callback state does not match the pending state', async () => {
-    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'attacker-state' } });
-    mockGetItem.mockReturnValue('DEPT001');
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'attacker-state' } });
+    mockGetItem.mockReturnValue('dept-token');
 
-    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&state=attacker-state');
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&relay_state=attacker-state');
     expect(result).toBe(false);
     expect(mockLoginWithSso).not.toHaveBeenCalled();
   });
 
   it('returns false and clears pending state when the callback state is missing', async () => {
     mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml' } });
-    mockGetItem.mockReturnValue('DEPT001');
+    mockGetItem.mockReturnValue('dept-token');
 
     const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml');
 
@@ -137,7 +146,7 @@ describe('handleSamlCallbackUrl', () => {
   it('returns false when the pending state is malformed', async () => {
     mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml' } });
     mockSecureGetItemAsync.mockResolvedValue('not-json');
-    mockGetItem.mockReturnValue('DEPT001');
+    mockGetItem.mockReturnValue('dept-token');
 
     const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml');
     expect(result).toBe(false);
@@ -145,53 +154,64 @@ describe('handleSamlCallbackUrl', () => {
     expect(mockSecureDeleteItemAsync).toHaveBeenCalledWith('pending_saml_state');
   });
 
-  it('returns false when no pending department code is stored', async () => {
-    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'test-state-uuid' } });
+  it('returns false when neither the callback nor storage has a department token', async () => {
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'test-state-uuid' } });
     mockGetItem.mockReturnValue(null);
 
-    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&state=test-state-uuid');
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&relay_state=test-state-uuid');
     expect(result).toBe(false);
     expect(mockLoginWithSso).not.toHaveBeenCalled();
   });
 
-  it('calls loginWithSso and clears stored dept code on success', async () => {
-    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml=', state: 'test-state-uuid' } });
-    mockGetItem.mockReturnValue('DEPT001');
+  it('calls loginWithSso and clears the stored department token on success', async () => {
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml=', relay_state: 'test-state-uuid' } });
+    mockGetItem.mockReturnValue('dept-token');
     mockLoginWithSso.mockResolvedValue(undefined);
 
-    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml=&state=test-state-uuid');
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml=&relay_state=test-state-uuid');
 
     expect(mockLoginWithSso).toHaveBeenCalledWith({
       provider: 'saml2',
       externalToken: 'base64saml=',
-      departmentCode: 'DEPT001',
+      departmentToken: 'dept-token',
     });
-    expect(mockRemoveItem).toHaveBeenCalledWith(PENDING_SAML_DEPT_CODE_KEY);
+    expect(mockRemoveItem).toHaveBeenCalledWith(PENDING_SAML_DEPT_TOKEN_KEY);
     expect(mockSecureDeleteItemAsync).toHaveBeenCalledWith('pending_saml_state');
     expect(result).toBe(true);
   });
 
   it('calls loginWithSso when the callback state matches the pending state', async () => {
-    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'test-state-uuid' } });
-    mockGetItem.mockReturnValue('DEPT001');
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'test-state-uuid' } });
+    mockGetItem.mockReturnValue('dept-token');
     mockLoginWithSso.mockResolvedValue(undefined);
 
-    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&state=test-state-uuid');
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&relay_state=test-state-uuid');
 
     expect(mockLoginWithSso).toHaveBeenCalledWith({
       provider: 'saml2',
       externalToken: 'base64saml',
-      departmentCode: 'DEPT001',
+      departmentToken: 'dept-token',
     });
     expect(result).toBe(true);
   });
 
+  it("uses the relay callback's own department token over the one stored at launch", async () => {
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'test-state-uuid', department_token: 'relay-token' } });
+    mockGetItem.mockReturnValue('dept-token');
+    mockLoginWithSso.mockResolvedValue(undefined);
+
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&relay_state=test-state-uuid&department_token=relay-token');
+
+    expect(mockLoginWithSso).toHaveBeenCalledWith({ provider: 'saml2', externalToken: 'base64saml', departmentToken: 'relay-token' });
+    expect(result).toBe(true);
+  });
+
   it('returns false and clears pending state when loginWithSso throws', async () => {
-    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'test-state-uuid' } });
-    mockGetItem.mockReturnValue('DEPT001');
+    mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'test-state-uuid' } });
+    mockGetItem.mockReturnValue('dept-token');
     mockLoginWithSso.mockRejectedValue(new Error('Token exchange failed'));
 
-    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&state=test-state-uuid');
+    const result = await handleSamlCallbackUrl('resgrid://auth/callback?saml_response=base64saml&relay_state=test-state-uuid');
 
     expect(result).toBe(false);
     expect(mockSecureDeleteItemAsync).toHaveBeenCalledWith('pending_saml_state');
@@ -207,29 +227,30 @@ describe('useSamlLogin', () => {
 
   describe('startSamlLogin', () => {
     it('persists state and department code, then opens the IdP URL with the state param', async () => {
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'https://idp.example.com/sso', departmentCode: 'DEPT001' }));
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'https://idp.example.com/sso', departmentToken: 'dept-token' }));
 
       await act(async () => {
         await result.current.startSamlLogin();
       });
 
-      expect(mockSecureSetItemAsync).toHaveBeenCalledWith('pending_saml_state', expect.stringContaining('test-state-uuid'));
-      expect(mockSetItem).toHaveBeenCalledWith(PENDING_SAML_DEPT_CODE_KEY, 'DEPT001');
-      expect(mockedOpenBrowserAsync).toHaveBeenCalledWith('https://idp.example.com/sso?state=test-state-uuid');
+      // Tagged with this app's name so the server's relay returns to Responder (every app shares one ACS URL).
+      expect(mockSecureSetItemAsync).toHaveBeenCalledWith('pending_saml_state', expect.stringContaining('"state":"responder.test-state-uuid"'));
+      expect(mockSetItem).toHaveBeenCalledWith(PENDING_SAML_DEPT_TOKEN_KEY, 'dept-token');
+      expect(mockedOpenBrowserAsync).toHaveBeenCalledWith('https://idp.example.com/sso?RelayState=responder.test-state-uuid');
     });
 
     it('appends the state param with & when the URL already has a query string', async () => {
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'https://idp.example.com/sso?foo=bar', departmentCode: 'DEPT001' }));
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'https://idp.example.com/sso?foo=bar', departmentToken: 'dept-token' }));
 
       await act(async () => {
         await result.current.startSamlLogin();
       });
 
-      expect(mockedOpenBrowserAsync).toHaveBeenCalledWith('https://idp.example.com/sso?foo=bar&state=test-state-uuid');
+      expect(mockedOpenBrowserAsync).toHaveBeenCalledWith('https://idp.example.com/sso?foo=bar&RelayState=responder.test-state-uuid');
     });
 
-    it('does nothing when idpSsoUrl is empty', async () => {
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: '', departmentCode: 'DEPT001' }));
+    it('does nothing without a sign-in page', async () => {
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: '', departmentToken: 'dept-token' }));
 
       await act(async () => {
         await result.current.startSamlLogin();
@@ -239,8 +260,8 @@ describe('useSamlLogin', () => {
       expect(mockSecureSetItemAsync).not.toHaveBeenCalled();
     });
 
-    it('refuses to open a malformed IdP URL', async () => {
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'not a url', departmentCode: 'DEPT001' }));
+    it('refuses to open a malformed sign-in page', async () => {
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'not a url', departmentToken: 'dept-token' }));
 
       await act(async () => {
         await result.current.startSamlLogin();
@@ -248,15 +269,15 @@ describe('useSamlLogin', () => {
 
       expect(mockedOpenBrowserAsync).not.toHaveBeenCalled();
       expect(mockSecureSetItemAsync).not.toHaveBeenCalled();
-      expect(mockedLogger.error).toHaveBeenCalledWith(expect.objectContaining({ message: 'SAML: refusing to open non-HTTPS or malformed IdP SSO URL' }));
+      expect(mockedLogger.error).toHaveBeenCalledWith(expect.objectContaining({ message: 'SAML: refusing to open a non-HTTPS or malformed sign-in page' }));
     });
 
-    it('refuses to open an http IdP URL when not in dev mode', async () => {
+    it('refuses to open an http sign-in page when not in dev mode', async () => {
       const originalDev = (global as Record<string, unknown>).__DEV__;
       (global as Record<string, unknown>).__DEV__ = false;
 
       try {
-        const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'http://idp.example.com/sso', departmentCode: 'DEPT001' }));
+        const { result } = renderHook(() => useSamlLogin({ signInUrl: 'http://idp.example.com/sso', departmentToken: 'dept-token' }));
 
         await act(async () => {
           await result.current.startSamlLogin();
@@ -274,7 +295,7 @@ describe('useSamlLogin', () => {
       mockSecureGetItemAsync.mockResolvedValue(null);
       mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml' } });
 
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'https://idp.example.com/sso', departmentCode: 'DEPT001' }));
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'https://idp.example.com/sso', departmentToken: 'dept-token' }));
 
       let ok: boolean | undefined;
       await act(async () => {
@@ -286,38 +307,51 @@ describe('useSamlLogin', () => {
     });
 
     it('returns false when the callback state does not match', async () => {
-      mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'wrong-state' } });
+      mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'wrong-state' } });
 
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'https://idp.example.com/sso', departmentCode: 'DEPT001' }));
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'https://idp.example.com/sso', departmentToken: 'dept-token' }));
 
       let ok: boolean | undefined;
       await act(async () => {
-        ok = await result.current.handleDeepLink('resgrid://auth/callback?saml_response=base64saml&state=wrong-state');
+        ok = await result.current.handleDeepLink('resgrid://auth/callback?saml_response=base64saml&relay_state=wrong-state');
       });
 
       expect(ok).toBe(false);
       expect(mockLoginWithSso).not.toHaveBeenCalled();
     });
 
+    it("prefers the relay callback's department token", async () => {
+      mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'test-state-uuid', department_token: 'relay-token' } });
+      mockLoginWithSso.mockResolvedValue(undefined);
+
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'https://idp.example.com/sso', departmentToken: 'dept-token' }));
+
+      await act(async () => {
+        await result.current.handleDeepLink('resgrid://auth/callback?saml_response=base64saml&relay_state=test-state-uuid&department_token=relay-token');
+      });
+
+      expect(mockLoginWithSso).toHaveBeenCalledWith({ provider: 'saml2', externalToken: 'base64saml', departmentToken: 'relay-token' });
+    });
+
     it('exchanges the response and clears pending state on success', async () => {
-      mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', state: 'test-state-uuid' } });
+      mockedParse.mockReturnValue({ queryParams: { saml_response: 'base64saml', relay_state: 'test-state-uuid' } });
       mockLoginWithSso.mockResolvedValue(undefined);
 
-      const { result } = renderHook(() => useSamlLogin({ idpSsoUrl: 'https://idp.example.com/sso', departmentCode: 'DEPT001' }));
+      const { result } = renderHook(() => useSamlLogin({ signInUrl: 'https://idp.example.com/sso', departmentToken: 'dept-token' }));
 
       let ok: boolean | undefined;
       await act(async () => {
-        ok = await result.current.handleDeepLink('resgrid://auth/callback?saml_response=base64saml&state=test-state-uuid');
+        ok = await result.current.handleDeepLink('resgrid://auth/callback?saml_response=base64saml&relay_state=test-state-uuid');
       });
 
       expect(ok).toBe(true);
       expect(mockLoginWithSso).toHaveBeenCalledWith({
         provider: 'saml2',
         externalToken: 'base64saml',
-        departmentCode: 'DEPT001',
+        departmentToken: 'dept-token',
       });
       expect(mockSecureDeleteItemAsync).toHaveBeenCalledWith('pending_saml_state');
-      expect(mockRemoveItem).toHaveBeenCalledWith(PENDING_SAML_DEPT_CODE_KEY);
+      expect(mockRemoveItem).toHaveBeenCalledWith(PENDING_SAML_DEPT_TOKEN_KEY);
     });
   });
 });
diff --git a/src/hooks/use-oidc-login.ts b/src/hooks/use-oidc-login.ts
index 3fa3e7fa..6970bbf5 100644
--- a/src/hooks/use-oidc-login.ts
+++ b/src/hooks/use-oidc-login.ts
@@ -11,7 +11,8 @@ WebBrowser.maybeCompleteAuthSession();
 export interface UseOidcLoginOptions {
   authority: string;
   clientId: string;
-  departmentCode: string;
+  /** Discovery's department token, sent with the id_token to connect/external-token. */
+  departmentToken: string;
 }
 
 export const isValidSsoUrl = (url: string): boolean => {
@@ -41,11 +42,11 @@ export interface UseOidcLoginResult {
  * Hook that drives the OIDC Authorization-Code + PKCE login flow.
  *
  * Usage:
- *   const { request, promptAsync, exchangeCodeForResgridToken } = useOidcLogin({ authority, clientId, departmentCode });
+ *   const { request, promptAsync, exchangeCodeForResgridToken } = useOidcLogin({ authority, clientId, departmentToken });
  *   // Call promptAsync() to open the system browser.
  *   // Watch `response` and call exchangeCodeForResgridToken() when response.type === 'success'.
  */
-export function useOidcLogin({ authority, clientId, departmentCode }: UseOidcLoginOptions): UseOidcLoginResult {
+export function useOidcLogin({ authority, clientId, departmentToken }: UseOidcLoginOptions): UseOidcLoginResult {
   const redirectUri = AuthSession.makeRedirectUri({ scheme: 'resgrid', path: 'auth/callback' });
 
   const safeAuthority = isValidSsoUrl(authority) ? authority : '';
@@ -99,7 +100,7 @@ export function useOidcLogin({ authority, clientId, departmentCode }: UseOidcLog
       await loginWithSso({
         provider: 'oidc',
         externalToken: idToken,
-        departmentCode,
+        departmentToken,
       });
 
       return true;
@@ -110,7 +111,7 @@ export function useOidcLogin({ authority, clientId, departmentCode }: UseOidcLog
       });
       return false;
     }
-  }, [response, request, discovery, clientId, redirectUri, departmentCode, loginWithSso]);
+  }, [response, request, discovery, clientId, redirectUri, departmentToken, loginWithSso]);
 
   return {
     request,
diff --git a/src/hooks/use-pending-approval-check.ts b/src/hooks/use-pending-approval-check.ts
new file mode 100644
index 00000000..889dd573
--- /dev/null
+++ b/src/hooks/use-pending-approval-check.ts
@@ -0,0 +1,59 @@
+import { type Href, usePathname, useRouter } from 'expo-router';
+import { useEffect, useRef } from 'react';
+import { AppState } from 'react-native';
+
+import { getPendingApproval } from '@/api/mfa/account-security';
+import { logger } from '@/lib/logging';
+
+const CHECK_INTERVAL_MS = 15000;
+const APPROVE_PATH = '/approve-sign-in';
+
+/**
+ * A push can be late or never arrive (passkey plan section 7.9): whenever Responder comes to the foreground, it asks the
+ * server whether a request is waiting for this member and opens the approval screen if one is. At most every 15 seconds.
+ */
+export const usePendingApprovalCheck = (enabled: boolean): void => {
+  const router = useRouter();
+  const pathname = usePathname();
+  const pathnameRef = useRef(pathname);
+
+  // Only a committed screen counts: a render React discards must not stop (or start) navigation.
+  useEffect(() => {
+    pathnameRef.current = pathname;
+  }, [pathname]);
+
+  useEffect(() => {
+    if (!enabled) {
+      return;
+    }
+    let active = true;
+    let lastCheck = 0;
+    const check = async () => {
+      const now = Date.now();
+      if (now - lastCheck < CHECK_INTERVAL_MS) {
+        return;
+      }
+      lastCheck = now;
+      try {
+        const pending = await getPendingApproval();
+        // A lookup that finishes after sign-out (or any other disable) opens nothing.
+        if (active && pending && pathnameRef.current !== APPROVE_PATH) {
+          router.push(APPROVE_PATH as Href);
+        }
+      } catch (error) {
+        logger.warn({ message: 'Could not check for a waiting approval request', context: { error } });
+      }
+    };
+
+    void check();
+    const subscription = AppState.addEventListener('change', (state) => {
+      if (state === 'active') {
+        void check();
+      }
+    });
+    return () => {
+      active = false;
+      subscription?.remove?.();
+    };
+  }, [enabled, router]);
+};
diff --git a/src/hooks/use-saml-login.ts b/src/hooks/use-saml-login.ts
index 66887341..b3860eb2 100644
--- a/src/hooks/use-saml-login.ts
+++ b/src/hooks/use-saml-login.ts
@@ -6,11 +6,12 @@ import { useCallback } from 'react';
 
 import { isValidSsoUrl } from '@/hooks/use-oidc-login';
 import { logger } from '@/lib/logging';
+import { RESGRID_CLIENT } from '@/lib/mfa/client-app';
 import { getItem, removeItem, setItem } from '@/lib/storage';
 import useAuthStore, { PENDING_SAML_STATE_KEY } from '@/stores/auth/store';
 
-/** MMKV key used to persist the active SAML department code across cold starts */
-export const PENDING_SAML_DEPT_CODE_KEY = 'pending_saml_dept_code';
+/** MMKV key holding discovery's department token across a cold start, for a relay callback that carries none */
+export const PENDING_SAML_DEPT_TOKEN_KEY = 'pending_saml_dept_token';
 
 const PENDING_SAML_STATE_TTL_MS = 10 * 60 * 1000;
 
@@ -83,8 +84,10 @@ const consumePendingSamlState = async (callbackState?: string): Promise<boolean>
 };
 
 export interface UseSamlLoginOptions {
-  idpSsoUrl: string;
-  departmentCode: string;
+  /** The server's SAML start page (discovery's SamlLoginUrl), which sends the browser on to the department's IdP. */
+  signInUrl: string;
+  /** Discovery's department token; the relay's callback normally carries its own. */
+  departmentToken: string;
 }
 
 export interface UseSamlLoginResult {
@@ -98,39 +101,40 @@ export interface UseSamlLoginResult {
  * Flow:
  *  1. Call startSamlLogin() to open the IdP SSO URL in a browser.
  *  2. The IdP POSTs a SAMLResponse to the SP ACS URL.
- *  3. The SP ACS URL redirects to resgrid://auth/callback?saml_response=<base64>.
+ *  3. The SP ACS URL redirects to resgrid://auth/callback?saml_response=<relay token>&relay_state=<our RelayState>.
  *  4. The deep-link is intercepted by the app and handleDeepLink() is called.
  *  5. handleDeepLink() exchanges the SAMLResponse for a Resgrid token.
  *
- * NOTE: The backend SP ACS endpoint must redirect to
- * resgrid://auth/callback?saml_response=<base64url-encoded SAMLResponse>
- * See the implementation plan Step 8 for backend configuration.
+ * NOTE: The backend relay (connect/saml-mobile-callback) returns to the app named in the RelayState (responder.<nonce>)
+ * and echoes it as relay_state; a callback whose relay_state is not our pending one is refused (login CSRF).
  */
-export function useSamlLogin({ idpSsoUrl, departmentCode }: UseSamlLoginOptions): UseSamlLoginResult {
+export function useSamlLogin({ signInUrl, departmentToken }: UseSamlLoginOptions): UseSamlLoginResult {
   const { loginWithSso } = useAuthStore();
 
   const startSamlLogin = useCallback(async (): Promise<void> => {
-    if (!idpSsoUrl) {
-      logger.warn({ message: 'SAML: idpSsoUrl is empty, cannot start login' });
+    if (!signInUrl) {
+      logger.warn({ message: 'SAML: no sign-in page, cannot start login' });
       return;
     }
 
-    if (!isValidSsoUrl(idpSsoUrl)) {
-      logger.error({ message: 'SAML: refusing to open non-HTTPS or malformed IdP SSO URL', context: { idpSsoUrl } });
+    if (!isValidSsoUrl(signInUrl)) {
+      logger.error({ message: 'SAML: refusing to open a non-HTTPS or malformed sign-in page' });
       return;
     }
 
-    const state = Crypto.randomUUID();
+    // One-time RelayState, tagged with this app's name: every app shares one ACS URL, so the server's relay returns to the
+    // app named here and echoes the whole value back as relay_state. IdPs round-trip RelayState, not arbitrary params.
+    const state = `${RESGRID_CLIENT}.${Crypto.randomUUID()}`;
     await savePendingSamlState(state);
 
-    // Persist department code so the cold-start deep-link handler can retrieve it
-    await setItem<string>(PENDING_SAML_DEPT_CODE_KEY, departmentCode);
+    // Keep discovery's department token for a cold-start callback that carries none
+    await setItem<string>(PENDING_SAML_DEPT_TOKEN_KEY, departmentToken);
 
-    const initiateUrl = `${idpSsoUrl}${idpSsoUrl.includes('?') ? '&' : '?'}state=${encodeURIComponent(state)}`;
+    const initiateUrl = `${signInUrl}${signInUrl.includes('?') ? '&' : '?'}RelayState=${encodeURIComponent(state)}`;
 
-    logger.info({ message: 'SAML: opening IdP SSO URL', context: { idpSsoUrl } });
+    logger.info({ message: 'SAML: opening the sign-in page' });
     await WebBrowser.openBrowserAsync(initiateUrl);
-  }, [idpSsoUrl, departmentCode]);
+  }, [signInUrl, departmentToken]);
 
   const handleDeepLink = useCallback(
     async (url: string): Promise<boolean> => {
@@ -142,9 +146,9 @@ export function useSamlLogin({ idpSsoUrl, departmentCode }: UseSamlLoginOptions)
         return false;
       }
 
-      const stateValid = await consumePendingSamlState(parsed.queryParams?.state as string | undefined);
+      const stateValid = await consumePendingSamlState(parsed.queryParams?.relay_state as string | undefined);
       if (!stateValid) {
-        await removeItem(PENDING_SAML_DEPT_CODE_KEY);
+        await removeItem(PENDING_SAML_DEPT_TOKEN_KEY);
         return false;
       }
 
@@ -154,7 +158,7 @@ export function useSamlLogin({ idpSsoUrl, departmentCode }: UseSamlLoginOptions)
         await loginWithSso({
           provider: 'saml2',
           externalToken: samlResponse,
-          departmentCode,
+          departmentToken: callbackDepartmentToken(parsed.queryParams?.department_token) ?? departmentToken,
         });
         return true;
       } catch (error) {
@@ -165,19 +169,22 @@ export function useSamlLogin({ idpSsoUrl, departmentCode }: UseSamlLoginOptions)
         return false;
       } finally {
         await clearPendingSamlState();
-        await removeItem(PENDING_SAML_DEPT_CODE_KEY);
+        await removeItem(PENDING_SAML_DEPT_TOKEN_KEY);
       }
     },
-    [departmentCode, loginWithSso]
+    [departmentToken, loginWithSso]
   );
 
   return { startSamlLogin, handleDeepLink };
 }
 
+/** The department token the relay put on its callback (connect/saml-mobile-callback always sends one). */
+const callbackDepartmentToken = (value: unknown): string | null => (typeof value === 'string' && value.length > 0 ? value : null);
+
 /**
  * Standalone SAML deep-link handler for use outside of React components
  * (e.g., in the app _layout.tsx for cold-start callbacks).
- * Reads the stored department code from MMKV and calls loginWithSso directly.
+ * Uses the relay callback's department token, or the one stored at launch, and calls loginWithSso directly.
  */
 export async function handleSamlCallbackUrl(url: string): Promise<boolean> {
   const parsed = Linking.parse(url);
@@ -185,15 +192,15 @@ export async function handleSamlCallbackUrl(url: string): Promise<boolean> {
 
   if (!samlResponse) return false;
 
-  const stateValid = await consumePendingSamlState(parsed.queryParams?.state as string | undefined);
+  const stateValid = await consumePendingSamlState(parsed.queryParams?.relay_state as string | undefined);
   if (!stateValid) {
-    await removeItem(PENDING_SAML_DEPT_CODE_KEY);
+    await removeItem(PENDING_SAML_DEPT_TOKEN_KEY);
     return false;
   }
 
-  const departmentCode = getItem<string>(PENDING_SAML_DEPT_CODE_KEY);
-  if (!departmentCode) {
-    logger.warn({ message: 'SAML cold-start: no pending department code found in storage' });
+  const departmentToken = callbackDepartmentToken(parsed.queryParams?.department_token) ?? getItem<string>(PENDING_SAML_DEPT_TOKEN_KEY);
+  if (!departmentToken) {
+    logger.warn({ message: 'SAML cold-start: no department token on the callback or in storage' });
     await clearPendingSamlState();
     return false;
   }
@@ -204,9 +211,9 @@ export async function handleSamlCallbackUrl(url: string): Promise<boolean> {
     await useAuthStore.getState().loginWithSso({
       provider: 'saml2',
       externalToken: samlResponse,
-      departmentCode,
+      departmentToken,
     });
-    await removeItem(PENDING_SAML_DEPT_CODE_KEY);
+    await removeItem(PENDING_SAML_DEPT_TOKEN_KEY);
     return true;
   } catch (error) {
     logger.error({
diff --git a/src/lib/__tests__/map-center.test.ts b/src/lib/__tests__/map-center.test.ts
index 86965ee7..1aeec379 100644
--- a/src/lib/__tests__/map-center.test.ts
+++ b/src/lib/__tests__/map-center.test.ts
@@ -32,6 +32,10 @@ const BASE_CONFIG: GetConfigResultData = {
   UnitLocationMinMeters: 0,
   AnalyticsApiKey: '',
   AnalyticsHost: '',
+  MapDayStyleUrl: '',
+  MapNightStyleUrl: '',
+  AppMapboxAccessToken: '',
+  IsDepartmentMapOverride: false,
 };
 
 const setConfig = (center: Partial<GetConfigResultData>) => {
diff --git a/src/lib/__tests__/map-style.test.ts b/src/lib/__tests__/map-style.test.ts
new file mode 100644
index 00000000..9f2d5f81
--- /dev/null
+++ b/src/lib/__tests__/map-style.test.ts
@@ -0,0 +1,115 @@
+import { FALLBACK_DAY_MAP_STYLE, FALLBACK_NIGHT_MAP_STYLE, getDepartmentMapStyle, resolveDepartmentMapStyle } from '@/lib/map-style';
+import { useCoreStore } from '@/stores/app/core-store';
+
+jest.mock('nativewind', () => ({
+  useColorScheme: jest.fn(() => ({ colorScheme: 'light' })),
+}));
+
+jest.mock('@/stores/app/core-store', () => ({
+  useCoreStore: { getState: jest.fn() },
+}));
+
+let mockActiveToken = 'pk.builtin.token';
+
+jest.mock('@/lib/mapbox-token', () => ({
+  getMapboxAccessToken: jest.fn(() => mockActiveToken),
+  useMapboxAccessToken: jest.fn(() => mockActiveToken),
+}));
+
+const mockedGetState = useCoreStore.getState as unknown as jest.Mock;
+
+const SATELLITE = 'mapbox://styles/mapbox/satellite-v9';
+const NAVIGATION_NIGHT = 'mapbox://styles/mapbox/navigation-night-v1';
+const CUSTOM = 'mapbox://styles/county-fire/ckcustom123';
+const COMMUNITY = 'mapbox://styles/mapbox-map-design/cks97e1e37nsd17nzg7p0308g';
+const DEPARTMENT_TOKEN = 'pk.department.token';
+
+describe('resolveDepartmentMapStyle', () => {
+  it('uses the day style in a light theme', () => {
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: SATELLITE, MapNightStyleUrl: NAVIGATION_NIGHT }, 'light')).toBe(SATELLITE);
+  });
+
+  it('uses the night style in a dark theme', () => {
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: SATELLITE, MapNightStyleUrl: NAVIGATION_NIGHT }, 'dark')).toBe(NAVIGATION_NIGHT);
+  });
+
+  it('treats an unknown theme as day', () => {
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: SATELLITE, MapNightStyleUrl: NAVIGATION_NIGHT }, undefined)).toBe(SATELLITE);
+  });
+
+  it('falls back to Streets / Dark before config loads', () => {
+    expect(resolveDepartmentMapStyle(null, 'light')).toBe(FALLBACK_DAY_MAP_STYLE);
+    expect(resolveDepartmentMapStyle(null, 'dark')).toBe(FALLBACK_NIGHT_MAP_STYLE);
+  });
+
+  it('falls back when an older server sends no style', () => {
+    expect(resolveDepartmentMapStyle({}, 'light')).toBe(FALLBACK_DAY_MAP_STYLE);
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: '', MapNightStyleUrl: '' }, 'dark')).toBe(FALLBACK_NIGHT_MAP_STYLE);
+  });
+
+  it('rejects anything that is not a mapbox:// style', () => {
+    // A raster tile url or an http style would not load on the app's own Mapbox token.
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: 'https://tiles.example.com/{z}/{x}/{y}.png' }, 'light')).toBe(FALLBACK_DAY_MAP_STYLE);
+  });
+
+  it('trims surrounding whitespace', () => {
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: `  ${SATELLITE} ` }, 'light')).toBe(SATELLITE);
+  });
+
+  it('uses a department custom style once its token is the one in use', () => {
+    const config = { MapDayStyleUrl: CUSTOM, MapNightStyleUrl: CUSTOM, AppMapboxAccessToken: DEPARTMENT_TOKEN, IsDepartmentMapOverride: true };
+
+    expect(resolveDepartmentMapStyle(config, 'light', DEPARTMENT_TOKEN)).toBe(CUSTOM);
+    expect(resolveDepartmentMapStyle(config, 'dark', DEPARTMENT_TOKEN)).toBe(CUSTOM);
+  });
+
+  it('holds a custom style back until the department token is active', () => {
+    // The custom style would load blank on the built-in token.
+    const config = { MapDayStyleUrl: CUSTOM, MapNightStyleUrl: CUSTOM, AppMapboxAccessToken: DEPARTMENT_TOKEN, IsDepartmentMapOverride: true };
+
+    expect(resolveDepartmentMapStyle(config, 'light', 'pk.builtin.token')).toBe(FALLBACK_DAY_MAP_STYLE);
+    expect(resolveDepartmentMapStyle(config, 'dark', undefined)).toBe(FALLBACK_NIGHT_MAP_STYLE);
+  });
+
+  it('never uses an override style the server sent without a token', () => {
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: CUSTOM, IsDepartmentMapOverride: true }, 'light', 'pk.builtin.token')).toBe(FALLBACK_DAY_MAP_STYLE);
+  });
+
+  it('uses Mapbox styles on any token', () => {
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: SATELLITE, AppMapboxAccessToken: DEPARTMENT_TOKEN }, 'light', 'pk.builtin.token')).toBe(SATELLITE);
+  });
+
+  it('uses community styles on any token, with or without a server token', () => {
+    // Gallery styles live under mapbox-map-design and are public.
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: COMMUNITY, AppMapboxAccessToken: '' }, 'light', 'pk.builtin.token')).toBe(COMMUNITY);
+    expect(resolveDepartmentMapStyle({ MapDayStyleUrl: COMMUNITY, AppMapboxAccessToken: DEPARTMENT_TOKEN }, 'light', 'pk.builtin.token')).toBe(COMMUNITY);
+    expect(resolveDepartmentMapStyle({ MapNightStyleUrl: COMMUNITY }, 'dark', undefined)).toBe(COMMUNITY);
+  });
+});
+
+describe('getDepartmentMapStyle', () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it('reads the current config from the store', () => {
+    mockedGetState.mockReturnValue({ config: { MapDayStyleUrl: SATELLITE, MapNightStyleUrl: NAVIGATION_NIGHT } });
+
+    expect(getDepartmentMapStyle('dark')).toBe(NAVIGATION_NIGHT);
+    expect(getDepartmentMapStyle('light')).toBe(SATELLITE);
+  });
+
+  it('falls back while the store has no config', () => {
+    mockedGetState.mockReturnValue({ config: null });
+
+    expect(getDepartmentMapStyle('dark')).toBe(FALLBACK_NIGHT_MAP_STYLE);
+  });
+
+  it('checks a custom style against the token in use', () => {
+    mockedGetState.mockReturnValue({ config: { MapDayStyleUrl: CUSTOM, AppMapboxAccessToken: DEPARTMENT_TOKEN, IsDepartmentMapOverride: true } });
+
+    mockActiveToken = 'pk.builtin.token';
+    expect(getDepartmentMapStyle('light')).toBe(FALLBACK_DAY_MAP_STYLE);
+
+    mockActiveToken = DEPARTMENT_TOKEN;
+    expect(getDepartmentMapStyle('light')).toBe(CUSTOM);
+  });
+});
diff --git a/src/lib/__tests__/mapbox-token.test.ts b/src/lib/__tests__/mapbox-token.test.ts
new file mode 100644
index 00000000..fc49369e
--- /dev/null
+++ b/src/lib/__tests__/mapbox-token.test.ts
@@ -0,0 +1,186 @@
+import {
+  applyServerMapboxToken,
+  clearMapboxToken,
+  getBuiltInMapboxToken,
+  getMapboxAccessToken,
+  isUsableMapboxToken,
+  MAPBOX_TOKEN_RECHECK_MS,
+  onMapboxAccessTokenChange,
+  useMapboxTokenStore,
+  verifyMapboxToken,
+} from '@/lib/mapbox-token';
+
+jest.mock('@/lib/mapbox-built-in-token', () => ({
+  MAPBOX_BUILT_IN_TOKEN: 'pk.builtin.signature',
+}));
+
+// The map lives inside the factory: persist reads storage while the module under test is imported,
+// which happens before any top-level const in this file is initialised.
+jest.mock('@/lib/storage', () => {
+  const store = new Map<string, string>();
+
+  return {
+    __store: store,
+    zustandStorage: {
+      getItem: (name: string) => store.get(name) ?? null,
+      setItem: (name: string, value: string) => {
+        store.set(name, value);
+      },
+      removeItem: (name: string) => {
+        store.delete(name);
+      },
+    },
+  };
+});
+
+const mockStorage: Map<string, string> = jest.requireMock('@/lib/storage').__store;
+
+const SERVER_TOKEN = 'pk.eyJ1IjoiY291bnR5LWZpcmUifQ.server-signature_1';
+const OTHER_TOKEN = 'pk.eyJ1Ijoib3RoZXIifQ.other-signature';
+
+const mockFetchCode = (code: string | null) => {
+  (global as any).fetch = jest.fn().mockResolvedValue({
+    json: () => Promise.resolve(code === null ? {} : { code }),
+  });
+};
+
+const mockFetchFailure = () => {
+  (global as any).fetch = jest.fn().mockRejectedValue(new Error('Network request failed'));
+};
+
+describe('mapbox-token', () => {
+  const originalFetch = (global as any).fetch;
+
+  beforeEach(() => {
+    clearMapboxToken();
+    mockStorage.clear();
+  });
+
+  afterAll(() => {
+    (global as any).fetch = originalFetch;
+  });
+
+  describe('isUsableMapboxToken', () => {
+    it('accepts public tokens', () => {
+      expect(isUsableMapboxToken(SERVER_TOKEN)).toBe(true);
+      expect(isUsableMapboxToken(`  ${SERVER_TOKEN} `)).toBe(true);
+    });
+
+    it('refuses secret, temporary, empty and malformed tokens', () => {
+      expect(isUsableMapboxToken('sk.eyJ1IjoieCJ9.secret')).toBe(false);
+      expect(isUsableMapboxToken('tk.eyJ1IjoieCJ9.temp')).toBe(false);
+      expect(isUsableMapboxToken('')).toBe(false);
+      expect(isUsableMapboxToken(null)).toBe(false);
+      expect(isUsableMapboxToken(undefined)).toBe(false);
+      expect(isUsableMapboxToken('pk.only-one-part')).toBe(false);
+      expect(isUsableMapboxToken('pk.has spaces.inside')).toBe(false);
+    });
+  });
+
+  it('uses the built-in token until the server sends one', () => {
+    expect(getBuiltInMapboxToken()).toBe('pk.builtin.signature');
+    expect(getMapboxAccessToken()).toBe('pk.builtin.signature');
+  });
+
+  it('adopts and stores a server token Mapbox confirms', async () => {
+    mockFetchCode('TokenValid');
+
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    expect(getMapboxAccessToken()).toBe(SERVER_TOKEN);
+    expect((global as any).fetch).toHaveBeenCalledWith(expect.stringContaining('https://api.mapbox.com/tokens/v2?access_token='));
+    expect(mockStorage.get('mapbox-token-storage')).toContain(SERVER_TOKEN);
+  });
+
+  it('does not re-check a confirmed token on every config load', async () => {
+    mockFetchCode('TokenValid');
+    await applyServerMapboxToken(SERVER_TOKEN);
+    (global as any).fetch.mockClear();
+
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    expect((global as any).fetch).not.toHaveBeenCalled();
+  });
+
+  it('re-checks a confirmed token once a day and drops it when revoked', async () => {
+    mockFetchCode('TokenValid');
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    mockFetchCode('TokenRevoked');
+    await applyServerMapboxToken(SERVER_TOKEN, Date.now() + MAPBOX_TOKEN_RECHECK_MS + 1);
+
+    expect(getMapboxAccessToken()).toBe('pk.builtin.signature');
+  });
+
+  it.each(['TokenInvalid', 'TokenExpired', 'TokenRevoked', 'TokenMalformed'])('falls back to the built-in token when Mapbox says %s', async (code) => {
+    mockFetchCode('TokenValid');
+    await applyServerMapboxToken(OTHER_TOKEN);
+
+    mockFetchCode(code);
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    expect(getMapboxAccessToken()).toBe('pk.builtin.signature');
+  });
+
+  it('does not re-check a recently refused token', async () => {
+    mockFetchCode('TokenInvalid');
+    await applyServerMapboxToken(SERVER_TOKEN);
+    (global as any).fetch.mockClear();
+
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    expect((global as any).fetch).not.toHaveBeenCalled();
+    expect(getMapboxAccessToken()).toBe('pk.builtin.signature');
+  });
+
+  it('keeps the token in use when Mapbox cannot be reached', async () => {
+    mockFetchCode('TokenValid');
+    await applyServerMapboxToken(OTHER_TOKEN);
+
+    mockFetchFailure();
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    expect(getMapboxAccessToken()).toBe(OTHER_TOKEN);
+  });
+
+  it('keeps the token in use on an unexpected Mapbox answer', async () => {
+    expect(await (mockFetchCode(null), verifyMapboxToken(SERVER_TOKEN))).toBe('unknown');
+  });
+
+  it('drops the stored token when the server stops sending one', async () => {
+    mockFetchCode('TokenValid');
+    await applyServerMapboxToken(SERVER_TOKEN);
+
+    await applyServerMapboxToken('');
+
+    expect(getMapboxAccessToken()).toBe('pk.builtin.signature');
+  });
+
+  it('never checks or stores a secret token', async () => {
+    mockFetchCode('TokenValid');
+
+    await applyServerMapboxToken('sk.eyJ1IjoieCJ9.secret');
+
+    expect((global as any).fetch).not.toHaveBeenCalled();
+    expect(getMapboxAccessToken()).toBe('pk.builtin.signature');
+  });
+
+  it('tells listeners about the token now and on every change', async () => {
+    const listener = jest.fn();
+    const unsubscribe = onMapboxAccessTokenChange(listener);
+
+    mockFetchCode('TokenValid');
+    await applyServerMapboxToken(SERVER_TOKEN);
+    clearMapboxToken();
+    unsubscribe();
+    await applyServerMapboxToken(OTHER_TOKEN);
+
+    expect(listener.mock.calls.map((call) => call[0])).toEqual(['pk.builtin.signature', SERVER_TOKEN, 'pk.builtin.signature']);
+  });
+
+  it('starts from the stored token', () => {
+    useMapboxTokenStore.setState({ token: SERVER_TOKEN, verifiedAt: Date.now() });
+
+    expect(getMapboxAccessToken()).toBe(SERVER_TOKEN);
+  });
+});
diff --git a/src/lib/auth/__tests__/api-mfa-transaction.test.ts b/src/lib/auth/__tests__/api-mfa-transaction.test.ts
new file mode 100644
index 00000000..959ab571
--- /dev/null
+++ b/src/lib/auth/__tests__/api-mfa-transaction.test.ts
@@ -0,0 +1,77 @@
+import queryString from 'query-string';
+
+const mockPost = jest.fn();
+
+jest.mock('@/lib/storage/app', () => ({ getBaseApiUrl: () => 'https://api.test/api/v4' }));
+jest.mock('@/lib/logging', () => ({ logger: { info: jest.fn(), error: jest.fn(), warn: jest.fn() } }));
+jest.mock('@env', () => ({ Env: { IS_MOBILE_APP: true } }));
+jest.mock('axios', () => ({
+  __esModule: true,
+  default: { create: jest.fn(() => ({ interceptors: { request: { use: jest.fn() } }, post: mockPost })) },
+}));
+
+// Required after the mocks exist: the module creates its axios instance at load.
+const { completionGrantRequest, loginRequest } = require('../api') as typeof import('../api');
+
+const refusal = (data: Record<string, unknown>) => Object.assign(new Error('400'), { response: { status: 400, data } });
+const sentBody = () => queryString.parse(mockPost.mock.calls[0][1] as string);
+
+describe('login on the transaction flow (passkey workbook section 7.1)', () => {
+  beforeEach(() => mockPost.mockReset());
+
+  it('asks for the transaction flow and never sends a code with the password', async () => {
+    mockPost.mockResolvedValue({ status: 200, data: { access_token: 'a', refresh_token: 'r', id_token: 'i', expires_in: 60 } });
+    await loginRequest({ username: 'user1', password: 'pw' });
+    expect(mockPost.mock.calls[0][0]).toBe('/connect/token');
+    expect(sentBody()).toMatchObject({ grant_type: 'password', username: 'user1', password: 'pw', mfa_flow: 'transaction' });
+    expect(sentBody().totp_code).toBeUndefined();
+  });
+
+  it('continues on the transaction the server started, with its methods and lifetime', async () => {
+    mockPost.mockRejectedValue(
+      refusal({ error: 'mfa_required', mfa_transaction: 'secret', mfa_methods: 'totp passkey federated', mfa_enrolled: 'totp passkey', mfa_preferred: 'passkey', mfa_expires_in: 300 })
+    );
+    const before = Date.now();
+    const response = await loginRequest({ username: 'user1', password: 'pw' });
+
+    expect(response.successful).toBe(false);
+    expect(response.mfaTransaction?.secret).toBe('secret');
+    expect(response.mfaTransaction?.challenge).toMatchObject({
+      kind: 'verify',
+      methods: ['totp', 'passkey', 'federated'],
+      enrolled: ['totp', 'passkey'],
+      preferred: 'passkey',
+      source: 'password',
+    });
+    expect(response.mfaTransaction?.challenge.expiresAt).toBeGreaterThanOrEqual(before + 300000);
+  });
+
+  it('falls back to the code resent with the password when the server has no transaction', async () => {
+    mockPost.mockRejectedValueOnce(refusal({ error: 'mfa_required' }));
+    const first = await loginRequest({ username: 'user1', password: 'pw' });
+    expect(first).toMatchObject({ mfaRequired: true, invalidOtp: false });
+    expect(first.mfaTransaction).toBeUndefined();
+
+    mockPost.mockReset();
+    mockPost.mockRejectedValueOnce(refusal({ error: 'invalid_totp' }));
+    const second = await loginRequest({ username: 'user1', password: 'pw', otpCode: ' 123456 ' });
+    expect(sentBody()).toMatchObject({ totp_code: '123456' });
+    expect(sentBody().mfa_flow).toBeUndefined();
+    expect(second).toMatchObject({ mfaRequired: true, invalidOtp: true });
+  });
+
+  it('continues as the setup transaction when the department requires MFA the account does not have', async () => {
+    mockPost.mockRejectedValueOnce(refusal({ error: 'mfa_enrollment_required', mfa_setup_transaction: 'setup-secret', mfa_expires_in: 300 }));
+    const setup = await loginRequest({ username: 'user1', password: 'pw' });
+    expect(setup.mfaTransaction).toMatchObject({ secret: 'setup-secret', challenge: { kind: 'setup', methods: ['totp'] } });
+
+    mockPost.mockRejectedValueOnce(refusal({ error: 'mfa_enrollment_required', error_uri: 'https://app/User/TwoFactor' }));
+    expect(await loginRequest({ username: 'user1', password: 'pw' })).toMatchObject({ successful: false, enrollmentRequired: true });
+  });
+
+  it('exchanges the completion code once for tokens', async () => {
+    mockPost.mockResolvedValue({ data: { access_token: 'a', refresh_token: 'r', id_token: 'i', expires_in: 60 } });
+    expect(await completionGrantRequest('secret', 'code-1')).toMatchObject({ access_token: 'a' });
+    expect(sentBody()).toEqual({ grant_type: 'urn:resgrid:params:oauth:grant-type:mfa_completion', transaction: 'secret', completion_code: 'code-1' });
+  });
+});
diff --git a/src/lib/auth/__tests__/external-token.test.ts b/src/lib/auth/__tests__/external-token.test.ts
new file mode 100644
index 00000000..e633c0f4
--- /dev/null
+++ b/src/lib/auth/__tests__/external-token.test.ts
@@ -0,0 +1,44 @@
+import queryString from 'query-string';
+
+const mockPost = jest.fn();
+
+jest.mock('@/lib/storage/app', () => ({ getBaseApiUrl: () => 'https://api.test/api/v4' }));
+jest.mock('@/lib/logging', () => ({ logger: { info: jest.fn(), error: jest.fn(), warn: jest.fn() } }));
+jest.mock('@env', () => ({ Env: { IS_MOBILE_APP: true } }));
+jest.mock('axios', () => ({
+  __esModule: true,
+  default: { create: jest.fn(() => ({ interceptors: { request: { use: jest.fn() } }, post: mockPost })) },
+}));
+
+// Required after the mocks exist: the module creates its axios instance at load.
+const { externalTokenRequest } = require('../api') as typeof import('../api');
+
+const sentBody = () => queryString.parse(mockPost.mock.calls[0][1] as string);
+
+describe('the legacy SSO exchange (connect/external-token)', () => {
+  beforeEach(() => mockPost.mockReset());
+
+  it('names the department by the token discovery returned, never by a username or code', async () => {
+    mockPost.mockResolvedValue({ status: 200, data: { access_token: 'a', refresh_token: 'r', id_token: 'i', expires_in: 60 } });
+
+    const response = await externalTokenRequest({ provider: 'oidc', externalToken: 'id.token', departmentToken: 'dept-token' });
+
+    expect(response.successful).toBe(true);
+    expect(mockPost.mock.calls[0][0]).toBe('/connect/external-token');
+    expect(sentBody()).toMatchObject({ provider: 'oidc', external_token: 'id.token', department_token: 'dept-token' });
+    expect(sentBody().department_code).toBeUndefined();
+    expect(sentBody().totp_code).toBeUndefined();
+  });
+
+  it('resends the same exchange with the authenticator code when the account has one', async () => {
+    mockPost.mockRejectedValueOnce(Object.assign(new Error('401'), { response: { status: 401, data: { error: 'mfa_required' } } }));
+
+    const first = await externalTokenRequest({ provider: 'oidc', externalToken: 'id.token', departmentToken: 'dept-token' });
+    expect(first).toMatchObject({ successful: false, mfaRequired: true, invalidOtp: false });
+
+    mockPost.mockReset();
+    mockPost.mockResolvedValue({ status: 200, data: { access_token: 'a', refresh_token: 'r', id_token: 'i', expires_in: 60 } });
+    await externalTokenRequest({ provider: 'oidc', externalToken: 'id.token', departmentToken: 'dept-token', otpCode: ' 123456 ' });
+    expect(sentBody()).toMatchObject({ department_token: 'dept-token', totp_code: '123456' });
+  });
+});
diff --git a/src/lib/auth/__tests__/sign-in-journeys.live.test.ts b/src/lib/auth/__tests__/sign-in-journeys.live.test.ts
new file mode 100644
index 00000000..6b3b98e2
--- /dev/null
+++ b/src/lib/auth/__tests__/sign-in-journeys.live.test.ts
@@ -0,0 +1,358 @@
+/**
+ * The sign-in journeys, through this app's own sign-in and approval code, against the real Resgrid sign-in server over
+ * real HTTP: Core's LiveSignInServer (the real token endpoint, bearer validation, session middleware and sign-in
+ * services), served by the LiveSignInHost fixture. Skipped unless RESGRID_LIVE_API names that server, for example:
+ *
+ *   (Core) RESGRID_LIVE_PORT=5098 dotnet test Tests/Resgrid.Tests --filter FullyQualifiedName~LiveSignInHost
+ *   (here) RESGRID_LIVE_API=http://127.0.0.1:5098 npx jest sign-in-journeys.live
+ *
+ * The server's /__live endpoints seed members and switch the deployment's gates, and play what is outside this app: the
+ * identity provider's sign-in page, this phone's passkey (the native module is the only stand-in here), and another
+ * app's sign-in on another device that asks this Responder to approve it.
+ */
+import { act, renderHook } from '@testing-library/react-native';
+import axios from 'axios';
+import * as SecureStore from 'expo-secure-store';
+import * as WebBrowser from 'expo-web-browser';
+import { Passkey } from 'react-native-passkey';
+
+import { approveRequest, denyRequest, getApprovalOptions, getPasskeyRegistrationOptions, getPendingApproval, getStepUpOptions, verifyStepUp } from '@/api/mfa/account-security';
+import { getStepUpMethods, getStepUpPasskeyOptions, requestProtectedGrant, verifyStepUpPasskey } from '@/api/data-protection/data-protection';
+import { useSamlLogin } from '@/hooks/use-saml-login';
+import { getPasskeyAssertion } from '@/lib/mfa/passkey';
+import { setBaseApiUrl } from '@/lib/storage/app';
+import { fetchUserSsoConfig } from '@/services/sso-discovery';
+import { forgetLoginSecrets } from '@/stores/auth/login-mfa';
+import useAuthStore from '@/stores/auth/store';
+
+// Responder has no shared mock of the browser module: the system browser is played below.
+jest.mock('expo-web-browser', () => ({ openAuthSessionAsync: jest.fn(), openBrowserAsync: jest.fn(), maybeCompleteAuthSession: jest.fn(), dismissBrowser: jest.fn() }));
+
+/** expo-linking's parse needs expo-constants, which Jest lacks: read the link as a device does (scheme, host, path, query). */
+jest.mock('expo-linking', () => ({
+  ...jest.requireActual('expo-linking'),
+  parse: (url: string) => {
+    const link = new URL(url);
+    return { scheme: link.protocol.replace(/:$/, ''), hostname: link.hostname || null, path: link.pathname.replace(/^\//, '') || null, queryParams: Object.fromEntries(link.searchParams) };
+  },
+}));
+
+const LIVE = process.env.RESGRID_LIVE_API;
+const describeLive = LIVE ? describe : describe.skip;
+const CLIENT = 'responder';
+const FAKE_IDP_AUTHORIZE = 'https://idp.example.test/authorize';
+const FAKE_SAML_IDP = 'https://idp.example.test/saml2/sso';
+const SAML_CALLBACK = 'resgrid://auth/callback';
+
+interface LiveUser {
+  userId: string;
+  username: string;
+  password: string;
+  departmentToken: string;
+  externalSubject: string | null;
+}
+
+interface LiveSession {
+  client: string;
+  authentication: string;
+  loginMfa: string | null;
+}
+
+const control = async <T = unknown>(path: string, body: Record<string, unknown> = {}): Promise<T> => (await axios.post<T>(`${LIVE}/__live/${path}`, body)).data;
+const gates = (on: boolean) => control('gates', { transaction: on, brokeredSso: on, passkeys: on, approval: on, providerStepUp: on, sharedDevice: on });
+const newUser = (spec: Record<string, unknown>) => control<LiveUser>('users', spec);
+const totp = async (user: LiveUser) => (await control<{ code: string }>('totp', { userId: user.userId })).code;
+const thisAppsSessions = async (user: LiveUser) => (await control<LiveSession[]>('sessions', { userId: user.userId })).filter((s) => s.client === CLIENT);
+
+/** The system browser: the provider's sign-in page (the server's fake IdP), then the broker's callback, back to this app. */
+const browser = async (url: string, returnTarget: string): Promise<WebBrowser.WebBrowserAuthSessionResult> => {
+  // The providers' pages are the server's stand-ins: its OIDC authorize page and its SAML IdP.
+  const toLive = (link: string) =>
+    link.startsWith(FAKE_IDP_AUTHORIZE)
+      ? `${LIVE}/__live/idp/authorize${link.substring(FAKE_IDP_AUTHORIZE.length)}`
+      : link.startsWith(FAKE_SAML_IDP)
+        ? `${LIVE}/__live/idp/saml${link.substring(FAKE_SAML_IDP.length)}`
+        : link;
+  let next = toLive(url);
+  const dismissed = { type: 'dismiss' } as WebBrowser.WebBrowserAuthSessionResult;
+  for (let hop = 0; hop < 5; hop++) {
+    if (next.startsWith(returnTarget)) {
+      return { type: 'success', url: next };
+    }
+    // Each redirect by hand, reading the Location header as sent: the last one is this app's own scheme.
+    const response = await fetch(next, { redirect: 'manual' });
+    next = toLive(response.headers.get('location') ?? '');
+    if (!next) {
+      return dismissed;
+    }
+  }
+  return dismissed;
+};
+
+/** The claims of a protected-data grant (a signed JWT): which second factor stands behind it. */
+const grantClaims = (grant: string): Record<string, unknown> => JSON.parse(Buffer.from(grant.split('.')[1], 'base64url').toString('utf8'));
+
+/** Responder keeps the pending SAML state in the secure store: an in-memory one here. */
+const secureStore = new Map<string, string>();
+
+/** A legacy SAML sign-in through this app's own hook: the server's start page, the IdP, and the relay's link back, which it exchanges. */
+const samlRoundTrip = async (user: LiveUser, signInUrl: string, departmentToken: string) => {
+  await control('idp/next', { subject: user.externalSubject });
+  let returned = '';
+  (WebBrowser.openBrowserAsync as jest.Mock).mockImplementation(async (url: string) => {
+    returned = ((await browser(url, SAML_CALLBACK)) as { url?: string }).url ?? '';
+    return { type: 'opened' };
+  });
+  const { result, unmount } = renderHook(() => useSamlLogin({ signInUrl, departmentToken }));
+  await act(async () => result.current.startSamlLogin());
+  let handled = false;
+  await act(async () => {
+    handled = await result.current.handleDeepLink(returned);
+  });
+  unmount();
+  if (!handled) {
+    throw new Error('the app refused its own SAML callback: ' + returned);
+  }
+};
+
+const signedIn = () => {
+  const state = useAuthStore.getState();
+  return state.status === 'signedIn' && !!state.accessToken;
+};
+
+describeLive('sign-in journeys against the live Resgrid sign-in server (Responder)', () => {
+  jest.setTimeout(60000);
+
+  beforeAll(() => {
+    jest.useRealTimers();
+    setBaseApiUrl(`${LIVE}/api/v4`);
+    (WebBrowser.openAuthSessionAsync as jest.Mock).mockImplementation((url: string, returnTarget: string) => browser(url, returnTarget));
+    (Passkey.isSupported as jest.Mock).mockReturnValue(true);
+    (SecureStore.getItemAsync as jest.Mock).mockImplementation(async (key: string) => secureStore.get(key) ?? null);
+    (SecureStore.setItemAsync as jest.Mock).mockImplementation(async (key: string, value: string) => void secureStore.set(key, value));
+    (SecureStore.deleteItemAsync as jest.Mock).mockImplementation(async (key: string) => void secureStore.delete(key));
+    // This phone's passkey: the server's soft authenticator answers the options this app hands the native module.
+    (Passkey.get as jest.Mock).mockImplementation(async (request: unknown) => control('authenticator/assert', { options: request, client: CLIENT }));
+  });
+
+  beforeEach(() => {
+    jest.useRealTimers();
+    forgetLoginSecrets();
+    useAuthStore.setState({ status: 'signedOut', accessToken: null, refreshToken: null, mfaChallenge: null, isSsoMfaPending: false, error: null });
+  });
+
+  describe("with every new switch off (today's deployments)", () => {
+    beforeEach(() => gates(false));
+
+    it('1. signs in with a password alone', async () => {
+      const user = await newUser({});
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      expect(signedIn()).toBe(true);
+      expect(await thisAppsSessions(user)).toEqual([expect.objectContaining({ authentication: 'LocalPassword', loginMfa: null })]);
+    });
+
+    it('2. signs in with a password and an authenticator code, resent with the password', async () => {
+      const user = await newUser({ totp: true });
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      expect(useAuthStore.getState().status).toBe('mfaRequired');
+      expect(useAuthStore.getState().mfaChallenge?.kind).toBe('legacy');
+
+      await useAuthStore.getState().login({ username: user.username, password: user.password, otpCode: await totp(user) });
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0].loginMfa).toBe('totp');
+    });
+
+    it("3. signs in through the department's provider with discovery's department token", async () => {
+      const user = await newUser({ sso: true });
+      const discovery = await fetchUserSsoConfig(user.username);
+      expect(discovery?.brokeredSsoAvailable).toBe(false);
+      expect(discovery?.oidcRedirectUri).toBe('resgrid://auth/callback');
+      const { id_token } = await control<{ id_token: string }>('idp/legacy-token', { subject: user.externalSubject });
+
+      await useAuthStore.getState().loginWithSso({ provider: 'oidc', externalToken: id_token, departmentToken: discovery!.departmentToken! });
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0].authentication).toBe('OidcSso');
+    });
+
+    it('4. a member whose provider does the MFA and who has no authenticator signs straight in', async () => {
+      const user = await newUser({ sso: true, providerMfa: true });
+      const { id_token } = await control<{ id_token: string }>('idp/legacy-token', { subject: user.externalSubject });
+      await useAuthStore.getState().loginWithSso({ provider: 'oidc', externalToken: id_token, departmentToken: user.departmentToken });
+      expect(signedIn()).toBe(true);
+    });
+
+    it("5. signs in through the provider, then resends the same exchange with the member's code", async () => {
+      const user = await newUser({ sso: true, totp: true });
+      const { id_token } = await control<{ id_token: string }>('idp/legacy-token', { subject: user.externalSubject });
+
+      await useAuthStore.getState().loginWithSso({ provider: 'oidc', externalToken: id_token, departmentToken: user.departmentToken });
+      expect(useAuthStore.getState().status).toBe('mfaRequired');
+      expect(useAuthStore.getState().isSsoMfaPending).toBe(true);
+
+      await useAuthStore.getState().retrySsoWithOtp(await totp(user));
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0]).toEqual(expect.objectContaining({ authentication: 'OidcSso', loginMfa: 'totp' }));
+    });
+
+    it("3. signs in through a SAML provider: the server's start page, the relay back to this app, and the exchange", async () => {
+      const user = await newUser({ sso: true, saml: true });
+      const discovery = await fetchUserSsoConfig(user.username);
+      expect(discovery).toEqual(expect.objectContaining({ providerType: 'saml2', brokeredSsoAvailable: false, samlLoginUrl: expect.stringContaining('/connect/saml-mobile-login?departmentToken=') }));
+
+      await samlRoundTrip(user, discovery!.samlLoginUrl!, discovery!.departmentToken!);
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0].authentication).toBe('SamlSso');
+    });
+
+    it("5. signs in through a SAML provider, then resends the same relay token with the member's code", async () => {
+      const user = await newUser({ sso: true, saml: true, totp: true });
+      const discovery = await fetchUserSsoConfig(user.username);
+
+      await samlRoundTrip(user, discovery!.samlLoginUrl!, discovery!.departmentToken!);
+      expect(useAuthStore.getState().status).toBe('mfaRequired');
+      expect(useAuthStore.getState().isSsoMfaPending).toBe(true);
+      await useAuthStore.getState().retrySsoWithOtp(await totp(user));
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0]).toEqual(expect.objectContaining({ authentication: 'SamlSso', loginMfa: 'totp' }));
+    });
+  });
+
+  describe("with the plan's switches on", () => {
+    beforeEach(() => gates(true));
+
+    it('1. signs in with a password alone', async () => {
+      const user = await newUser({});
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      expect(signedIn()).toBe(true);
+    });
+
+    it('2. signs in with a password and an authenticator code on the login transaction', async () => {
+      const user = await newUser({ totp: true });
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      expect(useAuthStore.getState().mfaChallenge).toEqual(expect.objectContaining({ kind: 'verify', source: 'password', enrolled: ['totp'] }));
+
+      expect(await useAuthStore.getState().verifyLoginMfa({ method: 'totp', code: await totp(user) })).toEqual(expect.objectContaining({ ok: true }));
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0].loginMfa).toBe('totp');
+    });
+
+    it('3. signs in through the broker, with no MFA', async () => {
+      const user = await newUser({ sso: true });
+      const discovery = await fetchUserSsoConfig(user.username);
+      expect(discovery?.brokeredSsoAvailable).toBe(true);
+      await control('idp/next', { subject: user.externalSubject });
+
+      await useAuthStore.getState().loginWithBrokeredSso({ departmentToken: discovery!.departmentToken! });
+      expect(signedIn()).toBe(true);
+      expect(await thisAppsSessions(user)).toEqual([expect.objectContaining({ authentication: 'OidcSso', loginMfa: null })]);
+    });
+
+    it("4. signs in through the broker on the provider's MFA, with no Resgrid prompt though the member has an authenticator", async () => {
+      const user = await newUser({ sso: true, providerMfa: true, totp: true, requireMfa: true });
+      await control('idp/next', { subject: user.externalSubject, amr: ['pwd', 'mfa'] });
+
+      await useAuthStore.getState().loginWithBrokeredSso({ departmentToken: user.departmentToken });
+      expect(useAuthStore.getState().mfaChallenge).toBeNull();
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0].loginMfa).toBe('federated');
+    });
+
+    it('5. signs in through the broker, then with an authenticator code', async () => {
+      const user = await newUser({ sso: true, totp: true });
+      await control('idp/next', { subject: user.externalSubject });
+
+      await useAuthStore.getState().loginWithBrokeredSso({ departmentToken: user.departmentToken });
+      expect(useAuthStore.getState().mfaChallenge).toEqual(expect.objectContaining({ kind: 'verify', source: 'sso' }));
+
+      expect(await useAuthStore.getState().verifyLoginMfa({ method: 'totp', code: await totp(user) })).toEqual(expect.objectContaining({ ok: true }));
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0]).toEqual(expect.objectContaining({ authentication: 'OidcSso', loginMfa: 'totp' }));
+    });
+
+    it("6. finishes a password sign-in with this app's passkey, which then counts as the session's recent MFA", async () => {
+      const user = await newUser({ totp: true, passkeyFor: [CLIENT] });
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      expect(useAuthStore.getState().mfaChallenge?.enrolled).toContain('passkey');
+
+      expect(await useAuthStore.getState().verifyLoginMfa({ method: 'passkey' })).toEqual(expect.objectContaining({ ok: true }));
+      expect(signedIn()).toBe(true);
+      expect((await thisAppsSessions(user))[0].loginMfa).toBe('passkey');
+
+      // An account change right after sign-in takes the sign-in's own MFA: no password again, no step-up.
+      await expect(getPasskeyRegistrationOptions()).resolves.toEqual(expect.objectContaining({ RequestId: expect.any(String) }));
+      // So does protected data: the grant stands on the sign-in's passkey, and no prompt comes.
+      const grant = await requestProtectedGrant();
+      expect(grantClaims(grant.GrantToken as string)).toEqual(expect.objectContaining({ mfa_method: 'passkey', grant_ver: 2 }));
+    });
+
+    it('7. steps up for protected data with the passkey, where the department does not reuse the sign-in', async () => {
+      const user = await newUser({ totp: true, passkeyFor: [CLIENT], acceptRecentLoginMfaForAdp: false });
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      await useAuthStore.getState().verifyLoginMfa({ method: 'totp', code: await totp(user) });
+      await expect(requestProtectedGrant()).rejects.toMatchObject({ response: expect.objectContaining({ status: 401 }) });
+
+      expect((await getStepUpMethods()).Methods).toContain('passkey');
+      const ceremony = await getStepUpPasskeyOptions();
+      const credential = await getPasskeyAssertion(ceremony.Options);
+      const grant = await verifyStepUpPasskey(ceremony.RequestId, credential);
+      expect(grantClaims(grant.GrantToken as string)).toEqual(expect.objectContaining({ mfa_method: 'passkey' }));
+    });
+
+    it('7. steps up inside a session with the passkey', async () => {
+      const user = await newUser({ totp: true, passkeyFor: [CLIENT] });
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      await useAuthStore.getState().verifyLoginMfa({ method: 'totp', code: await totp(user) });
+      expect(signedIn()).toBe(true);
+
+      const options = await getStepUpOptions('account_security');
+      expect(options.Methods).toContain('passkey');
+      const credential = await getPasskeyAssertion(options.Passkey!.Options);
+      await expect(verifyStepUp({ Operation: 'account_security', Method: 'passkey', RequestId: options.Passkey!.RequestId, Credential: credential })).resolves.toEqual(
+        expect.objectContaining({ VerifiedAt: expect.any(String) })
+      );
+    });
+
+    it.each(['unit', 'dispatch', 'ic'])('8. approves a sign-in on a shared %s workstation from this phone, shown as shared and by its label, and that sign-in finishes', async (requestingApp) => {
+      const user = await newUser({ totp: true, responderApprover: true });
+      // This phone signs in to Responder with its passkey, as a member who approves does.
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      await useAuthStore.getState().verifyLoginMfa({ method: 'passkey' });
+      expect(signedIn()).toBe(true);
+
+      // The workstation starts its sign-in and shows the number; this phone sees the request.
+      const label = `${requestingApp} workstation 1`;
+      const started = await control<{ transaction: string; approvalRequestId: string; matchNumber: string }>('requester/start', {
+        userId: user.userId,
+        client: requestingApp,
+        shared: true,
+        deviceName: label,
+      });
+      const pending = await getPendingApproval();
+      expect(pending).toEqual(expect.objectContaining({ ApprovalRequestId: started.approvalRequestId, RequestingApp: requestingApp, Shared: true, InstallationLabel: label }));
+
+      // The member types the number and approves with this phone's passkey.
+      const ceremony = await getApprovalOptions(started.approvalRequestId);
+      const credential = await getPasskeyAssertion(ceremony.Options);
+      await expect(approveRequest(started.approvalRequestId, started.matchNumber, ceremony.RequestId, credential)).resolves.toEqual(expect.objectContaining({ State: 'approved' }));
+
+      const finished = await control<{ access_token?: string }>('requester/finish', { transaction: started.transaction, approvalRequestId: started.approvalRequestId, client: requestingApp });
+      expect(finished.access_token).toEqual(expect.any(String));
+    });
+
+    it('8. denying a sign-in the member did not start ends it on the other device', async () => {
+      const user = await newUser({ totp: true, responderApprover: true });
+      await useAuthStore.getState().login({ username: user.username, password: user.password });
+      await useAuthStore.getState().verifyLoginMfa({ method: 'passkey' });
+
+      const started = await control<{ transaction: string; approvalRequestId: string }>('requester/start', { userId: user.userId, client: 'unit' });
+      await expect(denyRequest(started.approvalRequestId, 'not_me')).resolves.toEqual(expect.objectContaining({ State: 'denied' }));
+
+      const finished = await control<{ access_token?: string; type?: string; error?: string }>('requester/finish', {
+        transaction: started.transaction,
+        approvalRequestId: started.approvalRequestId,
+        client: 'unit',
+      });
+      expect(finished.access_token).toBeUndefined();
+    });
+  });
+});
diff --git a/src/lib/auth/api.tsx b/src/lib/auth/api.tsx
index 119ad937..a3de1bb3 100644
--- a/src/lib/auth/api.tsx
+++ b/src/lib/auth/api.tsx
@@ -3,6 +3,8 @@ import axios from 'axios';
 import queryString from 'query-string';
 
 import { logger } from '@/lib/logging';
+import { applyClientHeaders } from '@/lib/mfa/client-app';
+import { type MfaChallenge, parseMethods } from '@/lib/mfa/types';
 
 import { getBaseApiUrl } from '../storage/app';
 import type { AuthResponse, ExternalTokenCredentials, LoginCredentials, LoginResponse } from './types';
@@ -21,18 +23,53 @@ const authApi = axios.create({
 
 authApi.interceptors.request.use((config) => {
   config.baseURL = getBaseApiUrl();
+  // The app header binds a sign-in transaction and the session it creates to this app (passkey plan section 10.4).
+  applyClientHeaders(config.headers);
   return config;
 });
 
+const LOGIN_SCOPE = Env.IS_MOBILE_APP ? 'openid profile offline_access mobile' : 'openid profile offline_access';
+
+interface OAuthErrorBody {
+  error?: string;
+  mfa_transaction?: string;
+  mfa_setup_transaction?: string;
+  mfa_methods?: string;
+  mfa_enrolled?: string;
+  mfa_preferred?: string;
+  mfa_expires_in?: number;
+}
+
+const oauthErrorBody = (error: unknown): OAuthErrorBody => {
+  const data = (error as { response?: { data?: unknown } })?.response?.data;
+  return typeof data === 'object' && data !== null ? (data as OAuthErrorBody) : {};
+};
+
+/** The login transaction the token endpoint started, when it started one (transaction flow on, passkey workbook section 7.1). */
+export const loginTransactionFrom = (body: OAuthErrorBody, source: MfaChallenge['source']): LoginResponse['mfaTransaction'] | undefined => {
+  const expiresAt = typeof body.mfa_expires_in === 'number' ? Date.now() + body.mfa_expires_in * 1000 : null;
+  if (body.error === 'mfa_required' && body.mfa_transaction) {
+    const methods = parseMethods(body.mfa_methods);
+    const enrolled = parseMethods(body.mfa_enrolled);
+    const preferred = parseMethods(body.mfa_preferred)[0] ?? null;
+    return { secret: body.mfa_transaction, challenge: { kind: 'verify', methods, enrolled, preferred, expiresAt, source } };
+  }
+  if (body.error === 'mfa_enrollment_required' && body.mfa_setup_transaction) {
+    return { secret: body.mfa_setup_transaction, challenge: { kind: 'setup', methods: ['totp'], enrolled: [], preferred: 'totp', expiresAt, source } };
+  }
+  return undefined;
+};
+
 export const loginRequest = async (credentials: LoginCredentials): Promise<LoginResponse> => {
   try {
     const data = queryString.stringify({
       grant_type: 'password',
       username: credentials.username,
       password: credentials.password,
-      // Accounts with Resgrid 2FA enabled must supply the current authenticator code.
-      ...(credentials.otpCode ? { totp_code: credentials.otpCode.trim() } : {}),
-      scope: Env.IS_MOBILE_APP ? 'openid profile offline_access mobile' : 'openid profile offline_access',
+      // A second factor continues on a login transaction; a server without one answers the older way (a code resent
+      // with the password), which the totp_code below still serves.
+      ...(credentials.otpCode ? { totp_code: credentials.otpCode.trim() } : { mfa_flow: 'transaction' }),
+      scope: LOGIN_SCOPE,
     });
 
     const response = await authApi.post<AuthResponse>('/connect/token', data);
@@ -62,8 +99,21 @@ export const loginRequest = async (credentials: LoginCredentials): Promise<Login
     }
   } catch (error) {
     // The OAuth error body distinguishes the 2FA challenge from a bad password. Neither the
-    // password nor any code is ever logged.
-    const oauthError = (error as { response?: { data?: { error?: string } } })?.response?.data?.error;
+    // password, the transaction nor any code is ever logged.
+    const body = oauthErrorBody(error);
+    const mfaTransaction = loginTransactionFrom(body, 'password');
+    if (mfaTransaction) {
+      logger.info({
+        message: 'Login continues on a second-factor transaction',
+        context: { username: credentials.username, kind: mfaTransaction.challenge.kind, methods: mfaTransaction.challenge.methods },
+      });
+      return { successful: false, message: 'Additional verification is required', authResponse: null, mfaRequired: true, mfaTransaction };
+    }
+    if (body.error === 'mfa_enrollment_required') {
+      return { successful: false, message: 'mfa_enrollment_required', authResponse: null, enrollmentRequired: true };
+    }
+
+    const oauthError = body.error;
     if (oauthError === 'mfa_required' || oauthError === 'invalid_totp') {
       logger.info({
         message: 'Login requires two-factor code',
@@ -87,6 +137,21 @@ export const loginRequest = async (credentials: LoginCredentials): Promise<Login
   }
 };
 
+/**
+ * Exchanges a finished login transaction for tokens (passkey workbook section 7.1): the completion code is single-use,
+ * bound to this transaction and app, and lives about a minute. A lost response means signing in again.
+ */
+export const completionGrantRequest = async (transaction: string, completionCode: string): Promise<AuthResponse> => {
+  const data = queryString.stringify({
+    grant_type: 'urn:resgrid:params:oauth:grant-type:mfa_completion',
+    transaction,
+    completion_code: completionCode,
+  });
+  const response = await authApi.post<AuthResponse>('/connect/token', data);
+  logger.info({ message: 'Login transaction completed' });
+  return response.data;
+};
+
 export const refreshTokenRequest = async (refreshToken: string): Promise<AuthResponse> => {
   try {
     const data = queryString.stringify({
@@ -116,7 +181,7 @@ export const externalTokenRequest = async (credentials: ExternalTokenCredentials
     const data = queryString.stringify({
       provider: credentials.provider,
       external_token: credentials.externalToken,
-      department_code: credentials.departmentCode,
+      department_token: credentials.departmentToken,
       // Accounts with Resgrid 2FA enabled must supply the current authenticator code even via SSO.
       ...(credentials.otpCode ? { totp_code: credentials.otpCode.trim() } : {}),
       scope: Env.IS_MOBILE_APP ? 'openid email profile offline_access mobile' : 'openid email profile offline_access',
@@ -127,7 +192,7 @@ export const externalTokenRequest = async (credentials: ExternalTokenCredentials
     if (response.status === 200) {
       logger.info({
         message: 'External token exchange successful',
-        context: { provider: credentials.provider, departmentCode: credentials.departmentCode },
+        context: { provider: credentials.provider },
       });
 
       return {
diff --git a/src/lib/auth/types.tsx b/src/lib/auth/types.tsx
index 660b4e9a..59a9e270 100644
--- a/src/lib/auth/types.tsx
+++ b/src/lib/auth/types.tsx
@@ -1,3 +1,5 @@
+import type { MfaChallenge } from '@/lib/mfa/types';
+
 export interface AuthTokens {
   accessToken: string;
   refreshToken: string;
@@ -8,7 +10,11 @@ export type SsoProvider = 'oidc' | 'saml2';
 export interface ExternalTokenCredentials {
   provider: SsoProvider;
   externalToken: string;
-  departmentCode: string;
+  /**
+   * The department, as the system-encrypted token SSO discovery returns (or the SAML relay's callback carries). The
+   * server reads this or a department code, never a username.
+   */
+  departmentToken: string;
   /** Current authenticator (TOTP) code; required when the account has 2FA enabled. */
   otpCode?: string;
 }
@@ -38,6 +44,13 @@ export interface LoginResponse {
   mfaRequired?: boolean;
   /** A code was supplied but rejected (error invalid_totp). */
   invalidOtp?: boolean;
+  /**
+   * The sign-in continues on a login transaction (passkey plan section 7.5): the password was right and a second factor,
+   * or setting one up, finishes it. The secret is the only authority for that; it is held in memory and never logged.
+   */
+  mfaTransaction?: { secret: string; challenge: MfaChallenge };
+  /** The department requires MFA the account does not have, and this server cannot set it up in the app. */
+  enrollmentRequired?: boolean;
 }
 export interface ProfileModel {
   sub: string;
diff --git a/src/lib/checklists/__tests__/vault.test.ts b/src/lib/checklists/__tests__/vault.test.ts
index cc578b0b..2e5043b1 100644
--- a/src/lib/checklists/__tests__/vault.test.ts
+++ b/src/lib/checklists/__tests__/vault.test.ts
@@ -1,31 +1,73 @@
-const mockDisk = new Map<string,string>();
-const mockKeys = new Map<string,string>();
-jest.mock('react-native', () => ({ Platform:{OS:'ios'} }));
-jest.mock('react-native-mmkv', () => ({ MMKV:jest.fn().mockImplementation(()=>({getString:(k:string)=>mockDisk.get(k),set:(k:string,v:string)=>mockDisk.set(k,v),delete:(k:string)=>mockDisk.delete(k)})) }));
-jest.mock('expo-secure-store', () => ({ WHEN_UNLOCKED_THIS_DEVICE_ONLY:'device-only',getItemAsync:jest.fn(async(k:string)=>mockKeys.get(k)??null),setItemAsync:jest.fn(async(k:string,v:string)=>{mockKeys.set(k,v);}) }));
+const mockDisk = new Map<string, string>();
+const mockKeys = new Map<string, string>();
+jest.mock('react-native', () => ({ Platform: { OS: 'ios' } }));
+jest.mock('react-native-mmkv', () => ({
+  MMKV: jest.fn().mockImplementation(() => ({ getString: (k: string) => mockDisk.get(k), set: (k: string, v: string) => mockDisk.set(k, v), delete: (k: string) => mockDisk.delete(k) })),
+}));
+jest.mock('expo-secure-store', () => ({
+  WHEN_UNLOCKED_THIS_DEVICE_ONLY: 'device-only',
+  getItemAsync: jest.fn(async (k: string) => mockKeys.get(k) ?? null),
+  setItemAsync: jest.fn(async (k: string, v: string) => {
+    mockKeys.set(k, v);
+  }),
+}));
 // Exercise authenticated encryption and AAD with Node's crypto, standing in for the native Expo module.
-jest.mock('expo-crypto',()=>{
-  const crypto=jest.requireActual<typeof import('crypto')>('crypto');
-  const bytes=(v:string|Uint8Array)=>typeof v==='string'?Buffer.from(v,'base64'):Buffer.from(v);
-  return { CryptoDigestAlgorithm:{SHA256:'sha256'},digestStringAsync:async(_:string,s:string)=>crypto.createHash('sha256').update(s).digest('hex'),
-    AESEncryptionKey:{generate:async()=>{const b=crypto.randomBytes(32);return {b,encoded:async()=>b.toString('base64')};},import:async(s:string)=>({b:Buffer.from(s,'base64')})},
-    AESSealedData:{fromCombined:bytes},
-    aesEncryptAsync:async(data:Uint8Array,key:{b:Buffer},options:{additionalData:Uint8Array})=>{ const iv=crypto.randomBytes(12);const cipher=crypto.createCipheriv('aes-256-gcm',key.b,iv);cipher.setAAD(bytes(options.additionalData));const payload=Buffer.concat([iv,cipher.update(bytes(data)),cipher.final(),cipher.getAuthTag()]);return {combined:async()=>payload.toString('base64')}; },
-    aesDecryptAsync:async(data:Uint8Array,key:{b:Buffer},options:{additionalData:Uint8Array})=>{ const payload=bytes(data);const decipher=crypto.createDecipheriv('aes-256-gcm',key.b,payload.subarray(0,12));decipher.setAAD(bytes(options.additionalData));decipher.setAuthTag(payload.subarray(-16));return Buffer.concat([decipher.update(payload.subarray(12,-16)),decipher.final()]); },
+jest.mock('expo-crypto', () => {
+  const crypto = jest.requireActual<typeof import('crypto')>('crypto');
+  const bytes = (v: string | Uint8Array) => {
+    // Match Expo's native boundary: a Buffer has an unsupported constructor name.
+    if (Buffer.isBuffer(v)) throw new Error('Native bridge cannot accept Buffer');
+    return typeof v === 'string' ? Buffer.from(v, 'base64') : Buffer.from(v);
+  };
+  return {
+    CryptoDigestAlgorithm: { SHA256: 'sha256' },
+    digestStringAsync: async (_: string, s: string) => crypto.createHash('sha256').update(s).digest('hex'),
+    AESEncryptionKey: {
+      generate: async () => {
+        const b = crypto.randomBytes(32);
+        return { b, encoded: async () => b.toString('base64') };
+      },
+      import: async (s: string) => ({ b: Buffer.from(s, 'base64') }),
+    },
+    AESSealedData: { fromCombined: (v: string) => new Uint8Array(bytes(v)) },
+    aesEncryptAsync: async (data: string | Uint8Array, key: { b: Buffer }, options: { additionalData: string | Uint8Array }) => {
+      const iv = crypto.randomBytes(12);
+      const cipher = crypto.createCipheriv('aes-256-gcm', key.b, iv);
+      cipher.setAAD(bytes(options.additionalData));
+      const payload = Buffer.concat([iv, cipher.update(bytes(data)), cipher.final(), cipher.getAuthTag()]);
+      return { combined: async () => payload.toString('base64') };
+    },
+    aesDecryptAsync: async (data: string | Uint8Array, key: { b: Buffer }, options: { additionalData: string | Uint8Array }) => {
+      const payload = bytes(data);
+      const decipher = crypto.createDecipheriv('aes-256-gcm', key.b, payload.subarray(0, 12));
+      decipher.setAAD(bytes(options.additionalData));
+      decipher.setAuthTag(payload.subarray(-16));
+      return Buffer.concat([decipher.update(payload.subarray(12, -16)), decipher.final()]);
+    },
   };
 });
 import * as SecureStore from 'expo-secure-store';
-import { vaultRead,vaultWrite } from '@/lib/checklists/vault';
+import { vaultRead, vaultWrite } from '@/lib/checklists/vault';
 
-it('persists only ciphertext, isolates tenants and uses a device-only OS key',async()=>{
-  await vaultWrite('server|77|author','draft',{notes:'SYNTHETIC PHI',image:'synthetic-base64'});
-  expect([...mockDisk.values()].join()).not.toContain('SYNTHETIC PHI');expect([...mockDisk.values()].join()).not.toContain('synthetic-base64');
-  expect(await vaultRead('server|77|author','draft')).toEqual({notes:'SYNTHETIC PHI',image:'synthetic-base64'});
-  expect(await vaultRead('server|88|author','draft')).toBeNull();
-  expect(SecureStore.setItemAsync).toHaveBeenCalledWith(expect.any(String),expect.any(String),{keychainAccessible:'device-only'});
+it('persists only ciphertext, isolates tenants and uses a device-only OS key', async () => {
+  await vaultWrite('server|77|author', 'draft', { notes: 'SYNTHETIC PHI', image: 'synthetic-base64' });
+  expect([...mockDisk.values()].join()).not.toContain('SYNTHETIC PHI');
+  expect([...mockDisk.values()].join()).not.toContain('synthetic-base64');
+  expect(await vaultRead('server|77|author', 'draft')).toEqual({ notes: 'SYNTHETIC PHI', image: 'synthetic-base64' });
+  expect(await vaultRead('server|88|author', 'draft')).toBeNull();
+  expect(SecureStore.setItemAsync).toHaveBeenCalledWith(expect.any(String), expect.any(String), { keychainAccessible: 'device-only' });
+});
+it('refuses tampered or relocated ciphertext without a plaintext fallback', async () => {
+  await vaultWrite('tamper-scope', 'first', { notes: 'private' });
+  const first = [...mockDisk.entries()].at(-1)!;
+  await vaultWrite('tamper-scope', 'second', { notes: 'second' });
+  const second = [...mockDisk.entries()].at(-1)!;
+  mockDisk.set(second[0], first[1]);
+  await expect(vaultRead('tamper-scope', 'second')).rejects.toThrow();
 });
-it('refuses tampered or relocated ciphertext without a plaintext fallback',async()=>{
-  await vaultWrite('tamper-scope','first',{notes:'private'});const first=[...mockDisk.entries()].at(-1)!;
-  await vaultWrite('tamper-scope','second',{notes:'second'});const second=[...mockDisk.entries()].at(-1)!;
-  mockDisk.set(second[0],first[1]);await expect(vaultRead('tamper-scope','second')).rejects.toThrow();
+
+it('round-trips Unicode and binary evidence through bridge-safe inputs', async () => {
+  const content = { notes: '点検済み 🚒 café', image: Buffer.from([0, 127, 128, 255]).toString('base64') };
+  await vaultWrite('server|77|author', 'draft:点検', content);
+  expect(await vaultRead('server|77|author', 'draft:点検')).toEqual(content);
 });
diff --git a/src/lib/checklists/vault.ts b/src/lib/checklists/vault.ts
index 8554c148..3d73f873 100644
--- a/src/lib/checklists/vault.ts
+++ b/src/lib/checklists/vault.ts
@@ -36,13 +36,15 @@ export const vaultRead = async <T>(scope: string, name: string): Promise<T | nul
   const id = await slot(scope, name);
   const ciphertext = native ? storage?.getString(id) : memory.get(id);
   if (!ciphertext) return null;
-  const bytes = await aesDecryptAsync(AESSealedData.fromCombined(ciphertext), await keyFor(scope), { additionalData: Buffer.from(`${scope}:${name}`, 'utf8') });
+  const bytes = await aesDecryptAsync(AESSealedData.fromCombined(ciphertext), await keyFor(scope), { additionalData: Buffer.from(`${scope}:${name}`, 'utf8').toString('base64') });
   return JSON.parse(Buffer.from(bytes).toString('utf8')) as T;
 };
 export const vaultWrite = async (scope: string, name: string, value: unknown): Promise<void> => {
   const plaintext = Buffer.from(JSON.stringify(value), 'utf8');
   if (plaintext.byteLength > 32 * 1024 * 1024) throw new Error('storage_full');
-  const ciphertext = await aesEncryptAsync(plaintext, await keyFor(scope), { additionalData: Buffer.from(`${scope}:${name}`, 'utf8') });
+  // Expo's iOS typed-array bridge cannot identify the Buffer subclass and can trap
+  // before returning a JS error. Its base64 input path preserves the same bytes.
+  const ciphertext = await aesEncryptAsync(plaintext.toString('base64'), await keyFor(scope), { additionalData: Buffer.from(`${scope}:${name}`, 'utf8').toString('base64') });
   const id = await slot(scope, name);
   const text = await ciphertext.combined('base64');
   if (native) storage!.set(id, text);
diff --git a/src/lib/date-time-picker.ts b/src/lib/date-time-picker.ts
new file mode 100644
index 00000000..d4cb2ea9
--- /dev/null
+++ b/src/lib/date-time-picker.ts
@@ -0,0 +1,31 @@
+export type PickerMode = 'date' | 'time' | 'datetime';
+
+const pad = (value: number) => String(value).padStart(2, '0');
+export const pickerDate = (date: Date) => `${String(date.getFullYear()).padStart(4, '0')}-${pad(date.getMonth() + 1)}-${pad(date.getDate())}`;
+export const pickerTime = (date: Date) => `${pad(date.getHours())}:${pad(date.getMinutes())}`;
+
+// Calendar dates and deployment clock times are local values, never UTC instants.
+export const parsePickerValue = (value: string, mode: PickerMode, now = new Date()): Date => {
+  if (mode === 'datetime' && value) {
+    // Record timestamps without an offset are UTC in the API contract.
+    const parsed = new Date(/(?:Z|[+-]\d{2}:\d{2})$/i.test(value) ? value : `${value}Z`);
+    if (!Number.isNaN(parsed.getTime())) return parsed;
+  }
+  const date = new Date(now);
+  // A standalone clock is independent of today's daylight-saving transition.
+  if (mode === 'time') date.setFullYear(2000, 0, 15);
+  if (mode === 'date' && /^\d{4}-\d{2}-\d{2}$/.test(value)) {
+    const [year, month, day] = value.split('-').map(Number);
+    date.setHours(12, 0, 0, 0);
+    date.setFullYear(year, month - 1, day);
+    if (pickerDate(date) === value) return date;
+    return new Date(now);
+  }
+  if (mode === 'time' && /^([01]\d|2[0-3]):[0-5]\d$/.test(value)) {
+    const [hour, minute] = value.split(':').map(Number);
+    date.setHours(hour, minute, 0, 0);
+  }
+  return date;
+};
+
+export const serializePickerValue = (date: Date, mode: PickerMode) => (mode === 'date' ? pickerDate(date) : mode === 'time' ? pickerTime(date) : date.toISOString());
diff --git a/src/lib/map-style.ts b/src/lib/map-style.ts
new file mode 100644
index 00000000..008810a4
--- /dev/null
+++ b/src/lib/map-style.ts
@@ -0,0 +1,67 @@
+import { useColorScheme } from 'nativewind';
+
+import { getMapboxAccessToken, useMapboxAccessToken } from '@/lib/mapbox-token';
+import { useCoreStore } from '@/stores/app/core-store';
+
+/**
+ * The department's Mapbox base map.
+ *
+ * Departments pick a day style and a night style on the web Mapping Settings screen (Streets,
+ * Outdoors, Light, Dark, Satellite, Satellite Streets, Navigation Day/Night, or one of the Mapbox
+ * gallery's community styles), or use their own Mapbox account's custom style. The server resolves both, including the "Automatic" pairing, and ships them
+ * in config as mapbox:// urls. Every base map in the app renders through here, so the choice reaches
+ * every map, and the device's dark mode switches to the night style.
+ *
+ * The fallbacks cover only the window before config loads and servers that predate the setting. They
+ * are the same Streets / Dark pair the server sends for a department that has not chosen, so a map that
+ * renders during bootstrap does not visibly change style a moment later.
+ */
+
+export const FALLBACK_DAY_MAP_STYLE = 'mapbox://styles/mapbox/streets-v12';
+export const FALLBACK_NIGHT_MAP_STYLE = 'mapbox://styles/mapbox/dark-v11';
+
+interface MapStyleConfig {
+  MapDayStyleUrl?: string | null;
+  MapNightStyleUrl?: string | null;
+  AppMapboxAccessToken?: string | null;
+  IsDepartmentMapOverride?: boolean | null;
+}
+
+/** Only a mapbox:// style can load on the app's own token; anything else falls back. */
+const toMapboxStyle = (value: string | null | undefined, fallback: string): string => {
+  const trimmed = typeof value === 'string' ? value.trim() : '';
+
+  return trimmed.startsWith('mapbox://styles/') ? trimmed : fallback;
+};
+
+export const resolveDepartmentMapStyle = (config: MapStyleConfig | null | undefined, colorScheme: string | null | undefined, activeToken?: string | null): string => {
+  const isDark = colorScheme === 'dark';
+  const fallback = isDark ? FALLBACK_NIGHT_MAP_STYLE : FALLBACK_DAY_MAP_STYLE;
+  const style = toMapboxStyle(isDark ? config?.MapNightStyleUrl : config?.MapDayStyleUrl, fallback);
+
+  if (config?.IsDepartmentMapOverride === true) {
+    // The department's own Mapbox account: its custom style only loads on its own token. Until that token
+    // has been checked and is the one in use, a map asking for the style would come back blank, so show
+    // the default until the token switch lands. Every other style the server sends (Mapbox's own and the
+    // gallery's community styles) is public and loads on any token, the built-in one included.
+    const serverToken = typeof config?.AppMapboxAccessToken === 'string' ? config.AppMapboxAccessToken.trim() : '';
+
+    if (!serverToken || (activeToken ?? '').trim() !== serverToken) {
+      return fallback;
+    }
+  }
+
+  return style;
+};
+
+/** Reactive: re-renders when config lands, the device theme flips or the Mapbox token changes. */
+export const useDepartmentMapStyle = (): string => {
+  const { colorScheme } = useColorScheme();
+  const config = useCoreStore((state) => state.config);
+  const activeToken = useMapboxAccessToken();
+
+  return resolveDepartmentMapStyle(config, colorScheme, activeToken);
+};
+
+/** Non-reactive read for imperative paths (map construction inside effects). */
+export const getDepartmentMapStyle = (colorScheme: string | null | undefined): string => resolveDepartmentMapStyle(useCoreStore.getState().config, colorScheme, getMapboxAccessToken());
diff --git a/src/lib/mapbox-built-in-token.ts b/src/lib/mapbox-built-in-token.ts
new file mode 100644
index 00000000..44387af5
--- /dev/null
+++ b/src/lib/mapbox-built-in-token.ts
@@ -0,0 +1,4 @@
+import { Env } from '@/lib/env';
+
+/** The Mapbox token built into this app; used whenever the server has not supplied a verified one. */
+export const MAPBOX_BUILT_IN_TOKEN: string = Env.RESPOND_MAPBOX_PUBKEY ?? '';
diff --git a/src/lib/mapbox-token.ts b/src/lib/mapbox-token.ts
new file mode 100644
index 00000000..009d70c6
--- /dev/null
+++ b/src/lib/mapbox-token.ts
@@ -0,0 +1,140 @@
+import { create } from 'zustand';
+import { createJSONStorage, persist } from 'zustand/middleware';
+
+import { MAPBOX_BUILT_IN_TOKEN } from '@/lib/mapbox-built-in-token';
+import { zustandStorage } from '@/lib/storage';
+
+/**
+ * Which Mapbox token the app renders maps and calls Mapbox services (directions, geocoding, static
+ * images) with.
+ *
+ * The server hands out a public token in config (`AppMapboxAccessToken`): the department's own token
+ * when its Mapbox override is on, otherwise the token the installation configures for this app. A token
+ * the server sends is checked with Mapbox once, kept on the device, and used from then on, so a token
+ * can be rotated without an app release. Whenever the server sends none, or Mapbox says the token is
+ * invalid, expired or revoked, the app goes back to the token built into it.
+ *
+ * Storage is synchronous (MMKV), so the stored token is already in place when modules that call the
+ * Mapbox SDK at import time read it.
+ */
+
+/** Public tokens only: "pk." plus a base64url payload and signature. Secret (sk.) tokens never qualify. */
+const PUBLIC_TOKEN_PATTERN = /^pk\.[A-Za-z0-9_=-]+\.[A-Za-z0-9_=-]+$/;
+
+/** A token in use is re-checked this often; a rejected token is not re-checked sooner than this. */
+export const MAPBOX_TOKEN_RECHECK_MS = 24 * 60 * 60 * 1000;
+
+const MAPBOX_TOKEN_CHECK_URL = 'https://api.mapbox.com/tokens/v2';
+
+interface MapboxTokenState {
+  /** Server token that Mapbox confirmed valid; null = use the built-in token. */
+  token: string | null;
+  verifiedAt: number | null;
+  /** Last server token Mapbox refused, so it is not re-checked on every config load. */
+  rejectedToken: string | null;
+  rejectedAt: number | null;
+}
+
+const EMPTY_STATE: MapboxTokenState = { token: null, verifiedAt: null, rejectedToken: null, rejectedAt: null };
+
+export const useMapboxTokenStore = create<MapboxTokenState>()(
+  persist(() => ({ ...EMPTY_STATE }), {
+    name: 'mapbox-token-storage',
+    storage: createJSONStorage(() => zustandStorage),
+  })
+);
+
+export const isUsableMapboxToken = (value: string | null | undefined): value is string => typeof value === 'string' && PUBLIC_TOKEN_PATTERN.test(value.trim());
+
+export const getBuiltInMapboxToken = (): string => (typeof MAPBOX_BUILT_IN_TOKEN === 'string' ? MAPBOX_BUILT_IN_TOKEN.trim() : '');
+
+const resolveToken = (stored: string | null | undefined): string => (isUsableMapboxToken(stored) ? stored.trim() : getBuiltInMapboxToken());
+
+/** Non-reactive: the token to use right now (stored server token, else built-in). */
+export const getMapboxAccessToken = (): string => resolveToken(useMapboxTokenStore.getState().token);
+
+/** Reactive: re-renders when the token in use changes. */
+export const useMapboxAccessToken = (): string => useMapboxTokenStore((state) => resolveToken(state.token));
+
+/**
+ * Calls `listener` with the token in use now and again whenever it changes. Store listeners run
+ * synchronously inside the state change, before React re-renders, so an SDK token set here is in place
+ * before any map re-renders with a style that needs it.
+ */
+export const onMapboxAccessTokenChange = (listener: (token: string) => void): (() => void) => {
+  listener(getMapboxAccessToken());
+
+  return useMapboxTokenStore.subscribe((state, previous) => {
+    const next = resolveToken(state.token);
+
+    if (next !== resolveToken(previous.token)) {
+      listener(next);
+    }
+  });
+};
+
+export type MapboxTokenVerdict = 'valid' | 'invalid' | 'unknown';
+
+const REFUSED_CODES = ['TokenInvalid', 'TokenExpired', 'TokenRevoked', 'TokenMalformed'];
+
+/** Asks Mapbox whether a token works. Network trouble is 'unknown', never 'invalid'. */
+export const verifyMapboxToken = async (token: string): Promise<MapboxTokenVerdict> => {
+  try {
+    const response = await fetch(`${MAPBOX_TOKEN_CHECK_URL}?access_token=${encodeURIComponent(token)}`);
+    const body = (await response.json().catch(() => null)) as { code?: string } | null;
+
+    if (body?.code === 'TokenValid') {
+      return 'valid';
+    }
+
+    if (body?.code && REFUSED_CODES.includes(body.code)) {
+      return 'invalid';
+    }
+
+    return 'unknown';
+  } catch {
+    return 'unknown';
+  }
+};
+
+/**
+ * Applies the token from a successful config load. Call it only when config actually arrived: an
+ * empty or missing token (an older server, or none configured) drops back to the built-in token.
+ */
+export const applyServerMapboxToken = async (serverToken: string | null | undefined, now: number = Date.now()): Promise<void> => {
+  const candidate = typeof serverToken === 'string' ? serverToken.trim() : '';
+  const state = useMapboxTokenStore.getState();
+
+  if (!isUsableMapboxToken(candidate)) {
+    if (state.token !== null) {
+      useMapboxTokenStore.setState({ token: null, verifiedAt: null });
+    }
+    return;
+  }
+
+  if (candidate === state.token && state.verifiedAt !== null && now - state.verifiedAt < MAPBOX_TOKEN_RECHECK_MS) {
+    return;
+  }
+
+  if (candidate === state.rejectedToken && state.rejectedAt !== null && now - state.rejectedAt < MAPBOX_TOKEN_RECHECK_MS) {
+    // Refused recently. The server is still sending it, so the stored token (if any) is stale too.
+    if (state.token !== null) {
+      useMapboxTokenStore.setState({ token: null, verifiedAt: null });
+    }
+    return;
+  }
+
+  const verdict = await verifyMapboxToken(candidate);
+
+  if (verdict === 'valid') {
+    useMapboxTokenStore.setState({ token: candidate, verifiedAt: Date.now(), rejectedToken: null, rejectedAt: null });
+  } else if (verdict === 'invalid') {
+    useMapboxTokenStore.setState({ token: null, verifiedAt: null, rejectedToken: candidate, rejectedAt: Date.now() });
+  }
+  // 'unknown' (offline, Mapbox unreachable): keep whatever is in use and try again on the next config load.
+};
+
+/** Forget the server token (sign-out, server switch); the built-in token is used until config loads again. */
+export const clearMapboxToken = (): void => {
+  useMapboxTokenStore.setState({ ...EMPTY_STATE });
+};
diff --git a/src/lib/mfa/__tests__/approval-wait.test.ts b/src/lib/mfa/__tests__/approval-wait.test.ts
new file mode 100644
index 00000000..0ae44398
--- /dev/null
+++ b/src/lib/mfa/__tests__/approval-wait.test.ts
@@ -0,0 +1,48 @@
+import { waitForApproval } from '../approval-wait';
+
+describe('waitForApproval', () => {
+  // The app's Jest setup fakes timers; the 1 ms polling interval here runs on real ones.
+  beforeEach(() => jest.useRealTimers());
+  afterEach(() => jest.useFakeTimers());
+
+  it('polls until the request is decided', async () => {
+    const status = jest
+      .fn()
+      .mockResolvedValueOnce({ State: 'pending', ExpiresAt: null })
+      .mockResolvedValueOnce({ State: 'pending', ExpiresAt: null })
+      .mockResolvedValueOnce({ State: 'approved', ExpiresAt: null });
+
+    await expect(waitForApproval(status, undefined, 1)).resolves.toBe('approved');
+    expect(status).toHaveBeenCalledTimes(3);
+  });
+
+  it('stops for a denial, an expiry, an abort, or a server it cannot reach', async () => {
+    await expect(waitForApproval(jest.fn().mockResolvedValue({ State: 'denied', ExpiresAt: null }), undefined, 1)).resolves.toBe('denied');
+    await expect(waitForApproval(jest.fn().mockResolvedValue({ State: 'expired', ExpiresAt: null }), undefined, 1)).resolves.toBe('expired');
+    await expect(waitForApproval(jest.fn().mockRejectedValue(new Error('offline')), undefined, 1)).resolves.toBe('unavailable');
+
+    const controller = new AbortController();
+    const status = jest.fn().mockImplementation(async () => {
+      controller.abort();
+      return { State: 'pending', ExpiresAt: null };
+    });
+    await expect(waitForApproval(status, controller.signal, 1)).resolves.toBe('aborted');
+    expect(status).toHaveBeenCalledTimes(1);
+  });
+
+  it('leaves no abort listener behind on the signal after each poll', async () => {
+    const controller = new AbortController();
+    const add = jest.spyOn(controller.signal, 'addEventListener');
+    const remove = jest.spyOn(controller.signal, 'removeEventListener');
+    const status = jest
+      .fn()
+      .mockResolvedValueOnce({ State: 'pending', ExpiresAt: null })
+      .mockResolvedValueOnce({ State: 'pending', ExpiresAt: null })
+      .mockResolvedValueOnce({ State: 'approved', ExpiresAt: null });
+
+    await expect(waitForApproval(status, controller.signal, 1)).resolves.toBe('approved');
+    expect(add).toHaveBeenCalledTimes(2);
+    expect(remove).toHaveBeenCalledTimes(2);
+    expect(remove.mock.calls.map(([, listener]) => listener)).toEqual(add.mock.calls.map(([, listener]) => listener));
+  });
+});
diff --git a/src/lib/mfa/__tests__/helpers.test.ts b/src/lib/mfa/__tests__/helpers.test.ts
new file mode 100644
index 00000000..db43dc72
--- /dev/null
+++ b/src/lib/mfa/__tests__/helpers.test.ts
@@ -0,0 +1,69 @@
+import { headerSafe } from '../client-app';
+import { endsTransaction, toMfaProblem } from '../errors';
+import { isMfaErrorCode, mfaErrorKey } from '../messages';
+import { parseMethods, parseUtc } from '../types';
+
+describe('parseMethods', () => {
+  it('reads the token endpoint string and the Sso/Redeem array alike, dropping unknown names', () => {
+    expect(parseMethods('totp passkey  passkey_approval federated')).toEqual(['totp', 'passkey', 'passkey_approval', 'federated']);
+    expect(parseMethods(['passkey', 'sms', 'totp'])).toEqual(['passkey', 'totp']);
+    expect(parseMethods(undefined)).toEqual([]);
+    expect(parseMethods(42)).toEqual([]);
+  });
+});
+
+describe('parseUtc', () => {
+  it('reads a zoneless server time as UTC and keeps an explicit zone', () => {
+    expect(parseUtc('2026-09-29T12:00:00.0000000')).toBe(Date.parse('2026-09-29T12:00:00Z'));
+    expect(parseUtc('2026-09-29T12:00:00Z')).toBe(Date.parse('2026-09-29T12:00:00Z'));
+    expect(parseUtc('2026-09-29T12:00:00+02:00')).toBe(Date.parse('2026-09-29T10:00:00Z'));
+    expect(parseUtc(null)).toBeNull();
+    expect(parseUtc('not a date')).toBeNull();
+  });
+});
+
+describe('toMfaProblem', () => {
+  it('prefers the ProblemDetails type, then the OAuth error, and keeps a lock version', () => {
+    expect(toMfaProblem({ response: { status: 401, data: { type: 'invalid_totp', title: 'x' } } })).toEqual({ code: 'invalid_totp', status: 401 });
+    expect(toMfaProblem({ response: { status: 400, data: { error: 'mfa_transaction_expired' } } })).toEqual({ code: 'mfa_transaction_expired', status: 400 });
+    expect(toMfaProblem({ response: { status: 401, data: { error: 'shared_session_locked', lock_version: 7 } } })).toEqual({
+      code: 'shared_session_locked',
+      status: 401,
+      lockVersion: 7,
+    });
+  });
+
+  it('treats a missing response as a network problem and an unreadable body as unknown', () => {
+    expect(toMfaProblem(new Error('Network Error'))).toEqual({ code: 'network_error', status: null });
+    expect(toMfaProblem({ response: { status: 500, data: 'oops' } })).toEqual({ code: 'unknown_error', status: 500 });
+  });
+
+  it('ends the sign-in only for the codes that cannot be retried', () => {
+    for (const code of ['mfa_transaction_invalid', 'mfa_transaction_expired', 'too_many_attempts', 'policy_changed', 'session_revoked']) {
+      expect(endsTransaction({ code, status: 400 })).toBe(true);
+    }
+    for (const code of ['invalid_totp', 'passkey_verification_failed', 'approval_denied', 'network_error']) {
+      expect(endsTransaction({ code, status: 400 })).toBe(false);
+    }
+  });
+});
+
+describe('mfaErrorKey', () => {
+  it('names known codes and falls back for anything else, never showing a raw code', () => {
+    expect(mfaErrorKey('invalid_totp')).toBe('mfa.errors.invalid_totp');
+    expect(mfaErrorKey('something_new')).toBe('mfa.errors.unknown_error');
+    expect(mfaErrorKey(null)).toBe('mfa.errors.unknown_error');
+    expect(isMfaErrorCode('policy_changed')).toBe(true);
+    expect(isMfaErrorCode('Network request failed')).toBe(false);
+  });
+});
+
+describe('headerSafe', () => {
+  it('keeps a label printable, trimmed and bounded, so the HTTP stack can send it', () => {
+    expect(headerSafe('  Engine 7 iPad  ')).toBe('Engine 7 iPad');
+    expect(headerSafe('Shawn’s iPhone 🚒')).toBe('Shawns iPhone');
+    expect(headerSafe('x'.repeat(100))).toHaveLength(64);
+    expect(headerSafe('🚒')).toBeNull();
+    expect(headerSafe(null)).toBeNull();
+  });
+});
diff --git a/src/lib/mfa/__tests__/passkey.test.ts b/src/lib/mfa/__tests__/passkey.test.ts
new file mode 100644
index 00000000..41427bd7
--- /dev/null
+++ b/src/lib/mfa/__tests__/passkey.test.ts
@@ -0,0 +1,64 @@
+import { Passkey } from 'react-native-passkey';
+
+import { createPasskeyCredential, getPasskeyAssertion, passkeysSupported } from '../passkey';
+import { PasskeyCeremonyError } from '../passkey-errors';
+
+const passkey = Passkey as unknown as { isSupported: jest.Mock; get: jest.Mock; create: jest.Mock };
+
+describe('native passkeys', () => {
+  beforeEach(() => jest.clearAllMocks());
+
+  it('hands the server its own options and returns the assertion as WebAuthn JSON', async () => {
+    const options = { challenge: 'abc', rpId: 'responder.resgrid.com', allowCredentials: [{ id: 'cred', type: 'public-key' }] };
+    passkey.get.mockResolvedValue({
+      id: 'cred',
+      rawId: 'cred',
+      type: 'public-key',
+      response: { authenticatorData: 'ad', clientDataJSON: 'cd', signature: 'sig', userHandle: 'uh' },
+    });
+
+    const credential = await getPasskeyAssertion(options);
+
+    expect(passkey.get).toHaveBeenCalledWith(options);
+    expect(credential).toEqual({
+      id: 'cred',
+      rawId: 'cred',
+      type: 'public-key',
+      authenticatorAttachment: null,
+      response: { authenticatorData: 'ad', clientDataJSON: 'cd', signature: 'sig', userHandle: 'uh' },
+      clientExtensionResults: {},
+    });
+  });
+
+  it('returns a new credential as WebAuthn JSON', async () => {
+    passkey.create.mockResolvedValue({ id: 'new', rawId: 'new', response: { clientDataJSON: 'cd', attestationObject: 'ao' } });
+    expect(await createPasskeyCredential({ challenge: 'abc' })).toMatchObject({
+      id: 'new',
+      type: 'public-key',
+      response: { clientDataJSON: 'cd', attestationObject: 'ao', transports: [] },
+    });
+  });
+
+  it('reports a closed prompt as cancelled, never as a failed signature', async () => {
+    for (const [native, reason] of [
+      ['UserCancelled', 'cancelled'],
+      ['Interrupted', 'cancelled'],
+      ['NotSupported', 'not_supported'],
+      ['BadConfiguration', 'not_supported'],
+      ['NoCredentials', 'no_credentials'],
+      ['RequestFailed', 'failed'],
+    ] as const) {
+      passkey.get.mockRejectedValueOnce({ error: native, message: native });
+      await expect(getPasskeyAssertion({ challenge: 'abc' })).rejects.toEqual(new PasskeyCeremonyError(reason));
+    }
+  });
+
+  it('is unsupported when the platform says so or the module is missing', () => {
+    passkey.isSupported.mockReturnValueOnce(false);
+    expect(passkeysSupported()).toBe(false);
+    passkey.isSupported.mockImplementationOnce(() => {
+      throw new Error('no native module');
+    });
+    expect(passkeysSupported()).toBe(false);
+  });
+});
diff --git a/src/lib/mfa/__tests__/sso-browser.test.ts b/src/lib/mfa/__tests__/sso-browser.test.ts
new file mode 100644
index 00000000..0c2c51bd
--- /dev/null
+++ b/src/lib/mfa/__tests__/sso-browser.test.ts
@@ -0,0 +1,157 @@
+import { createHash } from 'crypto';
+import * as WebBrowser from 'expo-web-browser';
+
+import { parseSsoReturn, runSsoRoundTrip, ssoPlatform, ssoReturnTarget } from '../sso-browser';
+
+jest.mock('expo-web-browser', () => ({ openAuthSessionAsync: jest.fn(), maybeCompleteAuthSession: jest.fn() }));
+
+const openAuthSession = WebBrowser.openAuthSessionAsync as jest.Mock;
+const begun = { AuthorizeUrl: 'https://idp.example/authorize', SsoTransactionId: 'sso-1', ExpiresIn: 600 };
+const base64Url = (buffer: Buffer) => buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+
+describe('parseSsoReturn', () => {
+  it('reads the one-time code, the state and an error from the return address', () => {
+    expect(parseSsoReturn('resgrid://sso-return?sso_code=abc&state=s1')).toEqual({ ssoCode: 'abc', state: 's1', error: undefined });
+    expect(parseSsoReturn('resgrid://sso-return?error=access_denied&state=s1#x')).toEqual({ ssoCode: undefined, state: 's1', error: 'access_denied' });
+    expect(parseSsoReturn('resgrid://sso-return')).toEqual({ ssoCode: undefined, state: undefined, error: undefined });
+  });
+});
+
+describe('runSsoRoundTrip', () => {
+  beforeEach(() => openAuthSession.mockReset());
+
+  it('sends only the S256 challenge, returns to the registered target, and keeps the verifier for redemption', async () => {
+    let sent: { state: string; codeChallenge: string; returnTarget: string } | null = null;
+    openAuthSession.mockImplementation(async () => ({ type: 'success', url: `resgrid://sso-return?sso_code=code-1&state=${sent!.state}` }));
+
+    const result = await runSsoRoundTrip(async (secrets) => {
+      sent = secrets;
+      return begun;
+    });
+
+    expect(sent!.returnTarget).toBe(ssoReturnTarget());
+    expect(ssoReturnTarget()).toBe('resgrid://sso-return');
+    expect(openAuthSession).toHaveBeenCalledWith(begun.AuthorizeUrl, 'resgrid://sso-return', { preferEphemeralSession: false });
+    expect(result.ok).toBe(true);
+    if (result.ok) {
+      expect(result.trip.ssoTransactionId).toBe('sso-1');
+      expect(result.trip.ssoCode).toBe('code-1');
+      expect(result.trip.codeVerifier).toHaveLength(43);
+      expect(base64Url(createHash('sha256').update(result.trip.codeVerifier).digest())).toBe(sent!.codeChallenge);
+      expect(result.trip.codeVerifier).not.toBe(sent!.codeChallenge);
+    }
+  });
+
+  it('refuses a return that is not this round trip, and reports the provider refusing or the member closing it', async () => {
+    openAuthSession.mockResolvedValueOnce({ type: 'success', url: 'resgrid://sso-return?sso_code=code-1&state=someone-else' });
+    expect(await runSsoRoundTrip(async () => begun)).toEqual({ ok: false, reason: 'state_mismatch' });
+
+    let state = '';
+    openAuthSession.mockImplementationOnce(async () => ({ type: 'success', url: `resgrid://sso-return?error=access_denied&state=${state}` }));
+    expect(
+      await runSsoRoundTrip(async (secrets) => {
+        state = secrets.state;
+        return begun;
+      })
+    ).toEqual({ ok: false, reason: 'denied', code: 'access_denied' });
+
+    openAuthSession.mockResolvedValueOnce({ type: 'cancel' });
+    expect(await runSsoRoundTrip(async () => begun)).toEqual({ ok: false, reason: 'cancelled' });
+  });
+
+  it('opens nothing when the broker refuses to begin, and uses an ephemeral session when asked', async () => {
+    expect(await runSsoRoundTrip(async () => Promise.reject({ response: { status: 400, data: { type: 'sso_unavailable' } } }))).toEqual({
+      ok: false,
+      reason: 'refused',
+      code: 'sso_unavailable',
+    });
+    expect(openAuthSession).not.toHaveBeenCalled();
+
+    openAuthSession.mockResolvedValueOnce({ type: 'dismiss' });
+    await runSsoRoundTrip(async () => begun, true);
+    expect(openAuthSession).toHaveBeenCalledWith(begun.AuthorizeUrl, 'resgrid://sso-return', { preferEphemeralSession: true });
+  });
+
+  it('reports a browser that cannot open as a failed round trip instead of throwing', async () => {
+    openAuthSession.mockRejectedValueOnce(new Error('No matching browser activity found'));
+    await expect(runSsoRoundTrip(async () => begun)).resolves.toEqual({ ok: false, reason: 'failed' });
+  });
+});
+
+describe('runSsoRoundTrip in the desktop app', () => {
+  const bridge = {
+    ssoListen: jest.fn(async () => ({ id: 'trip-1', returnTarget: 'http://127.0.0.1:50123/sso-return' })),
+    ssoOpen: jest.fn(),
+    ssoCancel: jest.fn(async () => undefined),
+  };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    openAuthSession.mockReset();
+    (window as unknown as { electronAPI?: unknown }).electronAPI = { ...bridge, getPlatform: jest.fn() };
+  });
+
+  afterEach(() => {
+    delete (window as unknown as { electronAPI?: unknown }).electronAPI;
+  });
+
+  it('returns to a one-time loopback listener and opens the provider in the system browser', async () => {
+    let sent: { state: string; returnTarget: string; platform: string } | null = null;
+    bridge.ssoOpen.mockImplementation(async () => `http://127.0.0.1:50123/sso-return?sso_code=code-9&state=${sent!.state}`);
+
+    const result = await runSsoRoundTrip(async (secrets) => {
+      sent = secrets;
+      return begun;
+    });
+
+    expect(ssoPlatform()).toBe('electron');
+    expect(sent!.returnTarget).toBe('http://127.0.0.1:50123/sso-return');
+    expect(sent!.platform).toBe('electron');
+    expect(bridge.ssoOpen).toHaveBeenCalledWith('trip-1', begun.AuthorizeUrl);
+    expect(openAuthSession).not.toHaveBeenCalled();
+    expect(result).toMatchObject({ ok: true, trip: { ssoCode: 'code-9', ssoTransactionId: 'sso-1' } });
+  });
+
+  it('closes the listener when the broker refuses to begin', async () => {
+    const refusal = Object.assign(new Error('refused'), { response: { status: 400, data: { type: 'sso_unavailable' } } });
+
+    const result = await runSsoRoundTrip(async () => {
+      throw refusal;
+    });
+
+    expect(result).toEqual({ ok: false, reason: 'refused', code: 'sso_unavailable' });
+    expect(bridge.ssoCancel).toHaveBeenCalledWith('trip-1');
+    expect(bridge.ssoOpen).not.toHaveBeenCalled();
+  });
+
+  it('reports a listener that cannot start, or a browser that cannot open, as failed and closes the listener', async () => {
+    const begin = jest.fn(async () => begun);
+    bridge.ssoListen.mockRejectedValueOnce(new Error('EADDRINUSE'));
+    await expect(runSsoRoundTrip(begin)).resolves.toEqual({ ok: false, reason: 'failed' });
+    expect(begin).not.toHaveBeenCalled();
+    expect(bridge.ssoCancel).not.toHaveBeenCalled();
+
+    bridge.ssoOpen.mockRejectedValueOnce(new Error('openExternal failed'));
+    await expect(runSsoRoundTrip(begin)).resolves.toEqual({ ok: false, reason: 'failed' });
+    expect(bridge.ssoCancel).toHaveBeenCalledWith('trip-1');
+  });
+
+  it('reads a closed or timed-out listener as cancelled, and still checks the state', async () => {
+    bridge.ssoOpen.mockResolvedValueOnce(null);
+    expect(await runSsoRoundTrip(async () => begun)).toEqual({ ok: false, reason: 'cancelled' });
+
+    bridge.ssoOpen.mockResolvedValueOnce('http://127.0.0.1:50123/sso-return?sso_code=x&state=forged');
+    expect(await runSsoRoundTrip(async () => begun)).toEqual({ ok: false, reason: 'state_mismatch' });
+  });
+
+  it('ignores a partial bridge and uses the auth session', async () => {
+    (window as unknown as { electronAPI?: unknown }).electronAPI = { getPlatform: jest.fn(), ssoListen: bridge.ssoListen };
+    openAuthSession.mockResolvedValueOnce({ type: 'cancel' });
+
+    expect(ssoPlatform()).not.toBe('electron');
+    await runSsoRoundTrip(async () => begun);
+
+    expect(openAuthSession).toHaveBeenCalled();
+    expect(bridge.ssoListen).not.toHaveBeenCalled();
+  });
+});
diff --git a/src/lib/mfa/__tests__/transaction-api.test.ts b/src/lib/mfa/__tests__/transaction-api.test.ts
new file mode 100644
index 00000000..37afbce9
--- /dev/null
+++ b/src/lib/mfa/__tests__/transaction-api.test.ts
@@ -0,0 +1,44 @@
+const mockPost = jest.fn();
+let mockInterceptor: ((config: { headers: Record<string, string>; baseURL?: string }) => unknown) | null = null;
+
+jest.mock('@/lib/storage/app', () => ({ getBaseApiUrl: () => 'https://api.test/api/v4' }));
+jest.mock('axios', () => ({
+  __esModule: true,
+  default: {
+    create: jest.fn(() => ({
+      interceptors: { request: { use: (fn: typeof mockInterceptor) => (mockInterceptor = fn) } },
+      post: mockPost,
+    })),
+  },
+}));
+
+// Required after the mocks exist: the module creates its axios instance at load.
+const { completePasskey, completeTotp, requestLoginApproval, ssoBegin, ssoRedeem } = require('../transaction-api') as typeof import('../transaction-api');
+
+describe('sign-in transaction calls', () => {
+  beforeEach(() => mockPost.mockReset().mockResolvedValue({ data: { Data: { CompletionCode: 'c' } } }));
+
+  it('sends PascalCase bodies (snake_case never binds on the server) and returns the Data payload', async () => {
+    expect(await completeTotp('secret', '123456')).toEqual({ CompletionCode: 'c' });
+    expect(mockPost).toHaveBeenCalledWith('/Authentication/CompleteTotp', { Transaction: 'secret', Code: '123456' });
+
+    await completePasskey('secret', 'req-1', { id: 'cred' });
+    expect(mockPost).toHaveBeenLastCalledWith('/Authentication/CompletePasskey', { Transaction: 'secret', RequestId: 'req-1', Credential: { id: 'cred' } });
+
+    await requestLoginApproval('secret');
+    expect(mockPost).toHaveBeenLastCalledWith('/MfaApproval/Request', { Purpose: 'login', Transaction: 'secret' });
+
+    await ssoBegin({ Purpose: 'login', ReturnTarget: 'resgrid://sso-return', State: 's', CodeChallenge: 'c', Platform: 'ios', Username: 'user1' });
+    expect(mockPost).toHaveBeenLastCalledWith('/Sso/Begin', expect.objectContaining({ Purpose: 'login', CodeChallengeMethod: 'S256', Username: 'user1' }));
+
+    await ssoRedeem('sso-1', 'code-1', 'verifier');
+    expect(mockPost).toHaveBeenLastCalledWith('/Sso/Redeem', { SsoTransactionId: 'sso-1', SsoCode: 'code-1', CodeVerifier: 'verifier' });
+  });
+
+  it('binds every call to this app and base address, with no bearer token', () => {
+    const config = mockInterceptor!({ headers: {} }) as { headers: Record<string, string>; baseURL: string };
+    expect(config.baseURL).toBe('https://api.test/api/v4');
+    expect(config.headers['X-Resgrid-Client']).toBe('responder');
+    expect(config.headers.Authorization).toBeUndefined();
+  });
+});
diff --git a/src/lib/mfa/approval-wait.ts b/src/lib/mfa/approval-wait.ts
new file mode 100644
index 00000000..a2d04392
--- /dev/null
+++ b/src/lib/mfa/approval-wait.ts
@@ -0,0 +1,43 @@
+import type { ApprovalState, ApprovalStatusData } from './types';
+
+export const APPROVAL_POLL_MS = 2000;
+
+export type ApprovalWaitResult = ApprovalState | 'aborted' | 'unavailable';
+
+const TERMINAL: readonly ApprovalState[] = ['approved', 'denied', 'expired', 'canceled', 'consumed'];
+
+// Each pause removes its own abort listener, so a long wait does not pile one up per poll on the caller's signal.
+const wait = (ms: number, signal?: AbortSignal) =>
+  new Promise<void>((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve();
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
+
+/**
+ * Waits for the member's Responder to decide (plan section 7.9): polls every 2 seconds until the request is decided,
+ * expires or is canceled, or `signal` aborts. A sign-in has no realtime connection, so polling is the only way here.
+ */
+export const waitForApproval = async (status: () => Promise<ApprovalStatusData>, signal?: AbortSignal, intervalMs = APPROVAL_POLL_MS): Promise<ApprovalWaitResult> => {
+  for (;;) {
+    if (signal?.aborted) {
+      return 'aborted';
+    }
+    let state: ApprovalState;
+    try {
+      state = (await status()).State;
+    } catch {
+      return 'unavailable';
+    }
+    if (TERMINAL.includes(state)) {
+      return state;
+    }
+    await wait(intervalMs, signal);
+  }
+};
diff --git a/src/lib/mfa/base64url.ts b/src/lib/mfa/base64url.ts
new file mode 100644
index 00000000..d08fc158
--- /dev/null
+++ b/src/lib/mfa/base64url.ts
@@ -0,0 +1,22 @@
+/** RFC 4648 base64url without padding, for WebAuthn values on the web (the native passkey module does its own). */
+export const bytesToBase64Url = (bytes: ArrayBuffer | Uint8Array): string => {
+  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+  let binary = '';
+  for (let i = 0; i < view.length; i++) {
+    binary += String.fromCharCode(view[i]!);
+  }
+  return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+
+export const base64UrlToBytes = (value: string): Uint8Array<ArrayBuffer> => {
+  const base64 = value.replace(/-/g, '+').replace(/_/g, '/');
+  const padded = base64 + '='.repeat((4 - (base64.length % 4)) % 4);
+  const binary = atob(padded);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+};
+
+export const base64ToBase64Url = (value: string): string => value.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
diff --git a/src/lib/mfa/client-app.ts b/src/lib/mfa/client-app.ts
new file mode 100644
index 00000000..e48ffb76
--- /dev/null
+++ b/src/lib/mfa/client-app.ts
@@ -0,0 +1,71 @@
+import * as Application from 'expo-application';
+import * as Device from 'expo-device';
+import { Platform } from 'react-native';
+
+/**
+ * Which Resgrid app this build is (passkey plan section 10.4). The server binds sign-in transactions, passkeys, brokered
+ * SSO and recovery to it, so every call that starts or finishes one of those sends it.
+ */
+export const RESGRID_CLIENT = 'responder';
+
+/** The scheme the server's return-target registry lists for this app's brokered SSO (`resgrid://sso-return`). */
+export const SSO_RETURN_SCHEME = 'resgrid';
+
+export const CLIENT_HEADER = 'X-Resgrid-Client';
+export const SHARED_INSTALLATION_HEADER = 'X-Resgrid-Shared-Installation';
+export const OPERATOR_ACTIVITY_HEADER = 'X-Resgrid-Operator-Activity';
+
+const MAX_HEADER_LENGTH = 64;
+
+/** A header value the platform HTTP stack will send: printable ASCII only, trimmed and bounded. */
+export const headerSafe = (value: string | null | undefined): string | null => {
+  if (!value) {
+    return null;
+  }
+  const ascii = value
+    .normalize('NFKD')
+    .replace(/[^\x20-\x7e]/g, '')
+    .trim();
+  return ascii.length === 0 ? null : ascii.slice(0, MAX_HEADER_LENGTH).trim();
+};
+
+/**
+ * The app and installation headers for requests that create or bind a session: the app, and labels for the member's own
+ * session list. Labels are display text only; nothing trusts them.
+ */
+export const clientHeaders = (): Record<string, string> => {
+  const headers: Record<string, string> = { [CLIENT_HEADER]: RESGRID_CLIENT };
+  const labels: Record<string, string | null> = {
+    'X-Resgrid-Device-Name': headerSafe(Device.deviceName ?? Device.modelName),
+    'X-Resgrid-Device-Type': headerSafe(Device.modelName),
+    'X-Resgrid-Operating-System': headerSafe(`${Platform.OS} ${Device.osVersion ?? ''}`),
+    'X-Resgrid-App-Version': headerSafe(Application.nativeApplicationVersion),
+  };
+  for (const [name, value] of Object.entries(labels)) {
+    if (value) {
+      headers[name] = value;
+    }
+  }
+  return headers;
+};
+
+/**
+ * Whether the provider's sign-in should run in a browser session that keeps no cookies. Responder is a personal app, so
+ * it keeps the member's provider session like any other browser sign-in.
+ */
+export const ephemeralBrowser = (): boolean => false;
+
+type HeaderBag = { set?: (name: string, value: string) => unknown } | Record<string, unknown>;
+
+/** Adds the app and installation headers to a request's headers (Axios headers or a plain object). */
+export const applyClientHeaders = <T extends HeaderBag>(headers: T): T => {
+  for (const [name, value] of Object.entries(clientHeaders())) {
+    const set = (headers as { set?: unknown }).set;
+    if (typeof set === 'function') {
+      set.call(headers, name, value);
+    } else {
+      (headers as Record<string, unknown>)[name] = value;
+    }
+  }
+  return headers;
+};
diff --git a/src/lib/mfa/errors.ts b/src/lib/mfa/errors.ts
new file mode 100644
index 00000000..1971fa0f
--- /dev/null
+++ b/src/lib/mfa/errors.ts
@@ -0,0 +1,46 @@
+/**
+ * What the server said when it refused an MFA, passkey, approval, SSO or session call (passkey workbook section 7.6). The
+ * v4 API answers with ProblemDetails (`type`); the token endpoint and the locked-session middleware answer with `error`.
+ * Clients switch on the code, never on the human text.
+ */
+export interface MfaProblem {
+  code: string;
+  status: number | null;
+  /** The shared session's lock version, when the refusal was "locked". */
+  lockVersion?: number;
+}
+
+/** A sign-in transaction that can no longer finish: the member signs in again from the start. */
+export const TRANSACTION_ENDING_CODES = new Set([
+  'mfa_transaction_invalid',
+  'mfa_transaction_expired',
+  'too_many_attempts',
+  'policy_changed',
+  'session_revoked',
+  'recovery_transaction_invalid',
+  'recovery_transaction_expired',
+]);
+
+interface ErrorBody {
+  type?: unknown;
+  error?: unknown;
+  lock_version?: unknown;
+}
+
+export const toMfaProblem = (error: unknown): MfaProblem => {
+  const response = (error as { response?: { status?: number; data?: unknown } } | null)?.response;
+  if (!response) {
+    return { code: 'network_error', status: null };
+  }
+
+  const body = (typeof response.data === 'object' && response.data !== null ? response.data : {}) as ErrorBody;
+  const code = typeof body.type === 'string' && body.type ? body.type : typeof body.error === 'string' && body.error ? body.error : 'unknown_error';
+  const problem: MfaProblem = { code, status: typeof response.status === 'number' ? response.status : null };
+  if (typeof body.lock_version === 'number') {
+    problem.lockVersion = body.lock_version;
+  }
+  return problem;
+};
+
+/** Whether the refusal ends the sign-in (rather than asking for another try or another method). */
+export const endsTransaction = (problem: MfaProblem): boolean => TRANSACTION_ENDING_CODES.has(problem.code);
diff --git a/src/lib/mfa/messages.ts b/src/lib/mfa/messages.ts
new file mode 100644
index 00000000..5eac9633
--- /dev/null
+++ b/src/lib/mfa/messages.ts
@@ -0,0 +1,52 @@
+/**
+ * The translation key for a refusal code (passkey workbook section 7.6, plus this app's own passkey and SSO outcomes).
+ * Codes the app has no message for fall back to a generic one; the code itself is never shown.
+ */
+const KNOWN = new Set([
+  'access_denied',
+  'approval_denied',
+  'approval_expired',
+  'approval_pending',
+  'approval_suspended',
+  'approval_unavailable',
+  'challenge_consumed',
+  'challenge_expired',
+  'federated_identity_mismatch',
+  'federated_mfa_not_satisfied',
+  'invalid_recovery_code',
+  'invalid_totp',
+  'mfa_enrollment_required',
+  'mfa_method_not_allowed',
+  'mfa_not_enrolled',
+  'mfa_transaction_expired',
+  'mfa_transaction_invalid',
+  'network_error',
+  'passkey_cancelled',
+  'passkey_failed',
+  'passkey_no_credentials',
+  'passkey_not_registered_for_client',
+  'passkey_not_supported',
+  'passkey_verification_failed',
+  'passkeys_unavailable',
+  'policy_changed',
+  'reauthentication_required',
+  'recovery_transaction_expired',
+  'recovery_transaction_invalid',
+  'service_unavailable',
+  'session_revoked',
+  'setup_expired',
+  'shared_session_lock_changed',
+  'sso_cancelled',
+  'sso_denied',
+  'sso_failed',
+  'sso_reauthentication_required',
+  'sso_state_mismatch',
+  'sso_unavailable',
+  'step_up_required',
+  'too_many_attempts',
+]);
+
+export const mfaErrorKey = (code: string | null | undefined): string => `mfa.errors.${code && KNOWN.has(code) ? code : 'unknown_error'}`;
+
+/** Whether an auth-store error is one of these codes (shown translated) rather than free text from elsewhere. */
+export const isMfaErrorCode = (value: string | null | undefined): value is string => !!value && KNOWN.has(value);
diff --git a/src/lib/mfa/passkey-errors.ts b/src/lib/mfa/passkey-errors.ts
new file mode 100644
index 00000000..88edfcc7
--- /dev/null
+++ b/src/lib/mfa/passkey-errors.ts
@@ -0,0 +1,14 @@
+/** Why a passkey prompt did not produce a credential. Cancelling is the member's choice, never a failed verification. */
+export type PasskeyCeremonyReason = 'cancelled' | 'not_supported' | 'no_credentials' | 'failed';
+
+export class PasskeyCeremonyError extends Error {
+  readonly reason: PasskeyCeremonyReason;
+
+  constructor(reason: PasskeyCeremonyReason) {
+    super(`passkey_${reason}`);
+    this.name = 'PasskeyCeremonyError';
+    this.reason = reason;
+  }
+}
+
+export const isPasskeyCeremonyError = (error: unknown): error is PasskeyCeremonyError => error instanceof PasskeyCeremonyError;
diff --git a/src/lib/mfa/passkey.ts b/src/lib/mfa/passkey.ts
new file mode 100644
index 00000000..6be8208e
--- /dev/null
+++ b/src/lib/mfa/passkey.ts
@@ -0,0 +1,77 @@
+import { Passkey, type PasskeyCreateRequest, type PasskeyGetRequest } from 'react-native-passkey';
+
+import { PasskeyCeremonyError, type PasskeyCeremonyReason } from './passkey-errors';
+import type { WebAuthnOptions } from './types';
+
+// ---------------------------------------------------------------------------
+// Passkeys on iOS and Android (passkey workbook section 3: react-native-passkey over Credential Manager and
+// ASAuthorization). The server issues the options for this app's own relying party and verifies the result; this only
+// runs the platform prompt. The options and results are WebAuthn JSON with base64url values on both sides.
+// ---------------------------------------------------------------------------
+
+const reasonFor = (error: unknown): PasskeyCeremonyReason => {
+  const code = (error as { error?: string } | null)?.error;
+  switch (code) {
+    case 'UserCancelled':
+    case 'Interrupted':
+      return 'cancelled';
+    case 'NotSupported':
+    case 'BadConfiguration':
+      return 'not_supported';
+    case 'NoCredentials':
+      return 'no_credentials';
+    default:
+      return 'failed';
+  }
+};
+
+export const passkeysSupported = (): boolean => {
+  try {
+    return Passkey.isSupported();
+  } catch {
+    return false;
+  }
+};
+
+/** Runs the sign-in prompt for the server's request options and returns the assertion as WebAuthn JSON. */
+export const getPasskeyAssertion = async (options: WebAuthnOptions): Promise<Record<string, unknown>> => {
+  try {
+    const result = await Passkey.get(options as unknown as PasskeyGetRequest);
+    return {
+      id: result.id,
+      rawId: result.rawId ?? result.id,
+      type: result.type ?? 'public-key',
+      authenticatorAttachment: result.authenticatorAttachment ?? null,
+      response: {
+        authenticatorData: result.response.authenticatorData,
+        clientDataJSON: result.response.clientDataJSON,
+        signature: result.response.signature,
+        userHandle: result.response.userHandle ?? null,
+      },
+      clientExtensionResults: result.clientExtensionResults ?? {},
+    };
+  } catch (error) {
+    throw new PasskeyCeremonyError(reasonFor(error));
+  }
+};
+
+/** Runs the create prompt for the server's creation options and returns the attestation as WebAuthn JSON. */
+export const createPasskeyCredential = async (options: WebAuthnOptions): Promise<Record<string, unknown>> => {
+  try {
+    const result = await Passkey.create(options as unknown as PasskeyCreateRequest);
+    return {
+      id: result.id,
+      rawId: result.rawId ?? result.id,
+      type: result.type ?? 'public-key',
+      authenticatorAttachment: result.authenticatorAttachment ?? null,
+      response: {
+        clientDataJSON: result.response.clientDataJSON,
+        attestationObject: result.response.attestationObject,
+        transports: result.response.transports ?? [],
+      },
+      clientExtensionResults: result.clientExtensionResults ?? {},
+    };
+  } catch (error) {
+    throw new PasskeyCeremonyError(reasonFor(error));
+  }
+};
diff --git a/src/lib/mfa/passkey.web.ts b/src/lib/mfa/passkey.web.ts
new file mode 100644
index 00000000..ca357ee1
--- /dev/null
+++ b/src/lib/mfa/passkey.web.ts
@@ -0,0 +1,106 @@
+import { base64UrlToBytes, bytesToBase64Url } from './base64url';
+import { PasskeyCeremonyError } from './passkey-errors';
+import type { WebAuthnOptions } from './types';
+
+// ---------------------------------------------------------------------------
+// Passkeys in the browser build (passkey workbook section 3: a small shim over navigator.credentials). WebAuthn needs a
+// secure https (or localhost) page; a packaged desktop shell's custom scheme is not one, so passkeys are unavailable
+// there and the other methods are offered instead.
+// ---------------------------------------------------------------------------
+
+type Descriptor = { id: string; type: string; transports?: string[] };
+
+const secureWebPage = (): boolean => {
+  if (typeof window === 'undefined' || !window.isSecureContext) {
+    return false;
+  }
+  const { protocol, hostname } = window.location;
+  return protocol === 'https:' || (protocol === 'http:' && (hostname === 'localhost' || hostname === '127.0.0.1'));
+};
+
+export const passkeysSupported = (): boolean => secureWebPage() && typeof window.PublicKeyCredential !== 'undefined' && typeof navigator !== 'undefined' && !!navigator.credentials;
+
+const descriptors = (list: unknown): PublicKeyCredentialDescriptor[] | undefined =>
+  Array.isArray(list) ? (list as Descriptor[]).map((d) => ({ id: base64UrlToBytes(d.id), type: 'public-key', ...(d.transports ? { transports: d.transports as AuthenticatorTransport[] } : {}) })) : undefined;
+
+const failure = (error: unknown): PasskeyCeremonyError => {
+  const name = (error as { name?: string } | null)?.name;
+  if (name === 'NotAllowedError' || name === 'AbortError') {
+    // The browser uses NotAllowedError for both a cancelled prompt and a timeout; neither is a failed signature.
+    return new PasskeyCeremonyError('cancelled');
+  }
+  if (name === 'NotSupportedError' || name === 'SecurityError') {
+    return new PasskeyCeremonyError('not_supported');
+  }
+  return new PasskeyCeremonyError('failed');
+};
+
+const credentialJson = (credential: PublicKeyCredential, assertion: boolean): Record<string, unknown> => {
+  const toJson = (credential as unknown as { toJSON?: () => Record<string, unknown> }).toJSON;
+  if (typeof toJson === 'function') {
+    return toJson.call(credential);
+  }
+
+  const response = credential.response as AuthenticatorAssertionResponse & AuthenticatorAttestationResponse;
+  return {
+    id: credential.id,
+    rawId: bytesToBase64Url(credential.rawId),
+    type: credential.type,
+    authenticatorAttachment: credential.authenticatorAttachment ?? null,
+    response: assertion
+      ? {
+          authenticatorData: bytesToBase64Url(response.authenticatorData),
+          clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+          signature: bytesToBase64Url(response.signature),
+          userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null,
+        }
+      : {
+          clientDataJSON: bytesToBase64Url(response.clientDataJSON),
+          attestationObject: bytesToBase64Url(response.attestationObject),
+          transports: typeof response.getTransports === 'function' ? response.getTransports() : [],
+        },
+    clientExtensionResults: credential.getClientExtensionResults(),
+  };
+};
+
+export const getPasskeyAssertion = async (options: WebAuthnOptions): Promise<Record<string, unknown>> => {
+  if (!passkeysSupported()) {
+    throw new PasskeyCeremonyError('not_supported');
+  }
+  const publicKey: PublicKeyCredentialRequestOptions = {
+    ...(options as unknown as PublicKeyCredentialRequestOptions),
+    challenge: base64UrlToBytes(String(options.challenge)),
+    allowCredentials: descriptors(options.allowCredentials),
+  };
+  try {
+    const credential = (await navigator.credentials.get({ publicKey })) as PublicKeyCredential | null;
+    if (!credential) {
+      throw new PasskeyCeremonyError('cancelled');
+    }
+    return credentialJson(credential, true);
+  } catch (error) {
+    throw error instanceof PasskeyCeremonyError ? error : failure(error);
+  }
+};
+
+export const createPasskeyCredential = async (options: WebAuthnOptions): Promise<Record<string, unknown>> => {
+  if (!passkeysSupported()) {
+    throw new PasskeyCeremonyError('not_supported');
+  }
+  const user = options.user as { id: string; name: string; displayName: string };
+  const publicKey: PublicKeyCredentialCreationOptions = {
+    ...(options as unknown as PublicKeyCredentialCreationOptions),
+    challenge: base64UrlToBytes(String(options.challenge)),
+    user: { ...user, id: base64UrlToBytes(user.id) },
+    excludeCredentials: descriptors(options.excludeCredentials),
+  };
+  try {
+    const credential = (await navigator.credentials.create({ publicKey })) as PublicKeyCredential | null;
+    if (!credential) {
+      throw new PasskeyCeremonyError('cancelled');
+    }
+    return credentialJson(credential, false);
+  } catch (error) {
+    throw error instanceof PasskeyCeremonyError ? error : failure(error);
+  }
+};
diff --git a/src/lib/mfa/pkce.ts b/src/lib/mfa/pkce.ts
new file mode 100644
index 00000000..d05e6c0d
--- /dev/null
+++ b/src/lib/mfa/pkce.ts
@@ -0,0 +1,9 @@
+import * as Crypto from 'expo-crypto';
+
+import { base64ToBase64Url, bytesToBase64Url } from './base64url';
+
+/** A fresh random value for a PKCE verifier (43 chars from 32 bytes) or an SSO state. */
+export const randomBase64Url = (bytes = 32): string => bytesToBase64Url(Crypto.getRandomBytes(bytes));
+
+/** The S256 challenge the broker sees; the verifier stays in this app's memory until redemption. */
+export const s256Challenge = async (verifier: string): Promise<string> => base64ToBase64Url(await Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA256, verifier, { encoding: Crypto.CryptoEncoding.BASE64 }));
diff --git a/src/lib/mfa/sso-browser.ts b/src/lib/mfa/sso-browser.ts
new file mode 100644
index 00000000..1cc90154
--- /dev/null
+++ b/src/lib/mfa/sso-browser.ts
@@ -0,0 +1,114 @@
+import * as WebBrowser from 'expo-web-browser';
+import queryString from 'query-string';
+import { Platform } from 'react-native';
+
+import { ephemeralBrowser, SSO_RETURN_SCHEME } from './client-app';
+import { toMfaProblem } from './errors';
+import { randomBase64Url, s256Challenge } from './pkce';
+import type { SsoBeginData } from './types';
+
+// ---------------------------------------------------------------------------
+// One brokered SSO round trip (passkey plan section 7.7.2). The broker returns only a one-time code and this app's
+// state to the registered return target; the PKCE verifier never leaves this app's memory until the code is redeemed,
+// and no IdP token or assertion ever reaches the app.
+// ---------------------------------------------------------------------------
+
+export interface SsoRoundTripSecrets {
+  returnTarget: string;
+  state: string;
+  codeChallenge: string;
+  platform: string;
+}
+
+export interface SsoRoundTrip {
+  ssoTransactionId: string;
+  ssoCode: string;
+  codeVerifier: string;
+}
+
+export type SsoRoundTripResult = { ok: true; trip: SsoRoundTrip } | { ok: false; reason: 'cancelled' | 'denied' | 'failed' | 'state_mismatch' | 'refused'; code?: string };
+
+/**
+ * The desktop app's loopback bridge (electron/sso-loopback.js): a one-time listener on 127.0.0.1 receives the broker's
+ * return, because a packaged desktop page cannot receive a browser redirect. Absent everywhere else.
+ */
+interface DesktopSso {
+  ssoListen: () => Promise<{ id: string; returnTarget: string }>;
+  ssoOpen: (id: string, authorizeUrl: string) => Promise<string | null>;
+  ssoCancel: (id: string) => Promise<void>;
+}
+
+const desktopSso = (): DesktopSso | null => {
+  const bridge = typeof window !== 'undefined' ? (window as unknown as { electronAPI?: Partial<DesktopSso> }).electronAPI : undefined;
+  return bridge?.ssoListen && bridge.ssoOpen && bridge.ssoCancel ? (bridge as DesktopSso) : null;
+};
+
+/** This build's registered return target: the app's scheme, or this site's `/sso-return` page. */
+export const ssoReturnTarget = (): string => (Platform.OS === 'web' && typeof window !== 'undefined' ? `${window.location.origin}/sso-return` : `${SSO_RETURN_SCHEME}://sso-return`);
+
+export const ssoPlatform = (): string => (desktopSso() ? 'electron' : Platform.OS);
+
+/** Parses the broker's return: `?sso_code=…&state=…` or `?error=…&state=…`. */
+export const parseSsoReturn = (url: string): { ssoCode?: string; state?: string; error?: string } => {
+  const query = url.includes('?') ? (url.substring(url.indexOf('?') + 1).split('#')[0] ?? '') : '';
+  const parsed = queryString.parse(query);
+  const one = (value: unknown): string | undefined => (typeof value === 'string' && value.length > 0 ? value : undefined);
+  return { ssoCode: one(parsed.sso_code), state: one(parsed.state), error: one(parsed.error) };
+};
+
+/**
+ * Begins the round trip through `begin`, runs it in the system browser (an auth session, so the redirect comes straight
+ * back to this app), and checks the state before handing back the code. `ephemeral` keeps the provider's cookies out of
+ * a shared installation so the next operator cannot inherit the last one's provider session.
+ */
+export const runSsoRoundTrip = async (begin: (secrets: SsoRoundTripSecrets) => Promise<SsoBeginData>, ephemeral = ephemeralBrowser()): Promise<SsoRoundTripResult> => {
+  const codeVerifier = randomBase64Url(32);
+  const state = randomBase64Url(24);
+  const desktop = desktopSso();
+  let listener: { id: string; returnTarget: string } | null = null;
+  try {
+    listener = desktop ? await desktop.ssoListen() : null;
+    const returnTarget = listener ? listener.returnTarget : ssoReturnTarget();
+
+    let begun: SsoBeginData;
+    try {
+      begun = await begin({ returnTarget, state, codeChallenge: await s256Challenge(codeVerifier), platform: ssoPlatform() });
+    } catch (error) {
+      return { ok: false, reason: 'refused', code: toMfaProblem(error).code };
+    }
+
+    let returnedUrl: string | null;
+    if (desktop && listener) {
+      // The provider opens in the member's own browser; the loopback listener hands back its one return.
+      returnedUrl = await desktop.ssoOpen(listener.id, begun.AuthorizeUrl);
+    } else {
+      const result = await WebBrowser.openAuthSessionAsync(begun.AuthorizeUrl, returnTarget, { preferEphemeralSession: ephemeral });
+      returnedUrl = result.type === 'success' && result.url ? result.url : null;
+    }
+    if (!returnedUrl) {
+      return { ok: false, reason: 'cancelled' };
+    }
+
+    const returned = parseSsoReturn(returnedUrl);
+    if (returned.state !== state) {
+      return { ok: false, reason: 'state_mismatch' };
+    }
+    if (returned.error) {
+      return { ok: false, reason: returned.error === 'access_denied' ? 'denied' : 'failed', code: returned.error };
+    }
+    if (!returned.ssoCode) {
+      return { ok: false, reason: 'failed' };
+    }
+
+    return { ok: true, trip: { ssoTransactionId: begun.SsoTransactionId, ssoCode: returned.ssoCode, codeVerifier } };
+  } catch {
+    // The listener or the browser could not run (no browser on the device, another auth session already open, the
+    // desktop bridge failing): a failed round trip, reported like any other rather than thrown at every caller.
+    return { ok: false, reason: 'failed' };
+  } finally {
+    // The listener closes itself after its one return, so this is a no-op then; on every other way out it closes here.
+    if (desktop && listener) {
+      await desktop.ssoCancel(listener.id).catch(() => undefined);
+    }
+  }
+};
diff --git a/src/lib/mfa/transaction-api.ts b/src/lib/mfa/transaction-api.ts
new file mode 100644
index 00000000..d0c9c846
--- /dev/null
+++ b/src/lib/mfa/transaction-api.ts
@@ -0,0 +1,84 @@
+import axios from 'axios';
+
+import { getBaseApiUrl } from '@/lib/storage/app';
+
+import { applyClientHeaders } from './client-app';
+import type { ApprovalRequestData, ApprovalStatusData, CompletionData, FactorRecoveryStatusData, PasskeyCeremonyData, RecoveryCompleteData, SsoBeginData, SsoRedeemData, TotpSetupData, V4Result } from './types';
+
+// ---------------------------------------------------------------------------
+// The sign-in transaction calls (passkey plan sections 7.5 and 7.7.2): no bearer token; the transaction secret is the
+// only authority, and the app header must match the app that started it. Bodies are PascalCase JSON: the server binds
+// names case-insensitively but never snake_case.
+// ---------------------------------------------------------------------------
+
+const REQUEST_TIMEOUT_MS = 15000;
+
+const transactionApi = axios.create({ timeout: REQUEST_TIMEOUT_MS, headers: { 'Content-Type': 'application/json' } });
+
+transactionApi.interceptors.request.use((config) => {
+  config.baseURL = getBaseApiUrl();
+  applyClientHeaders(config.headers);
+  return config;
+});
+
+const post = async <T>(path: string, body: Record<string, unknown>): Promise<T> => (await transactionApi.post<V4Result<T>>(path, body)).data.Data;
+
+// ---- Second factor for a sign-in ---------------------------------------------------------------------------------------
+
+export const completeTotp = (transaction: string, code: string) => post<CompletionData>('/Authentication/CompleteTotp', { Transaction: transaction, Code: code });
+
+export const completeRecoveryCode = (transaction: string, code: string) => post<CompletionData>('/Authentication/CompleteRecoveryCode', { Transaction: transaction, Code: code });
+
+export const loginPasskeyOptions = (transaction: string) => post<PasskeyCeremonyData>('/Authentication/PasskeyOptions', { Transaction: transaction });
+
+export const completePasskey = (transaction: string, requestId: string, credential: Record<string, unknown>) =>
+  post<CompletionData>('/Authentication/CompletePasskey', { Transaction: transaction, RequestId: requestId, Credential: credential });
+
+export const completeApproval = (transaction: string, approvalRequestId: string) => post<CompletionData>('/Authentication/CompleteApproval', { Transaction: transaction, ApprovalRequestId: approvalRequestId });
+
+export const completeFederated = (transaction: string, ssoTransactionId: string, ssoCode: string, codeVerifier: string) =>
+  post<CompletionData>('/Authentication/CompleteFederated', { Transaction: transaction, SsoTransactionId: ssoTransactionId, SsoCode: ssoCode, CodeVerifier: codeVerifier });
+
+// ---- Setting up an authenticator the department requires (plan section 6.2) ---------------------------------------------
+
+export const totpSetupOptions = (transaction: string) => post<TotpSetupData>('/Authentication/TotpSetupOptions', { Transaction: transaction });
+
+export const completeTotpSetup = (transaction: string, code: string) => post<CompletionData>('/Authentication/CompleteTotpSetup', { Transaction: transaction, Code: code });
+
+// ---- Approve with Responder, for a sign-in (plan section 7.9) -------------------------------------------------------------
+
+export const requestLoginApproval = (transaction: string) => post<ApprovalRequestData>('/MfaApproval/Request', { Purpose: 'login', Transaction: transaction });
+
+export const loginApprovalStatus = (transaction: string, approvalRequestId: string) => post<ApprovalStatusData>('/MfaApproval/Status', { Transaction: transaction, ApprovalRequestId: approvalRequestId });
+
+export const cancelLoginApproval = (transaction: string, approvalRequestId: string) => post<ApprovalStatusData>('/MfaApproval/Cancel', { Transaction: transaction, ApprovalRequestId: approvalRequestId });
+
+// ---- Brokered SSO (plan section 7.7.2) -----------------------------------------------------------------------------------
+
+export interface SsoBeginInput {
+  Purpose: 'login' | 'step_up';
+  ReturnTarget: string;
+  State: string;
+  CodeChallenge: string;
+  Platform: string;
+  DepartmentToken?: string;
+  DepartmentCode?: string;
+  Username?: string;
+  /** For a provider step-up that finishes a password sign-in. */
+  Transaction?: string;
+}
+
+export const ssoBegin = (input: SsoBeginInput) => post<SsoBeginData>('/Sso/Begin', { ...input, CodeChallengeMethod: 'S256' });
+
+export const ssoRedeem = (ssoTransactionId: string, ssoCode: string, codeVerifier: string) => post<SsoRedeemData>('/Sso/Redeem', { SsoTransactionId: ssoTransactionId, SsoCode: ssoCode, CodeVerifier: codeVerifier });
+
+// ---- "I lost my authenticator" (plan sections 5.4 and 6.3) --------------------------------------------------------------
+
+export const beginFactorRecovery = (transaction: string, recoveryCode: string) => post<FactorRecoveryStatusData>('/AccountSecurity/BeginFactorRecovery', { Transaction: transaction, Code: recoveryCode });
+
+export const prepareRecoveryReplacement = (recovery: string) => post<TotpSetupData>('/AccountSecurity/PrepareReplacement', { Transaction: recovery });
+
+export const completeFactorRecovery = (recovery: string, code: string, removePasskeyIds: string[]) =>
+  post<RecoveryCompleteData>('/AccountSecurity/CompleteFactorRecovery', { Transaction: recovery, Code: code, RemovePasskeyIds: removePasskeyIds });
+
+export const cancelFactorRecovery = (recovery: string) => post<FactorRecoveryStatusData>('/AccountSecurity/CancelFactorRecovery', { Transaction: recovery });
diff --git a/src/lib/mfa/types.ts b/src/lib/mfa/types.ts
new file mode 100644
index 00000000..f732c83b
--- /dev/null
+++ b/src/lib/mfa/types.ts
@@ -0,0 +1,124 @@
+/** The second factors the server knows (passkey plan section 7.5; `MfaMethodNames`). */
+export type MfaMethod = 'totp' | 'passkey' | 'passkey_approval' | 'federated';
+
+export const MFA_METHODS: readonly MfaMethod[] = ['totp', 'passkey', 'passkey_approval', 'federated'];
+
+export const isMfaMethod = (value: unknown): value is MfaMethod => typeof value === 'string' && (MFA_METHODS as readonly string[]).includes(value);
+
+/** The token endpoint sends methods as a space-separated string; `Sso/Redeem` sends an array. */
+export const parseMethods = (value: unknown): MfaMethod[] => {
+  const items = Array.isArray(value) ? value : typeof value === 'string' ? value.split(' ') : [];
+  return items.map((item) => (typeof item === 'string' ? item.trim() : item)).filter(isMfaMethod);
+};
+
+/** A sign-in waiting for its second factor. The secret itself is never part of this view (see `mfa-transaction`). */
+export interface MfaChallenge {
+  /** `verify`: choose a second factor. `setup`: the department requires MFA the account does not have yet. `legacy`: the server has no transaction; resend with a code. */
+  kind: 'verify' | 'setup' | 'legacy';
+  /** What this sign-in accepts (the deployment's and department's switches), in the server's order. */
+  methods: MfaMethod[];
+  /** What the member has: a sign-in offers only the accepted methods that are also here. */
+  enrolled: MfaMethod[];
+  preferred: MfaMethod | null;
+  /** Epoch ms after which the transaction is gone. */
+  expiresAt: number | null;
+  /** Where the first factor came from: a password, or the department's identity provider. */
+  source: 'password' | 'sso';
+}
+
+/** The WebAuthn options the server issued, as JSON (base64url values, camelCase names). */
+export type WebAuthnOptions = Record<string, unknown>;
+
+export interface PasskeyCeremonyData {
+  RequestId: string;
+  Options: WebAuthnOptions;
+}
+
+export interface CompletionData {
+  CompletionCode: string;
+  ExpiresIn: number;
+  Recovery: boolean;
+  RecoveryCodes: string[] | null;
+}
+
+export interface ApprovalRequestData {
+  ApprovalRequestId: string;
+  MatchNumber: string;
+  ExpiresIn: number;
+}
+
+export type ApprovalState = 'pending' | 'approved' | 'denied' | 'expired' | 'canceled' | 'consumed';
+
+export interface ApprovalStatusData {
+  State: ApprovalState;
+  ExpiresAt: string | null;
+}
+
+export interface TotpSetupData {
+  SharedKey: string;
+  AuthenticatorUri: string;
+  ExpiresIn: number;
+}
+
+export interface SsoBeginData {
+  AuthorizeUrl: string;
+  SsoTransactionId: string;
+  ExpiresIn: number;
+}
+
+export interface SsoRedeemData {
+  Outcome: 'mfa_required' | 'completed' | 'reauthenticated';
+  Transaction: string | null;
+  ExpiresIn: number;
+  MfaMethods: string[] | null;
+  MfaEnrolled: string[] | null;
+  MfaPreferred: string | null;
+  CompletionCode: string | null;
+  MfaSatisfiedBy: string | null;
+  VerifiedAt: string | null;
+}
+
+export interface FactorRecoveryStatusData {
+  Transaction: string | null;
+  State: 'pending' | 'canceled';
+  ExpiresIn: number;
+  NextActions: string[] | null;
+  Passkeys: PasskeyData[] | null;
+}
+
+export interface RecoveryCompleteData {
+  RecoveryCodes: string[];
+  SignInAgain: boolean;
+}
+
+export interface PasskeyData {
+  PasskeyId: string;
+  DisplayName: string;
+  Client: string | null;
+  CreatedOn: string;
+  CreatedPlatform: string | null;
+  CreatedInstallation: string | null;
+  CreatedOnSharedInstallation: boolean;
+  Attachment: string | null;
+  BackupEligible: boolean;
+  BackedUp: boolean;
+  LastUsedOn: string | null;
+  LastUsedClient: string | null;
+  LastUsedInstallation: string | null;
+  ApprovalEnabled: boolean | null;
+}
+
+/** The v4 wrapper: every result here carries its payload in `Data`. */
+export interface V4Result<T> {
+  Data: T;
+}
+
+/** Server timestamps read from a row may lack a zone; they are UTC. */
+export const parseUtc = (value: string | null | undefined): number | null => {
+  if (!value) {
+    return null;
+  }
+  const zoned = /([zZ]|[+-]\d\d:?\d\d)$/.test(value) ? value : `${value}Z`;
+  const parsed = Date.parse(zoned);
+  return Number.isFinite(parsed) ? parsed : null;
+};
diff --git a/src/lib/records/__tests__/uploads.test.ts b/src/lib/records/__tests__/uploads.test.ts
index 2690bbe6..fcdba60c 100644
--- a/src/lib/records/__tests__/uploads.test.ts
+++ b/src/lib/records/__tests__/uploads.test.ts
@@ -25,6 +25,8 @@ jest.mock('expo-file-system/legacy', () => ({
 jest.mock('expo-crypto', () => ({
   CryptoDigestAlgorithm: { SHA256: 'SHA-256' },
   digest: jest.fn(async (_algorithm: string, data: Uint8Array) => {
+    // Model the native bridge instead of silently accepting Node Buffer inputs.
+    if (data.constructor !== Uint8Array) throw new Error('Native bridge requires Uint8Array');
     const digest = jest.requireActual<typeof import('crypto')>('crypto').createHash('sha256').update(data).digest();
     return digest.buffer.slice(digest.byteOffset, digest.byteOffset + digest.byteLength);
   }),
@@ -230,3 +232,10 @@ describe('Record attachment uploads', () => {
     expect(api.completeRecordUpload).not.toHaveBeenCalled();
   });
 });
+
+it.each([[[]], [[0, 127, 128, 255, 1]]])('hashes binary bytes %j through a native-compatible array', async (values: number[]) => {
+  const bytes = Buffer.from(values);
+  fs.readAsStringAsync.mockResolvedValue(bytes.toString('base64'));
+  const expected = jest.requireActual<typeof import('crypto')>('crypto').createHash('sha256').update(bytes).digest('hex');
+  await expect(hashFile('file:///binary.bin')).resolves.toBe(expected);
+});
diff --git a/src/lib/records/uploads.ts b/src/lib/records/uploads.ts
index 818cbaa8..3011a774 100644
--- a/src/lib/records/uploads.ts
+++ b/src/lib/records/uploads.ts
@@ -72,7 +72,9 @@ const problemMessage = (error: unknown): string => {
  */
 export const hashFile = async (fileUri: string): Promise<string> => {
   const base64 = await FileSystem.readAsStringAsync(fileUri, { encoding: FileSystem.EncodingType.Base64 });
-  const digest = await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, Buffer.from(base64, 'base64'));
+  const bytes = Buffer.from(base64, 'base64');
+  // Expo's native bridge requires a plain typed array, not the Buffer subclass.
+  const digest = await Crypto.digest(Crypto.CryptoDigestAlgorithm.SHA256, new Uint8Array(bytes.buffer, bytes.byteOffset, bytes.byteLength));
   return Buffer.from(digest).toString('hex');
 };
 
diff --git a/src/lib/storage/__tests__/clear-all-data.test.ts b/src/lib/storage/__tests__/clear-all-data.test.ts
index 117d034e..610d496d 100644
--- a/src/lib/storage/__tests__/clear-all-data.test.ts
+++ b/src/lib/storage/__tests__/clear-all-data.test.ts
@@ -40,6 +40,12 @@ jest.mock('../secure-storage', () => ({
   clearSecureKeys: () => mockClearSecureKeys(),
 }));
 
+// Mock the Mapbox token store
+const mockClearMapboxToken = jest.fn();
+jest.mock('@/lib/mapbox-token', () => ({
+  clearMapboxToken: () => mockClearMapboxToken(),
+}));
+
 import { clearAllAppData, getRegisteredStoreCount, getRegisteredStoreNames, registerStoreReset, unregisterStoreReset } from '../clear-all-data';
 
 describe('clearAllAppData', () => {
@@ -133,6 +139,12 @@ describe('clearAllAppData', () => {
       });
     });
 
+    it('should forget the server Mapbox token so maps fall back to the built-in token', async () => {
+      await clearAllAppData();
+
+      expect(mockClearMapboxToken).toHaveBeenCalledTimes(1);
+    });
+
     it('should skip store reset when resetStores is false', async () => {
       const mockResetFn = jest.fn();
       registerStoreReset('skipResetStore', mockResetFn);
diff --git a/src/lib/storage/clear-all-data.ts b/src/lib/storage/clear-all-data.ts
index d87180c6..ba00ce9e 100644
--- a/src/lib/storage/clear-all-data.ts
+++ b/src/lib/storage/clear-all-data.ts
@@ -11,6 +11,7 @@
  */
 
 import { logger } from '@/lib/logging';
+import { clearMapboxToken } from '@/lib/mapbox-token';
 import { IS_FIRST_TIME, storage } from '@/lib/storage';
 import { BASE_API_URL_STORAGE_KEY } from '@/lib/storage/app';
 
@@ -21,7 +22,10 @@ import { clearUnitsFilterOptions } from './units-filter';
 // Store reset functions registry
 type StoreResetFunction = () => void;
 
-const storeResetFunctions: Map<string, StoreResetFunction> = new Map();
+// The Mapbox token store is shared code that does not register itself. Forgetting the server token on
+// sign-out (and on a server switch, which signs out) puts maps back on the built-in token until config
+// loads again.
+const storeResetFunctions: Map<string, StoreResetFunction> = new Map([['mapbox-token', clearMapboxToken]]);
 
 /**
  * Register a store reset function
diff --git a/src/models/v4/configs/getConfigResultData.ts b/src/models/v4/configs/getConfigResultData.ts
index da17be72..40cc0eba 100644
--- a/src/models/v4/configs/getConfigResultData.ts
+++ b/src/models/v4/configs/getConfigResultData.ts
@@ -22,4 +22,12 @@ export class GetConfigResultData {
   public MapCenterLongitude: number = 0;
   /** Zoom level for department-wide maps. */
   public MapCenterZoomLevel: number = 9;
+  /** Department Mapbox base map style (mapbox:// url) for the light theme. */
+  public MapDayStyleUrl: string = '';
+  /** Department Mapbox base map style (mapbox:// url) for the dark theme. */
+  public MapNightStyleUrl: string = '';
+  /** Public Mapbox token for this app (department's own when its override is on); '' keeps the built-in token. */
+  public AppMapboxAccessToken: string = '';
+  /** True when the department's own Mapbox account (token and custom style) is in effect; its style then waits for that token. */
+  public IsDepartmentMapOverride: boolean = false;
 }
diff --git a/src/services/__tests__/sso-discovery.test.ts b/src/services/__tests__/sso-discovery.test.ts
index ce602b4c..5876381e 100644
--- a/src/services/__tests__/sso-discovery.test.ts
+++ b/src/services/__tests__/sso-discovery.test.ts
@@ -40,9 +40,53 @@ describe('ssoDiscovery', () => {
 
       expect(mockedAxios.get).toHaveBeenCalledWith(
         'https://api.resgrid.dev/api/v4/connect/sso-config',
-        { params: { departmentCode: 'DEPT001' } },
+        { params: { departmentCode: 'DEPT001' }, headers: { 'X-Resgrid-Client': 'responder' } },
       );
-      expect(result).toEqual(mockConfig);
+      expect(result).toEqual({ ...mockConfig, departmentId: null, departmentToken: null, brokeredSsoAvailable: false, samlLoginUrl: null });
+    });
+
+    it('reads the PascalCase v4 payload, including the brokered SSO fields', async () => {
+      mockedAxios.get = jest.fn().mockResolvedValue({
+        data: {
+          Data: {
+            SsoEnabled: true,
+            ProviderType: 'saml2',
+            Authority: null,
+            ClientId: null,
+            MetadataUrl: 'https://idp.example.com/metadata',
+            EntityId: 'urn:resgrid',
+            AllowLocalLogin: false,
+            RequireSso: true,
+            RequireMfa: true,
+            OidcRedirectUri: null,
+            OidcScopes: null,
+            DepartmentId: 42,
+            DepartmentToken: 'enc-token',
+            BrokeredSsoAvailable: true,
+            SamlLoginUrl: 'https://api.example.com/api/v4/connect/saml-mobile-login?departmentToken=enc-token',
+          },
+        },
+      });
+
+      const result = await fetchDepartmentSsoConfig('DEPT001');
+
+      expect(result).toEqual({
+        ssoEnabled: true,
+        providerType: 'saml2',
+        authority: null,
+        clientId: null,
+        metadataUrl: 'https://idp.example.com/metadata',
+        entityId: 'urn:resgrid',
+        samlLoginUrl: 'https://api.example.com/api/v4/connect/saml-mobile-login?departmentToken=enc-token',
+        allowLocalLogin: false,
+        requireSso: true,
+        requireMfa: true,
+        oidcRedirectUri: '',
+        oidcScopes: '',
+        departmentId: 42,
+        departmentToken: 'enc-token',
+        brokeredSsoAvailable: true,
+      });
     });
 
     it('returns null when the API response has no Data field', async () => {
@@ -105,9 +149,9 @@ describe('ssoDiscovery', () => {
 
       expect(mockedAxios.get).toHaveBeenCalledWith(
         'https://api.resgrid.dev/api/v4/connect/sso-config-for-user',
-        { params: { username: 'jdoe@example.com' } },
+        { params: { username: 'jdoe@example.com' }, headers: { 'X-Resgrid-Client': 'responder' } },
       );
-      expect(result).toEqual(mockOidcConfig);
+      expect(result).toEqual({ ...mockOidcConfig, departmentId: null, departmentToken: null, brokeredSsoAvailable: false, samlLoginUrl: null });
     });
 
     it('includes departmentId param when provided', async () => {
@@ -117,7 +161,7 @@ describe('ssoDiscovery', () => {
 
       expect(mockedAxios.get).toHaveBeenCalledWith(
         'https://api.resgrid.dev/api/v4/connect/sso-config-for-user',
-        { params: { username: 'jdoe@example.com', departmentId: 42 } },
+        { params: { username: 'jdoe@example.com', departmentId: 42 }, headers: { 'X-Resgrid-Client': 'responder' } },
       );
     });
 
@@ -128,7 +172,7 @@ describe('ssoDiscovery', () => {
 
       expect(mockedAxios.get).toHaveBeenCalledWith(
         'https://api.resgrid.dev/api/v4/connect/sso-config-for-user',
-        { params: { username: 'jdoe@example.com' } },
+        { params: { username: 'jdoe@example.com' }, headers: { 'X-Resgrid-Client': 'responder' } },
       );
     });
 
diff --git a/src/services/push-notification.ts b/src/services/push-notification.ts
index 9ce4260c..53b8aaf4 100644
--- a/src/services/push-notification.ts
+++ b/src/services/push-notification.ts
@@ -325,6 +325,11 @@ class PushNotificationService {
         if (await PushNotificationService.deepLink('/(app)/messages', 'Failed to deep-link to messages from push notification', eventCode)) {
           return;
         }
+      } else if (parsed.type === 'mfa-approval' && isSafeRouteId(parsed.id)) {
+        // The approval screen reads the request from the server; the push carries only its id.
+        if (await PushNotificationService.deepLink({ pathname: '/approve-sign-in', params: { id: parsed.id } } as unknown as Href, 'Failed to open the approval request from push notification', eventCode)) {
+          return;
+        }
       } else if (parsed.type === 'work-order' && isSafeRouteId(parsed.id)) {
         // "NWO:{workOrderId}": the detail screen loads the order through the authorized v4 read.
         if (await PushNotificationService.deepLink({ pathname: '/work-orders/[id]', params: { id: parsed.id } } as Href, 'Failed to deep-link to work order from push notification', eventCode)) {
diff --git a/src/services/sso-discovery.ts b/src/services/sso-discovery.ts
index 52d45bc2..7283b083 100644
--- a/src/services/sso-discovery.ts
+++ b/src/services/sso-discovery.ts
@@ -1,5 +1,6 @@
 import axios from 'axios';
 
+import { CLIENT_HEADER, RESGRID_CLIENT } from '@/lib/mfa/client-app';
 import { getBaseApiUrl } from '@/lib/storage/app';
 
 export interface DepartmentSsoConfig {
@@ -9,20 +10,69 @@ export interface DepartmentSsoConfig {
   clientId: string | null;
   metadataUrl: string | null;
   entityId: string | null;
+  /** Where a SAML sign-in without the broker starts (discovery's SamlLoginUrl): this server's page, sent on to the IdP. */
+  samlLoginUrl: string | null;
   allowLocalLogin: boolean;
   requireSso: boolean;
   requireMfa: boolean;
   oidcRedirectUri: string;
   oidcScopes: string;
+  /** The department's id, when the lookup resolved one (never for an unknown user). */
+  departmentId: number | null;
+  /** A system-encrypted department reference for `Sso/Begin` (passkey workbook section 7.3 discovery fix). */
+  departmentToken: string | null;
+  /** Whether sign-in can go through the Resgrid broker for this department now (plan section 7.7.2). */
+  brokeredSsoAvailable: boolean;
 }
 
+type WireConfig = Record<string, unknown>;
+
+/**
+ * The v4 API is PascalCase (`SsoEnabled`, `Authority`, ...), like every other v4 model; reading the camelCase names left
+ * every field undefined, so SSO looked disabled. Both spellings are read so an older server still works.
+ */
+const read = (data: WireConfig, name: string): unknown => data[name.charAt(0).toUpperCase() + name.slice(1)] ?? data[name];
+
+const text = (value: unknown): string | null => (typeof value === 'string' && value.length > 0 ? value : null);
+
+export const normalizeSsoConfig = (data: unknown): DepartmentSsoConfig | null => {
+  if (typeof data !== 'object' || data === null) {
+    return null;
+  }
+  const wire = data as WireConfig;
+  const providerType = text(read(wire, 'providerType'));
+  const departmentId = read(wire, 'departmentId');
+  return {
+    ssoEnabled: read(wire, 'ssoEnabled') === true,
+    providerType: providerType === 'oidc' || providerType === 'saml2' ? providerType : null,
+    authority: text(read(wire, 'authority')),
+    clientId: text(read(wire, 'clientId')),
+    metadataUrl: text(read(wire, 'metadataUrl')),
+    entityId: text(read(wire, 'entityId')),
+    samlLoginUrl: text(read(wire, 'samlLoginUrl')),
+    allowLocalLogin: read(wire, 'allowLocalLogin') !== false,
+    requireSso: read(wire, 'requireSso') === true,
+    requireMfa: read(wire, 'requireMfa') === true,
+    oidcRedirectUri: text(read(wire, 'oidcRedirectUri')) ?? '',
+    oidcScopes: text(read(wire, 'oidcScopes')) ?? '',
+    departmentId: typeof departmentId === 'number' && departmentId > 0 ? departmentId : null,
+    departmentToken: text(read(wire, 'departmentToken')),
+    brokeredSsoAvailable: read(wire, 'brokeredSsoAvailable') === true,
+  };
+};
+
+// The server answers with this app's own legacy OIDC redirect URI (each app has its own scheme), so it is told which app
+// is asking.
+const clientHeaders = { [CLIENT_HEADER]: RESGRID_CLIENT };
+
 export async function fetchDepartmentSsoConfig(departmentCode: string): Promise<DepartmentSsoConfig | null> {
   try {
     const baseUrl = getBaseApiUrl();
     const response = await axios.get(`${baseUrl}/connect/sso-config`, {
       params: { departmentCode },
+      headers: clientHeaders,
     });
-    return (response.data?.Data as DepartmentSsoConfig) ?? null;
+    return normalizeSsoConfig(response.data?.Data);
   } catch (err) {
     throw new Error(`SSO config lookup failed for department "${departmentCode}": ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -41,8 +91,8 @@ export async function fetchUserSsoConfig(username: string, departmentId?: number
     if (departmentId !== undefined && departmentId > 0) {
       params.departmentId = departmentId;
     }
-    const response = await axios.get(`${baseUrl}/connect/sso-config-for-user`, { params });
-    return (response.data?.Data as DepartmentSsoConfig) ?? null;
+    const response = await axios.get(`${baseUrl}/connect/sso-config-for-user`, { params, headers: clientHeaders });
+    return normalizeSsoConfig(response.data?.Data);
   } catch (err) {
     throw new Error(`SSO config lookup failed for user "${username}": ${err instanceof Error ? err.message : String(err)}`);
   }
diff --git a/src/stores/app/__tests__/core-store.test.ts b/src/stores/app/__tests__/core-store.test.ts
index b6c482e6..8203ad65 100644
--- a/src/stores/app/__tests__/core-store.test.ts
+++ b/src/stores/app/__tests__/core-store.test.ts
@@ -69,6 +69,12 @@ jest.mock('@/lib/storage', () => ({
 	},
 }));
 
+// The token check itself talks to Mapbox; here only the hand-off from a config load matters.
+const mockApplyServerMapboxToken = jest.fn((_token: string | null | undefined): Promise<void> => Promise.resolve());
+jest.mock('@/lib/mapbox-token', () => ({
+	applyServerMapboxToken: (token: string | null | undefined) => mockApplyServerMapboxToken(token),
+}));
+
 // Import after mocks
 import { useCoreStore } from '../core-store';
 import { getConfig } from '@/api/config';
@@ -125,7 +131,11 @@ describe('Core Store', () => {
         AnalyticsHost: '',
         MapCenterLatitude: 0,
         MapCenterLongitude: 0,
-        MapCenterZoomLevel: 9
+        MapCenterZoomLevel: 9,
+        MapDayStyleUrl: '',
+        MapNightStyleUrl: '',
+        AppMapboxAccessToken: '',
+        IsDepartmentMapOverride: false
       },
 			PageSize: 0,
 			Timestamp: '',
@@ -321,6 +331,10 @@ describe('Core Store', () => {
 				MapCenterLatitude: 0,
 				MapCenterLongitude: 0,
 				MapCenterZoomLevel: 9,
+				MapDayStyleUrl: '',
+				MapNightStyleUrl: '',
+				AppMapboxAccessToken: '',
+				IsDepartmentMapOverride: false,
 			});
 			expect(result.current.activeStatuses).toEqual([
 				{
@@ -399,6 +413,10 @@ describe('Core Store', () => {
 				MapCenterLatitude: 0,
 				MapCenterLongitude: 0,
 				MapCenterZoomLevel: 9,
+				MapDayStyleUrl: '',
+				MapNightStyleUrl: '',
+				AppMapboxAccessToken: '',
+				IsDepartmentMapOverride: false,
 			});
 			expect(result.current.currentStatus).toBe(null);
 			expect(result.current.currentStaffing).toBe(null);
@@ -421,6 +439,73 @@ describe('Core Store', () => {
 		});
 	});
 
+	describe('Mapbox token', () => {
+		const SERVER_MAPBOX_TOKEN = 'pk.eyJ1IjoiY291bnR5LWZpcmUifQ.server-signature';
+
+		const serveMapboxToken = async (token: string) => {
+			const response = await mockGetConfig('test-app-key');
+			mockGetConfig.mockResolvedValue({ ...response, Data: { ...response.Data, AppMapboxAccessToken: token } });
+		};
+
+		it('should hand the server token to the token store after a successful init', async () => {
+			await serveMapboxToken(SERVER_MAPBOX_TOKEN);
+			const { result } = renderHook(() => useCoreStore());
+
+			await act(async () => {
+				await result.current.init();
+			});
+
+			expect(mockApplyServerMapboxToken).toHaveBeenCalledTimes(1);
+			expect(mockApplyServerMapboxToken).toHaveBeenCalledWith(SERVER_MAPBOX_TOKEN);
+		});
+
+		it('should not wait for the token check to finish init', async () => {
+			mockApplyServerMapboxToken.mockReturnValueOnce(new Promise<void>(() => undefined));
+			const { result } = renderHook(() => useCoreStore());
+
+			await act(async () => {
+				await result.current.init();
+			});
+
+			expect(result.current.isInitialized).toBe(true);
+			expect(result.current.isInitializing).toBe(false);
+		});
+
+		it('should not touch the token when init fails', async () => {
+			mockGetConfig.mockRejectedValue(new Error('API Error'));
+			const { result } = renderHook(() => useCoreStore());
+
+			await act(async () => {
+				await result.current.init();
+			});
+
+			expect(mockApplyServerMapboxToken).not.toHaveBeenCalled();
+		});
+
+		it('should hand the server token to the token store after a successful config fetch', async () => {
+			await serveMapboxToken(SERVER_MAPBOX_TOKEN);
+			const { result } = renderHook(() => useCoreStore());
+
+			await act(async () => {
+				await result.current.fetchConfig();
+			});
+
+			expect(mockApplyServerMapboxToken).toHaveBeenCalledTimes(1);
+			expect(mockApplyServerMapboxToken).toHaveBeenCalledWith(SERVER_MAPBOX_TOKEN);
+		});
+
+		it('should not touch the token when the config fetch fails', async () => {
+			mockGetConfig.mockRejectedValue(new Error('Config Error'));
+			const { result } = renderHook(() => useCoreStore());
+
+			await act(async () => {
+				await result.current.fetchConfig();
+			});
+
+			expect(mockApplyServerMapboxToken).not.toHaveBeenCalled();
+		});
+	});
+
 	describe('Store State', () => {
 		it('should have correct initial state', () => {
 			const { result } = renderHook(() => useCoreStore());
@@ -480,6 +565,10 @@ describe('Core Store', () => {
 				MapCenterLatitude: 0,
 				MapCenterLongitude: 0,
 				MapCenterZoomLevel: 9,
+				MapDayStyleUrl: '',
+				MapNightStyleUrl: '',
+				AppMapboxAccessToken: '',
+				IsDepartmentMapOverride: false,
 			});
 		});
 
diff --git a/src/stores/app/core-store.ts b/src/stores/app/core-store.ts
index b62f2ee4..b989be13 100644
--- a/src/stores/app/core-store.ts
+++ b/src/stores/app/core-store.ts
@@ -7,6 +7,7 @@ import { getAllPersonnelStatuses, getCurrentPersonStatus } from '@/api/satuses';
 import { getAllPersonnelStaffings, getCurrentPersonStaffing } from '@/api/staffing';
 import { useAuthStore } from '@/lib/auth';
 import { logger } from '@/lib/logging';
+import { applyServerMapboxToken } from '@/lib/mapbox-token';
 import { zustandStorage } from '@/lib/storage';
 import { type CallResultData } from '@/models/v4/calls/callResultData';
 import { type GetConfigResultData } from '@/models/v4/configs/getConfigResultData';
@@ -118,6 +119,11 @@ export const useCoreStore = create<CoreState>()(
             config: config.Data,
           });
 
+          // Fire and forget: checking the token with Mapbox must never hold up or fail init.
+          if (config.Data) {
+            void applyServerMapboxToken(config.Data.AppMapboxAccessToken);
+          }
+
           logger.info({
             message: 'Core store initialization completed successfully',
           });
@@ -165,6 +171,11 @@ export const useCoreStore = create<CoreState>()(
         try {
           const config = await getConfig(Env.APP_KEY);
           set({ config: config.Data });
+
+          // Fire and forget: checking the token with Mapbox must never hold up or fail the config load.
+          if (config.Data) {
+            void applyServerMapboxToken(config.Data.AppMapboxAccessToken);
+          }
         } catch (error) {
           set({ error: 'Failed to fetch config', isLoading: false });
           logger.error({
diff --git a/src/stores/auth/__tests__/login-mfa.test.ts b/src/stores/auth/__tests__/login-mfa.test.ts
new file mode 100644
index 00000000..d98128c1
--- /dev/null
+++ b/src/stores/auth/__tests__/login-mfa.test.ts
@@ -0,0 +1,286 @@
+import { completionGrantRequest } from '@/lib/auth/api';
+import { getPasskeyAssertion } from '@/lib/mfa/passkey';
+import { PasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { runSsoRoundTrip } from '@/lib/mfa/sso-browser';
+import * as api from '@/lib/mfa/transaction-api';
+
+import {
+  abandonFactorRecovery,
+  finishFactorRecovery,
+  forgetLoginSecrets,
+  hasLoginTransaction,
+  holdLoginTransaction,
+  type LoginMfaHost,
+  recoveryReplacementKey,
+  signInWithBrokeredSso,
+  startFactorRecovery,
+  startLoginApproval,
+  verifyLoginMfa,
+  waitForLoginApproval,
+} from '../login-mfa';
+
+jest.mock('@/lib/auth/api', () => ({ completionGrantRequest: jest.fn() }));
+jest.mock('@/lib/mfa/transaction-api');
+jest.mock('@/lib/mfa/passkey', () => ({ getPasskeyAssertion: jest.fn() }));
+jest.mock('@/lib/mfa/sso-browser', () => ({ runSsoRoundTrip: jest.fn() }));
+// As the real wait does: a decided status ends it, and a failed status call reads as unavailable.
+jest.mock('@/lib/mfa/approval-wait', () => ({
+  waitForApproval: jest.fn((status: () => Promise<unknown>) =>
+    status().then(
+      () => 'approved',
+      () => 'unavailable'
+    )
+  ),
+}));
+jest.mock('@/lib/logging', () => ({ logger: { info: jest.fn(), warn: jest.fn(), error: jest.fn() } }));
+
+const mocked = api as jest.Mocked<typeof api>;
+const grant = completionGrantRequest as jest.Mock;
+const tokens = { access_token: 'a', refresh_token: 'r', id_token: 'i', expires_in: 60, token_type: 'Bearer', expiration_date: '' };
+const completion = (extra: Record<string, unknown> = {}) => ({ CompletionCode: 'code-1', ExpiresIn: 60, Recovery: false, RecoveryCodes: null, ...extra });
+const refusal = (status: number, type: string, extra: Record<string, unknown> = {}) => Object.assign(new Error(type), { response: { status, data: { type, ...extra } } });
+
+const host = (): jest.Mocked<LoginMfaHost> => ({ signIn: jest.fn(), setChallenge: jest.fn(), restart: jest.fn() });
+
+describe('finishing a sign-in on the login transaction', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    forgetLoginSecrets();
+    grant.mockResolvedValue(tokens);
+  });
+
+  it('refuses without a transaction and sends the member back to the start', async () => {
+    const h = host();
+    expect(await verifyLoginMfa(h, { method: 'totp', code: '123456' })).toEqual({ ok: false, code: 'mfa_transaction_invalid', restart: true });
+    expect(h.restart).toHaveBeenCalledWith('mfa_transaction_invalid');
+    expect(mocked.completeTotp).not.toHaveBeenCalled();
+  });
+
+  it('signs in with a code, spends the completion once, and forgets the transaction', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.completeTotp.mockResolvedValue(completion());
+
+    expect(await verifyLoginMfa(h, { method: 'totp', code: ' 123456 ' })).toEqual({ ok: true, recovery: false });
+    expect(mocked.completeTotp).toHaveBeenCalledWith('secret', '123456');
+    expect(grant).toHaveBeenCalledWith('secret', 'code-1');
+    expect(h.signIn).toHaveBeenCalledWith(tokens, null);
+    expect(hasLoginTransaction()).toBe(false);
+  });
+
+  it('keeps the sign-in open after a wrong code, and ends it when the server says it is over', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.completeTotp.mockRejectedValueOnce(refusal(401, 'invalid_totp'));
+    expect(await verifyLoginMfa(h, { method: 'totp', code: '000000' })).toEqual({ ok: false, code: 'invalid_totp', restart: false });
+    expect(hasLoginTransaction()).toBe(true);
+    expect(h.restart).not.toHaveBeenCalled();
+
+    mocked.completeTotp.mockRejectedValueOnce(refusal(400, 'mfa_transaction_expired'));
+    expect(await verifyLoginMfa(h, { method: 'totp', code: '111111' })).toEqual({ ok: false, code: 'mfa_transaction_expired', restart: true });
+    expect(h.restart).toHaveBeenCalledWith('mfa_transaction_expired');
+    expect(hasLoginTransaction()).toBe(false);
+  });
+
+  it('ends the sign-in when the completion grant fails, since the factor is already spent', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.completeTotp.mockResolvedValue(completion());
+    grant.mockRejectedValueOnce(new Error('offline'));
+
+    expect(await verifyLoginMfa(h, { method: 'totp', code: '123456' })).toEqual({ ok: false, code: 'network_error', restart: true });
+    expect(h.restart).toHaveBeenCalledWith('network_error');
+    expect(h.signIn).not.toHaveBeenCalled();
+    expect(hasLoginTransaction()).toBe(false);
+  });
+
+  it('ends the sign-in when the tokens it returned cannot be used', async () => {
+    const h = host();
+    h.signIn.mockImplementation(() => {
+      throw new Error('Invalid ID token format');
+    });
+    holdLoginTransaction('secret');
+    mocked.completeTotp.mockResolvedValue(completion());
+
+    expect(await verifyLoginMfa(h, { method: 'totp', code: '123456' })).toEqual({ ok: false, code: 'unknown_error', restart: true });
+    expect(h.restart).toHaveBeenCalledWith('unknown_error');
+    expect(hasLoginTransaction()).toBe(false);
+  });
+
+  it('finishes setting up the required authenticator and hands the new recovery codes over once', async () => {
+    const h = host();
+    holdLoginTransaction('setup-secret');
+    mocked.completeTotpSetup.mockResolvedValue(completion({ RecoveryCodes: ['a', 'b'] }));
+    await verifyLoginMfa(h, { method: 'setup', code: '123456' });
+    expect(mocked.completeTotpSetup).toHaveBeenCalledWith('setup-secret', '123456');
+    expect(h.signIn).toHaveBeenCalledWith(tokens, ['a', 'b']);
+  });
+
+  it('signs in with a recovery code as a recovery sign-in', async () => {
+    holdLoginTransaction('secret');
+    mocked.completeRecoveryCode.mockResolvedValue(completion({ Recovery: true }));
+    expect(await verifyLoginMfa(host(), { method: 'recovery_code', code: 'ABCD-EFGH' })).toEqual({ ok: true, recovery: true });
+  });
+
+  it('runs a passkey prompt for this sign-in, and a closed prompt is not a failure', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.loginPasskeyOptions.mockResolvedValue({ RequestId: 'req-1', Options: { challenge: 'abc' } });
+    (getPasskeyAssertion as jest.Mock).mockResolvedValueOnce({ id: 'cred' });
+    mocked.completePasskey.mockResolvedValue(completion());
+    expect(await verifyLoginMfa(h, { method: 'passkey' })).toEqual({ ok: true, recovery: false });
+    expect(getPasskeyAssertion).toHaveBeenCalledWith({ challenge: 'abc' });
+    expect(mocked.completePasskey).toHaveBeenCalledWith('secret', 'req-1', { id: 'cred' });
+
+    holdLoginTransaction('secret');
+    (getPasskeyAssertion as jest.Mock).mockRejectedValueOnce(new PasskeyCeremonyError('cancelled'));
+    expect(await verifyLoginMfa(h, { method: 'passkey' })).toEqual({ ok: false, code: 'passkey_cancelled', restart: false });
+    expect(hasLoginTransaction()).toBe(true);
+  });
+
+  it('runs the provider step-up for this sign-in and redeems it with this round trip only', async () => {
+    holdLoginTransaction('secret');
+    (runSsoRoundTrip as jest.Mock).mockImplementationOnce(async (begin: (s: object) => Promise<unknown>) => {
+      await begin({ returnTarget: 'resgrid://sso-return', state: 's', codeChallenge: 'c', platform: 'ios' });
+      return { ok: true, trip: { ssoTransactionId: 'sso-1', ssoCode: 'code-9', codeVerifier: 'v' } };
+    });
+    mocked.completeFederated.mockResolvedValue(completion());
+
+    expect(await verifyLoginMfa(host(), { method: 'federated' })).toEqual({ ok: true, recovery: false });
+    expect(mocked.ssoBegin).toHaveBeenCalledWith({ Purpose: 'step_up', Transaction: 'secret', ReturnTarget: 'resgrid://sso-return', State: 's', CodeChallenge: 'c', Platform: 'ios' });
+    expect(mocked.completeFederated).toHaveBeenCalledWith('secret', 'sso-1', 'code-9', 'v');
+
+    holdLoginTransaction('secret');
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce({ ok: false, reason: 'cancelled' });
+    expect(await verifyLoginMfa(host(), { method: 'federated' })).toEqual({ ok: false, code: 'sso_cancelled', restart: false });
+  });
+
+  it('asks Responder to approve this sign-in and finishes with the approved request', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.requestLoginApproval.mockResolvedValue({ ApprovalRequestId: 'ap-1', MatchNumber: '42', ExpiresIn: 120 });
+    mocked.loginApprovalStatus.mockResolvedValue({ State: 'approved', ExpiresAt: null });
+    mocked.completeApproval.mockResolvedValue(completion());
+
+    expect(await startLoginApproval(h)).toEqual({ ApprovalRequestId: 'ap-1', MatchNumber: '42', ExpiresIn: 120 });
+    expect(await waitForLoginApproval(h, 'ap-1')).toBe('approved');
+    expect(mocked.loginApprovalStatus).toHaveBeenCalledWith('secret', 'ap-1');
+    expect(await verifyLoginMfa(h, { method: 'passkey_approval', approvalRequestId: 'ap-1' })).toEqual({ ok: true, recovery: false });
+    expect(mocked.completeApproval).toHaveBeenCalledWith('secret', 'ap-1');
+  });
+
+  it('sends the member back to the start when the sign-in itself ends while Responder is deciding', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.loginApprovalStatus.mockRejectedValue(refusal(400, 'mfa_transaction_expired'));
+
+    expect(await waitForLoginApproval(h, 'ap-1')).toBe('unavailable');
+    expect(h.restart).toHaveBeenCalledWith('mfa_transaction_expired');
+    expect(hasLoginTransaction()).toBe(false);
+  });
+
+  it('keeps the sign-in when a status check fails for another reason', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.loginApprovalStatus.mockRejectedValue(new Error('network'));
+
+    expect(await waitForLoginApproval(h, 'ap-1')).toBe('unavailable');
+    expect(h.restart).not.toHaveBeenCalled();
+    expect(hasLoginTransaction()).toBe(true);
+  });
+});
+
+describe('brokered single sign-on', () => {
+  const trip = { ok: true, trip: { ssoTransactionId: 'sso-1', ssoCode: 'code-1', codeVerifier: 'verifier' } };
+
+  beforeEach(() => {
+    jest.clearAllMocks();
+    forgetLoginSecrets();
+    grant.mockResolvedValue(tokens);
+  });
+
+  it('signs in directly when the provider sign-in needs no second factor', async () => {
+    const h = host();
+    (runSsoRoundTrip as jest.Mock).mockResolvedValue(trip);
+    mocked.ssoRedeem.mockResolvedValue({ Outcome: 'completed', Transaction: 't-1', CompletionCode: 'c-1', ExpiresIn: 60 } as never);
+
+    expect(await signInWithBrokeredSso(h, { departmentToken: 'dept' })).toEqual({ outcome: 'signed_in' });
+    expect(mocked.ssoRedeem).toHaveBeenCalledWith('sso-1', 'code-1', 'verifier');
+    expect(grant).toHaveBeenCalledWith('t-1', 'c-1');
+    expect(h.signIn).toHaveBeenCalledWith(tokens, null);
+  });
+
+  it('continues on the transaction the redemption started, with the methods as arrays', async () => {
+    const h = host();
+    (runSsoRoundTrip as jest.Mock).mockResolvedValue(trip);
+    mocked.ssoRedeem.mockResolvedValue({ Outcome: 'mfa_required', Transaction: 't-2', MfaMethods: ['totp', 'passkey'], MfaEnrolled: ['totp'], MfaPreferred: 'totp', ExpiresIn: 300 } as never);
+
+    const result = await signInWithBrokeredSso(h, { username: 'user1' });
+    expect(result).toMatchObject({ outcome: 'challenge', challenge: { kind: 'verify', methods: ['totp', 'passkey'], enrolled: ['totp'], preferred: 'totp', source: 'sso' } });
+    expect(h.setChallenge).toHaveBeenCalled();
+    mocked.completeTotp.mockResolvedValue(completion());
+    await verifyLoginMfa(h, { method: 'totp', code: '123456' });
+    expect(mocked.completeTotp).toHaveBeenCalledWith('t-2', '123456');
+  });
+
+  it('continues as the setup transaction when the department requires MFA the account does not have', async () => {
+    const h = host();
+    (runSsoRoundTrip as jest.Mock).mockResolvedValue(trip);
+    mocked.ssoRedeem.mockRejectedValue(refusal(409, 'mfa_enrollment_required', { mfa_setup_transaction: 'setup-1', mfa_expires_in: 300 }));
+
+    expect(await signInWithBrokeredSso(h, { username: 'user1' })).toMatchObject({ outcome: 'challenge', challenge: { kind: 'setup' } });
+    mocked.totpSetupOptions.mockResolvedValue({ SharedKey: 'k', AuthenticatorUri: 'otpauth://', ExpiresIn: 600 });
+    mocked.completeTotpSetup.mockResolvedValue(completion({ RecoveryCodes: ['x'] }));
+    await verifyLoginMfa(h, { method: 'setup', code: '123456' });
+    expect(mocked.completeTotpSetup).toHaveBeenCalledWith('setup-1', '123456');
+  });
+
+  it('reports a closed browser as cancelled and a refusal by its code', async () => {
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce({ ok: false, reason: 'cancelled' });
+    expect(await signInWithBrokeredSso(host(), { username: 'user1' })).toEqual({ outcome: 'cancelled' });
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce({ ok: false, reason: 'refused', code: 'sso_unavailable' });
+    expect(await signInWithBrokeredSso(host(), { username: 'user1' })).toEqual({ outcome: 'failed', code: 'sso_unavailable' });
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce(trip);
+    mocked.ssoRedeem.mockRejectedValueOnce(refusal(403, 'access_denied'));
+    expect(await signInWithBrokeredSso(host(), { username: 'user1' })).toEqual({ outcome: 'failed', code: 'access_denied' });
+  });
+});
+
+describe('"I lost my authenticator"', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    forgetLoginSecrets();
+  });
+
+  it('spends a recovery code on the sign-in, replaces the authenticator, and hands the new codes over once', async () => {
+    const h = host();
+    holdLoginTransaction('secret');
+    mocked.beginFactorRecovery.mockResolvedValue({ Transaction: 'recovery-1', State: 'pending', ExpiresIn: 600, NextActions: [], Passkeys: [] } as never);
+    mocked.prepareRecoveryReplacement.mockResolvedValue({ SharedKey: 'k', AuthenticatorUri: 'otpauth://', ExpiresIn: 600 });
+    mocked.completeFactorRecovery.mockResolvedValue({ RecoveryCodes: ['n1', 'n2'], SignInAgain: true });
+
+    expect(await startFactorRecovery(h, ' RC-1111 ')).toMatchObject({ passkeys: [] });
+    expect(mocked.beginFactorRecovery).toHaveBeenCalledWith('secret', 'RC-1111');
+    expect(hasLoginTransaction()).toBe(false);
+    expect(h.setChallenge).toHaveBeenCalledWith(null);
+
+    expect(await recoveryReplacementKey()).toMatchObject({ SharedKey: 'k' });
+    expect(mocked.prepareRecoveryReplacement).toHaveBeenCalledWith('recovery-1');
+    expect(await finishFactorRecovery('123456', ['pk-lost'])).toEqual({ recoveryCodes: ['n1', 'n2'] });
+    expect(mocked.completeFactorRecovery).toHaveBeenCalledWith('recovery-1', '123456', ['pk-lost']);
+    expect(await finishFactorRecovery('123456', [])).toEqual({ code: 'recovery_transaction_invalid', ended: true });
+  });
+
+  it('keeps the recovery open after a wrong code, and cancels it on request', async () => {
+    holdLoginTransaction('secret');
+    mocked.beginFactorRecovery.mockResolvedValue({ Transaction: 'recovery-1', State: 'pending', ExpiresIn: 600, NextActions: [], Passkeys: [] } as never);
+    await startFactorRecovery(host(), 'RC-1111');
+
+    mocked.completeFactorRecovery.mockRejectedValueOnce(refusal(401, 'invalid_totp'));
+    expect(await finishFactorRecovery('000000', [])).toEqual({ code: 'invalid_totp', ended: false });
+    mocked.cancelFactorRecovery.mockResolvedValue({ Transaction: null, State: 'canceled', ExpiresIn: 0, NextActions: null, Passkeys: null } as never);
+    await abandonFactorRecovery();
+    expect(mocked.cancelFactorRecovery).toHaveBeenCalledWith('recovery-1');
+    expect(await recoveryReplacementKey()).toEqual({ code: 'recovery_transaction_invalid' });
+  });
+});
diff --git a/src/stores/auth/login-mfa.ts b/src/stores/auth/login-mfa.ts
new file mode 100644
index 00000000..9af00b8d
--- /dev/null
+++ b/src/stores/auth/login-mfa.ts
@@ -0,0 +1,345 @@
+import { completionGrantRequest } from '@/lib/auth/api';
+import type { AuthResponse } from '@/lib/auth/types';
+import { logger } from '@/lib/logging';
+import { type ApprovalWaitResult, waitForApproval } from '@/lib/mfa/approval-wait';
+import { endsTransaction, type MfaProblem, toMfaProblem } from '@/lib/mfa/errors';
+import { getPasskeyAssertion } from '@/lib/mfa/passkey';
+import { isPasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { runSsoRoundTrip } from '@/lib/mfa/sso-browser';
+import {
+  beginFactorRecovery,
+  cancelFactorRecovery,
+  cancelLoginApproval,
+  completeApproval,
+  completeFactorRecovery,
+  completeFederated,
+  completePasskey,
+  completeRecoveryCode,
+  completeTotp,
+  completeTotpSetup,
+  loginApprovalStatus,
+  loginPasskeyOptions,
+  prepareRecoveryReplacement,
+  requestLoginApproval,
+  ssoBegin,
+  ssoRedeem,
+  totpSetupOptions,
+} from '@/lib/mfa/transaction-api';
+import { type ApprovalRequestData, type CompletionData, type MfaChallenge, parseMethods, type PasskeyData, type TotpSetupData } from '@/lib/mfa/types';
+
+// ---------------------------------------------------------------------------
+// Signing in on a login transaction (passkey plan sections 7.5, 7.7.2 and 6.2-6.3). The transaction and recovery
+// secrets are the only authority for finishing a sign-in, so they live in this module's memory only: never in the
+// persisted auth store, never in logs, and never past the sign-in they belong to.
+// ---------------------------------------------------------------------------
+
+let loginTransaction: string | null = null;
+let factorRecovery: string | null = null;
+
+/** A second factor for the current sign-in. */
+export type LoginMfaStep =
+  | { method: 'totp'; code: string }
+  | { method: 'recovery_code'; code: string }
+  | { method: 'passkey' }
+  | { method: 'passkey_approval'; approvalRequestId: string }
+  | { method: 'federated' }
+  | { method: 'setup'; code: string };
+
+export type LoginMfaResult = { ok: true; recovery: boolean } | { ok: false; code: string; restart: boolean };
+
+/** What the auth store provides: finishing a sign-in with tokens, and moving the visible sign-in state. */
+export interface LoginMfaHost {
+  signIn: (authResponse: AuthResponse, recoveryCodes: string[] | null) => void;
+  setChallenge: (challenge: MfaChallenge | null, error?: string | null) => void;
+  restart: (code: string) => void;
+}
+
+export const holdLoginTransaction = (secret: string | null): void => {
+  loginTransaction = secret;
+};
+
+export const hasLoginTransaction = (): boolean => loginTransaction !== null;
+
+/** Drops every sign-in secret: cancel, sign-out, or a sign-in that ended. */
+export const forgetLoginSecrets = (): void => {
+  loginTransaction = null;
+  factorRecovery = null;
+};
+
+/** The sign-in cannot finish any more: its secrets go, and the member starts again with the reason shown. */
+const ended = (host: LoginMfaHost, code: string): LoginMfaResult => {
+  forgetLoginSecrets();
+  host.restart(code);
+  return { ok: false, code, restart: true };
+};
+
+const failed = (host: LoginMfaHost, problem: MfaProblem): LoginMfaResult => (endsTransaction(problem) ? ended(host, problem.code) : { ok: false, code: problem.code, restart: false });
+
+/**
+ * Redeems the completion code. The factor is already spent and a completion is never issued twice, so a lost grant
+ * response or tokens this app cannot use end the sign-in rather than leaving the member to retry on a spent transaction.
+ */
+const finish = async (host: LoginMfaHost, secret: string, completion: CompletionData): Promise<LoginMfaResult> => {
+  let tokens: AuthResponse;
+  try {
+    tokens = await completionGrantRequest(secret, completion.CompletionCode);
+  } catch (error) {
+    return ended(host, toMfaProblem(error).code);
+  }
+  loginTransaction = null;
+  try {
+    host.signIn(tokens, completion.RecoveryCodes ?? null);
+  } catch {
+    logger.error({ message: 'Second-factor sign-in returned tokens that could not be used' });
+    return ended(host, 'unknown_error');
+  }
+  logger.info({ message: 'Signed in with a second factor', context: { recovery: completion.Recovery } });
+  return { ok: true, recovery: !!completion.Recovery };
+};
+
+/** Finishes the current sign-in with one second factor. A refusal that ends the sign-in sends the member back to the start. */
+export const verifyLoginMfa = async (host: LoginMfaHost, step: LoginMfaStep): Promise<LoginMfaResult> => {
+  const secret = loginTransaction;
+  if (!secret) {
+    host.restart('mfa_transaction_invalid');
+    return { ok: false, code: 'mfa_transaction_invalid', restart: true };
+  }
+
+  try {
+    let completion: CompletionData;
+    switch (step.method) {
+      case 'totp':
+        completion = await completeTotp(secret, step.code.trim());
+        break;
+      case 'recovery_code':
+        completion = await completeRecoveryCode(secret, step.code.trim());
+        break;
+      case 'setup':
+        completion = await completeTotpSetup(secret, step.code.trim());
+        break;
+      case 'passkey': {
+        const ceremony = await loginPasskeyOptions(secret);
+        const credential = await getPasskeyAssertion(ceremony.Options);
+        completion = await completePasskey(secret, ceremony.RequestId, credential);
+        break;
+      }
+      case 'passkey_approval':
+        completion = await completeApproval(secret, step.approvalRequestId);
+        break;
+      case 'federated': {
+        const trip = await runSsoRoundTrip((secrets) =>
+          ssoBegin({ Purpose: 'step_up', Transaction: secret, ReturnTarget: secrets.returnTarget, State: secrets.state, CodeChallenge: secrets.codeChallenge, Platform: secrets.platform })
+        );
+        if (!trip.ok) {
+          return trip.code ? failed(host, { code: trip.code, status: null }) : { ok: false, code: `sso_${trip.reason}`, restart: false };
+        }
+        completion = await completeFederated(secret, trip.trip.ssoTransactionId, trip.trip.ssoCode, trip.trip.codeVerifier);
+        break;
+      }
+    }
+    return await finish(host, secret, completion);
+  } catch (error) {
+    if (isPasskeyCeremonyError(error)) {
+      return { ok: false, code: `passkey_${error.reason}`, restart: false };
+    }
+    return failed(host, toMfaProblem(error));
+  }
+};
+
+// ---- Approve with Responder, from another app's sign-in ---------------------------------------------------------------
+
+export const startLoginApproval = async (host: LoginMfaHost): Promise<ApprovalRequestData | { code: string; restart: boolean }> => {
+  if (!loginTransaction) {
+    host.restart('mfa_transaction_invalid');
+    return { code: 'mfa_transaction_invalid', restart: true };
+  }
+  try {
+    return await requestLoginApproval(loginTransaction);
+  } catch (error) {
+    const result = failed(host, toMfaProblem(error));
+    return { code: result.ok ? 'unknown_error' : result.code, restart: !result.ok && result.restart };
+  }
+};
+
+/**
+ * Waits for the member's Responder to decide. A status refusal that ends the sign-in itself (it expired, or the policy
+ * changed) sends the member back to the start, as any other step does, instead of reading as the service being down.
+ */
+export const waitForLoginApproval = async (host: LoginMfaHost, approvalRequestId: string, signal?: AbortSignal): Promise<ApprovalWaitResult> => {
+  const secret = loginTransaction;
+  if (!secret) {
+    return 'unavailable';
+  }
+  const refused: { problem: MfaProblem | null } = { problem: null };
+  const decided = await waitForApproval(async () => {
+    try {
+      return await loginApprovalStatus(secret, approvalRequestId);
+    } catch (error) {
+      refused.problem = toMfaProblem(error);
+      throw error;
+    }
+  }, signal);
+  if (refused.problem) {
+    // As for any other step: only a refusal that ends the sign-in sends the member back to the start.
+    failed(host, refused.problem);
+  }
+  return decided;
+};
+
+export const cancelLoginApprovalRequest = async (approvalRequestId: string): Promise<void> => {
+  if (loginTransaction) {
+    await cancelLoginApproval(loginTransaction, approvalRequestId).catch(() => undefined);
+  }
+};
+
+// ---- Setting up the authenticator the department requires (plan section 6.2) ------------------------------------------
+
+export const loginSetupOptions = async (host: LoginMfaHost): Promise<TotpSetupData | { code: string; restart: boolean }> => {
+  if (!loginTransaction) {
+    host.restart('mfa_transaction_invalid');
+    return { code: 'mfa_transaction_invalid', restart: true };
+  }
+  try {
+    return await totpSetupOptions(loginTransaction);
+  } catch (error) {
+    const result = failed(host, toMfaProblem(error));
+    return { code: result.ok ? 'unknown_error' : result.code, restart: !result.ok && result.restart };
+  }
+};
+
+// ---- Brokered single sign-on (plan section 7.7.2) ---------------------------------------------------------------------
+
+export interface SsoDepartment {
+  departmentToken?: string;
+  departmentCode?: string;
+  username?: string;
+}
+
+export type BrokeredSsoResult = { outcome: 'signed_in' } | { outcome: 'challenge'; challenge: MfaChallenge } | { outcome: 'cancelled' } | { outcome: 'failed'; code: string };
+
+/** Signs in through the department's identity provider: the browser round trip, then the redemption, then a second factor if one is needed. */
+export const signInWithBrokeredSso = async (host: LoginMfaHost, department: SsoDepartment, ephemeral?: boolean): Promise<BrokeredSsoResult> => {
+  forgetLoginSecrets();
+  const trip = await runSsoRoundTrip(
+    (secrets) =>
+      ssoBegin({
+        Purpose: 'login',
+        ...(department.departmentToken ? { DepartmentToken: department.departmentToken } : {}),
+        ...(department.departmentCode ? { DepartmentCode: department.departmentCode } : {}),
+        ...(department.username ? { Username: department.username } : {}),
+        ReturnTarget: secrets.returnTarget,
+        State: secrets.state,
+        CodeChallenge: secrets.codeChallenge,
+        Platform: secrets.platform,
+      }),
+    ephemeral
+  );
+  if (!trip.ok) {
+    return trip.reason === 'cancelled' ? { outcome: 'cancelled' } : { outcome: 'failed', code: trip.code ?? `sso_${trip.reason}` };
+  }
+
+  try {
+    const redeemed = await ssoRedeem(trip.trip.ssoTransactionId, trip.trip.ssoCode, trip.trip.codeVerifier);
+    if (redeemed.Outcome === 'completed' && redeemed.Transaction && redeemed.CompletionCode) {
+      const tokens = await completionGrantRequest(redeemed.Transaction, redeemed.CompletionCode);
+      host.signIn(tokens, null);
+      return { outcome: 'signed_in' };
+    }
+    if (redeemed.Outcome === 'mfa_required' && redeemed.Transaction) {
+      loginTransaction = redeemed.Transaction;
+      const challenge: MfaChallenge = {
+        kind: 'verify',
+        methods: parseMethods(redeemed.MfaMethods),
+        enrolled: parseMethods(redeemed.MfaEnrolled),
+        preferred: parseMethods(redeemed.MfaPreferred)[0] ?? null,
+        expiresAt: redeemed.ExpiresIn > 0 ? Date.now() + redeemed.ExpiresIn * 1000 : null,
+        source: 'sso',
+      };
+      host.setChallenge(challenge);
+      return { outcome: 'challenge', challenge };
+    }
+    return { outcome: 'failed', code: 'sso_failed' };
+  } catch (error) {
+    // A department that requires MFA the account does not have yet continues as the setup transaction.
+    const body = (error as { response?: { data?: { type?: string; mfa_setup_transaction?: string; mfa_expires_in?: number } } })?.response?.data;
+    if (body?.type === 'mfa_enrollment_required' && body.mfa_setup_transaction) {
+      loginTransaction = body.mfa_setup_transaction;
+      const challenge: MfaChallenge = {
+        kind: 'setup',
+        methods: ['totp'],
+        enrolled: [],
+        preferred: 'totp',
+        expiresAt: typeof body.mfa_expires_in === 'number' ? Date.now() + body.mfa_expires_in * 1000 : null,
+        source: 'sso',
+      };
+      host.setChallenge(challenge);
+      return { outcome: 'challenge', challenge };
+    }
+    return { outcome: 'failed', code: toMfaProblem(error).code };
+  }
+};
+
+// ---- "I lost my authenticator" (plan sections 5.4 and 6.3) ------------------------------------------------------------
+
+export interface RecoveryStart {
+  passkeys: PasskeyData[];
+  expiresAt: number | null;
+}
+
+/** Spends a recovery code to open the restricted recovery. The sign-in itself ends; no session is created. */
+export const startFactorRecovery = async (host: LoginMfaHost, recoveryCode: string): Promise<RecoveryStart | { code: string; restart: boolean }> => {
+  const secret = loginTransaction;
+  if (!secret) {
+    host.restart('mfa_transaction_invalid');
+    return { code: 'mfa_transaction_invalid', restart: true };
+  }
+  try {
+    const started = await beginFactorRecovery(secret, recoveryCode.trim());
+    loginTransaction = null;
+    factorRecovery = started.Transaction;
+    // The sign-in is spent; recovery takes over, and nothing signs in until the member does so again.
+    host.setChallenge(null);
+    return { passkeys: started.Passkeys ?? [], expiresAt: started.ExpiresIn > 0 ? Date.now() + started.ExpiresIn * 1000 : null };
+  } catch (error) {
+    const result = failed(host, toMfaProblem(error));
+    return { code: result.ok ? 'unknown_error' : result.code, restart: !result.ok && result.restart };
+  }
+};
+
+export const recoveryReplacementKey = async (): Promise<TotpSetupData | { code: string }> => {
+  if (!factorRecovery) {
+    return { code: 'recovery_transaction_invalid' };
+  }
+  try {
+    return await prepareRecoveryReplacement(factorRecovery);
+  } catch (error) {
+    return { code: toMfaProblem(error).code };
+  }
+};
+
+/** Replaces the authenticator; every session ends and the member signs in again. Returns the new recovery codes, shown once. */
+export const finishFactorRecovery = async (code: string, removePasskeyIds: string[]): Promise<{ recoveryCodes: string[] } | { code: string; ended: boolean }> => {
+  if (!factorRecovery) {
+    return { code: 'recovery_transaction_invalid', ended: true };
+  }
+  try {
+    const done = await completeFactorRecovery(factorRecovery, code.trim(), removePasskeyIds);
+    factorRecovery = null;
+    return { recoveryCodes: done.RecoveryCodes ?? [] };
+  } catch (error) {
+    const problem = toMfaProblem(error);
+    const ended = endsTransaction(problem);
+    if (ended) {
+      factorRecovery = null;
+    }
+    return { code: problem.code, ended };
+  }
+};
+
+export const abandonFactorRecovery = async (): Promise<void> => {
+  const secret = factorRecovery;
+  factorRecovery = null;
+  if (secret) {
+    await cancelFactorRecovery(secret).catch(() => undefined);
+  }
+};
diff --git a/src/stores/auth/store.tsx b/src/stores/auth/store.tsx
index 82bfe580..28c69227 100644
--- a/src/stores/auth/store.tsx
+++ b/src/stores/auth/store.tsx
@@ -7,6 +7,8 @@ import { createJSONStorage, persist } from 'zustand/middleware';
 import { cacheManager } from '@/lib/cache/cache-manager';
 import { clearCacheScope, setCacheScope } from '@/lib/cache/cache-scope';
 import { logger } from '@/lib/logging';
+import type { ApprovalWaitResult } from '@/lib/mfa/approval-wait';
+import type { ApprovalRequestData, MfaChallenge, TotpSetupData } from '@/lib/mfa/types';
 import { clearAllAppData, LOGOUT_PRESERVED_STORAGE_KEYS } from '@/lib/storage/clear-all-data';
 
 import { externalTokenRequest, loginRequest, refreshTokenRequest } from '../../lib/auth/api';
@@ -14,6 +16,23 @@ import type { AuthResponse, AuthStatus, ExternalTokenCredentials, LoginCredentia
 import { type ProfileModel } from '../../lib/auth/types';
 import { getAuth } from '../../lib/auth/utils';
 import { getItem, removeItem, setItem, zustandStorage } from '../../lib/storage';
+import {
+  type BrokeredSsoResult,
+  cancelLoginApprovalRequest,
+  forgetLoginSecrets,
+  holdLoginTransaction,
+  type LoginMfaHost,
+  type LoginMfaResult,
+  type LoginMfaStep,
+  loginSetupOptions,
+  type RecoveryStart,
+  signInWithBrokeredSso,
+  type SsoDepartment,
+  startFactorRecovery,
+  startLoginApproval,
+  verifyLoginMfa,
+  waitForLoginApproval,
+} from './login-mfa';
 
 export const PENDING_SAML_STATE_KEY = 'pending_saml_state';
 
@@ -67,12 +86,34 @@ interface AuthState {
    * open its OTP prompt for a challenge it has no pending exchange to retry.
    */
   isSsoMfaPending: boolean;
+  /**
+   * A sign-in waiting for its second factor (or for the authenticator its department requires), when the server runs the
+   * login transaction. Not persisted: the transaction secret lives in `login-mfa` memory and dies with the process.
+   */
+  mfaChallenge: MfaChallenge | null;
+  /** Recovery codes from setting up an authenticator at sign-in, shown once after sign-in and then dropped. Never persisted. */
+  pendingRecoveryCodes: string[] | null;
 
   // Actions
   login: (credentials: LoginCredentials) => Promise<void>;
   loginWithSso: (credentials: ExternalTokenCredentials) => Promise<void>;
   /** Retries the pending SSO exchange with the user's authenticator code (2FA challenge). */
   retrySsoWithOtp: (otpCode: string) => Promise<void>;
+  /** Finishes the pending sign-in with a second factor (passkey plan section 7.5). */
+  verifyLoginMfa: (step: LoginMfaStep) => Promise<LoginMfaResult>;
+  /** Asks the member's Responder to approve the pending sign-in; the number is shown on this screen only. */
+  requestLoginApproval: () => Promise<ApprovalRequestData | { code: string; restart: boolean }>;
+  waitForLoginApproval: (approvalRequestId: string, signal?: AbortSignal) => Promise<ApprovalWaitResult>;
+  cancelLoginApproval: (approvalRequestId: string) => Promise<void>;
+  /** A new authenticator key for the setup the department requires. */
+  loginSetupOptions: () => Promise<TotpSetupData | { code: string; restart: boolean }>;
+  /** Abandons the pending sign-in; nothing of it is kept. */
+  cancelLoginMfa: () => void;
+  /** Signs in through the department's identity provider by way of the Resgrid broker (plan section 7.7.2). */
+  loginWithBrokeredSso: (department: SsoDepartment) => Promise<BrokeredSsoResult>;
+  dismissRecoveryCodes: () => void;
+  /** "I lost my authenticator": spends a recovery code on the pending sign-in to open the restricted recovery. */
+  beginFactorRecovery: (recoveryCode: string) => Promise<RecoveryStart | { code: string; restart: boolean }>;
   logout: (reason?: string) => Promise<void>;
   refreshAccessToken: () => Promise<void>;
   hydrate: () => void;
@@ -86,6 +127,41 @@ interface AuthState {
   shouldRefreshToken: () => boolean;
 }
 
+/**
+ * The signed-in state for a token response: the profile from the id token, and the persisted auth response. Throws on a
+ * missing or malformed id token, which no sign-in may continue without.
+ */
+const signedInState = (authResponse: AuthResponse): Partial<AuthState> => {
+  const tokenParts = authResponse.id_token?.split('.') ?? [];
+  if (tokenParts.length < 3 || !tokenParts[1]) {
+    throw new Error('Invalid ID token format');
+  }
+  const profileData = JSON.parse(sanitizeJson(decodeJwtPayload(tokenParts[1]))) as ProfileModel;
+  const now = Date.now();
+  setItem<AuthResponse>('authResponse', { ...authResponse, obtained_at: now });
+  return {
+    accessToken: authResponse.access_token ?? null,
+    refreshToken: authResponse.refresh_token ?? null,
+    accessTokenObtainedAt: now,
+    refreshTokenObtainedAt: now,
+    status: 'signedIn',
+    error: null,
+    profile: profileData,
+    userId: profileData.sub,
+    isFirstTime: false,
+  };
+};
+
+/**
+ * How the login transaction module moves this store: finishing a sign-in with tokens, showing a pending sign-in, or
+ * sending the member back to the start. Called only after the store exists.
+ */
+const mfaHost: LoginMfaHost = {
+  signIn: (authResponse, recoveryCodes) => useAuthStore.setState({ ...signedInState(authResponse), mfaChallenge: null, pendingRecoveryCodes: recoveryCodes }),
+  setChallenge: (challenge, error = null) => useAuthStore.setState({ status: challenge ? 'mfaRequired' : 'signedOut', mfaChallenge: challenge, error }),
+  restart: (code) => useAuthStore.setState({ status: 'signedOut', mfaChallenge: null, error: code }),
+};
+
 const useAuthStore = create<AuthState>()(
   persist(
     (set, get) => ({
@@ -99,6 +175,8 @@ const useAuthStore = create<AuthState>()(
       userId: null,
       isFirstTime: true,
       isSsoMfaPending: false,
+      mfaChallenge: null,
+      pendingRecoveryCodes: null,
       login: async (credentials: LoginCredentials) => {
         try {
           set({ status: 'loading' });
@@ -154,6 +232,13 @@ const useAuthStore = create<AuthState>()(
                 refreshTokenObtainedAt: now,
               },
             });
+          } else if (response.mfaTransaction) {
+            // The password was right; a second factor (or the setup the department requires) finishes the sign-in on the
+            // login transaction. The secret goes to login-mfa memory; the store only holds what the screen shows.
+            holdLoginTransaction(response.mfaTransaction.secret);
+            set({ status: 'mfaRequired', error: null, mfaChallenge: response.mfaTransaction.challenge });
+          } else if (response.enrollmentRequired) {
+            set({ status: 'error', error: 'mfa_enrollment_required', mfaChallenge: null });
           } else if (response.mfaRequired) {
             // 2FA challenge: the login screen prompts for the authenticator code and calls
             // login() again with otpCode. Credentials are never retained here.
@@ -164,6 +249,7 @@ const useAuthStore = create<AuthState>()(
             set({
               status: 'mfaRequired',
               error: response.invalidOtp ? 'invalid_totp' : null,
+              mfaChallenge: { kind: 'legacy', methods: ['totp'], enrolled: ['totp'], preferred: 'totp', expiresAt: null, source: 'password' },
             });
           } else {
             logger.error({
@@ -299,6 +385,28 @@ const useAuthStore = create<AuthState>()(
         await get().loginWithSso({ ...pendingSsoMfaCredentials, otpCode });
       },
 
+      verifyLoginMfa: (step: LoginMfaStep) => verifyLoginMfa(mfaHost, step),
+      requestLoginApproval: () => startLoginApproval(mfaHost),
+      waitForLoginApproval: (approvalRequestId: string, signal?: AbortSignal) => waitForLoginApproval(mfaHost, approvalRequestId, signal),
+      cancelLoginApproval: (approvalRequestId: string) => cancelLoginApprovalRequest(approvalRequestId),
+      loginSetupOptions: () => loginSetupOptions(mfaHost),
+      cancelLoginMfa: () => {
+        forgetLoginSecrets();
+        set({ status: 'signedOut', mfaChallenge: null, error: null });
+      },
+      loginWithBrokeredSso: async (department: SsoDepartment) => {
+        set({ status: 'loading', error: null, mfaChallenge: null });
+        const result = await signInWithBrokeredSso(mfaHost, department);
+        if (result.outcome === 'cancelled') {
+          set({ status: 'signedOut' });
+        } else if (result.outcome === 'failed') {
+          set({ status: 'error', error: result.code });
+        }
+        return result;
+      },
+      dismissRecoveryCodes: () => set({ pendingRecoveryCodes: null }),
+      beginFactorRecovery: (recoveryCode: string) => startFactorRecovery(mfaHost, recoveryCode),
+
       logout: async (reason?: string) => {
         const currentState = get();
         const wasAuthenticated = currentState.isAuthenticated();
@@ -359,9 +467,12 @@ const useAuthStore = create<AuthState>()(
           });
         }
 
-        // The retained IdP exchange is a credential; it must not outlive the session.
+        // The retained IdP exchange and any sign-in secrets are credentials; they must not outlive the session.
         pendingSsoMfaCredentials = null;
+        forgetLoginSecrets();
         set({
+          mfaChallenge: null,
+          pendingRecoveryCodes: null,
           accessToken: null,
           refreshToken: null,
           accessTokenObtainedAt: null,
@@ -664,9 +775,11 @@ const useAuthStore = create<AuthState>()(
     {
       name: 'auth-storage',
       storage: createJSONStorage(() => zustandStorage),
-      // The pending SSO exchange lives in module memory and dies with the process, so a rehydrated
-      // `true` here would open the OTP prompt with nothing to retry. Force it back to false.
-      merge: (persisted, current) => ({ ...current, ...(persisted as Partial<AuthState>), isSsoMfaPending: false }),
+      // A pending sign-in and recovery codes shown once are never written to storage.
+      partialize: ({ mfaChallenge: _mfaChallenge, pendingRecoveryCodes: _pendingRecoveryCodes, ...persisted }) => persisted,
+      // The pending SSO exchange and the login transaction live in module memory and die with the process, so a
+      // rehydrated pending state would open a prompt with nothing to finish. Force them back.
+      merge: (persisted, current) => ({ ...current, ...(persisted as Partial<AuthState>), isSsoMfaPending: false, mfaChallenge: null, pendingRecoveryCodes: null }),
     }
   )
 );
diff --git a/src/stores/data-protection/__tests__/step-up-methods.test.ts b/src/stores/data-protection/__tests__/step-up-methods.test.ts
new file mode 100644
index 00000000..8980ef4a
--- /dev/null
+++ b/src/stores/data-protection/__tests__/step-up-methods.test.ts
@@ -0,0 +1,100 @@
+jest.mock('@/api/data-protection/data-protection', () => ({
+  getDataProtectionCapabilities: jest.fn(),
+  requestProtectedGrant: jest.fn(),
+  verifyStepUp: jest.fn(),
+  getStepUpMethods: jest.fn(),
+  getStepUpPasskeyOptions: jest.fn(),
+  verifyStepUpPasskey: jest.fn(),
+  requestStepUpApproval: jest.fn(),
+  getStepUpApprovalStatus: jest.fn(),
+  cancelStepUpApproval: jest.fn(),
+  completeStepUpApproval: jest.fn(),
+  beginStepUpSso: jest.fn(),
+  completeStepUpFederated: jest.fn(),
+}));
+jest.mock('@/lib/logging', () => ({ logger: { error: jest.fn(), warn: jest.fn(), info: jest.fn(), debug: jest.fn() } }));
+jest.mock('@/lib/mfa/passkey', () => ({ getPasskeyAssertion: jest.fn(), passkeysSupported: jest.fn(() => true) }));
+jest.mock('@/lib/mfa/sso-browser', () => ({ runSsoRoundTrip: jest.fn() }));
+
+import * as api from '@/api/data-protection/data-protection';
+import { getPasskeyAssertion, passkeysSupported } from '@/lib/mfa/passkey';
+import { PasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { runSsoRoundTrip } from '@/lib/mfa/sso-browser';
+
+import { dataProtectionStore } from '../store';
+
+const mocked = api as jest.Mocked<typeof api>;
+const grant = () => ({ GrantId: 'g', GrantToken: 'token-1', StepUpExpiresOnUtc: new Date(Date.now() + 10 * 60 * 1000).toISOString(), StepUpWindowMinutes: 15 });
+const problem = (status: number, type: string) => Object.assign(new Error(type), { response: { status, data: { type } } });
+
+describe('protected data by every step-up method (passkey plan section 8.1)', () => {
+  beforeEach(() => {
+    jest.clearAllMocks();
+    dataProtectionStore.setState({ grantToken: null, stepUpExpiresAt: null, lastError: null, stepUpMethods: null, preferredStepUpMethod: null });
+  });
+
+  it('lists the member\'s methods, hides passkeys this device cannot use, and falls back to the code on an older server', async () => {
+    mocked.getStepUpMethods.mockResolvedValueOnce({ Methods: ['passkey', 'totp', 'passkey_approval'], Preferred: 'passkey', EnrolledMethods: [], AllowedMethods: [] });
+    await dataProtectionStore.getState().loadStepUpMethods();
+    expect(dataProtectionStore.getState().stepUpMethods).toEqual(['passkey', 'totp', 'passkey_approval']);
+
+    (passkeysSupported as jest.Mock).mockReturnValueOnce(false);
+    mocked.getStepUpMethods.mockResolvedValueOnce({ Methods: ['passkey', 'totp'], Preferred: 'passkey', EnrolledMethods: [], AllowedMethods: [] });
+    await dataProtectionStore.getState().loadStepUpMethods();
+    expect(dataProtectionStore.getState().stepUpMethods).toEqual(['totp']);
+
+    mocked.getStepUpMethods.mockRejectedValueOnce(problem(404, 'not_found'));
+    await dataProtectionStore.getState().loadStepUpMethods();
+    expect(dataProtectionStore.getState().stepUpMethods).toEqual(['totp']);
+  });
+
+  it('holds the grant a passkey returns, in memory only', async () => {
+    mocked.getStepUpPasskeyOptions.mockResolvedValue({ RequestId: 'req-1', Options: { challenge: 'abc' } });
+    (getPasskeyAssertion as jest.Mock).mockResolvedValue({ id: 'cred' });
+    mocked.verifyStepUpPasskey.mockResolvedValue(grant());
+
+    expect(await dataProtectionStore.getState().verifyPasskey()).toBe(true);
+    expect(mocked.verifyStepUpPasskey).toHaveBeenCalledWith('req-1', { id: 'cred' });
+    expect(dataProtectionStore.getState().getGrantHeaders()).toEqual({ 'X-Resgrid-Protected-Grant': 'token-1' });
+  });
+
+  it('reports a closed passkey prompt, and never treats a token-less answer as a grant', async () => {
+    mocked.getStepUpPasskeyOptions.mockResolvedValue({ RequestId: 'req-1', Options: {} });
+    (getPasskeyAssertion as jest.Mock).mockRejectedValueOnce(new PasskeyCeremonyError('cancelled'));
+    expect(await dataProtectionStore.getState().verifyPasskey()).toBe(false);
+    expect(dataProtectionStore.getState().lastError).toBe('passkey_cancelled');
+
+    (getPasskeyAssertion as jest.Mock).mockResolvedValueOnce({ id: 'cred' });
+    mocked.verifyStepUpPasskey.mockResolvedValueOnce({ GrantToken: null } as never);
+    expect(await dataProtectionStore.getState().verifyPasskey()).toBe(false);
+    expect(dataProtectionStore.getState().isStepUpActive()).toBe(false);
+  });
+
+  it('asks Responder, then redeems the approved request for a grant', async () => {
+    mocked.requestStepUpApproval.mockResolvedValue({ ApprovalRequestId: 'ap-1', MatchNumber: '07', ExpiresIn: 120 });
+    mocked.completeStepUpApproval.mockResolvedValue(grant());
+    expect(await dataProtectionStore.getState().requestApproval()).toEqual({ id: 'ap-1', number: '07' });
+    expect(await dataProtectionStore.getState().completeApproval('ap-1')).toBe(true);
+    expect(mocked.completeStepUpApproval).toHaveBeenCalledWith('ap-1');
+
+    mocked.requestStepUpApproval.mockRejectedValueOnce(problem(400, 'approval_unavailable'));
+    expect(await dataProtectionStore.getState().requestApproval()).toBeNull();
+    expect(dataProtectionStore.getState().lastError).toBe('approval_unavailable');
+  });
+
+  it('runs the provider step-up for protected data and redeems it once', async () => {
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce({ ok: true, trip: { ssoTransactionId: 'sso-1', ssoCode: 'code-1', codeVerifier: 'v' } });
+    mocked.completeStepUpFederated.mockResolvedValue(grant());
+    expect(await dataProtectionStore.getState().verifyFederated()).toBe(true);
+    expect(mocked.completeStepUpFederated).toHaveBeenCalledWith('sso-1', 'code-1', 'v');
+
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce({ ok: false, reason: 'cancelled' });
+    expect(await dataProtectionStore.getState().verifyFederated()).toBe(false);
+    expect(dataProtectionStore.getState().lastError).toBe('sso_cancelled');
+
+    (runSsoRoundTrip as jest.Mock).mockResolvedValueOnce({ ok: true, trip: { ssoTransactionId: 'sso-1', ssoCode: 'code-1', codeVerifier: 'v' } });
+    mocked.completeStepUpFederated.mockRejectedValueOnce(problem(401, 'federated_mfa_not_satisfied'));
+    expect(await dataProtectionStore.getState().verifyFederated()).toBe(false);
+    expect(dataProtectionStore.getState().lastError).toBe('federated_mfa_not_satisfied');
+  });
+});
diff --git a/src/stores/data-protection/store.ts b/src/stores/data-protection/store.ts
index 9f06938c..9bf3737f 100644
--- a/src/stores/data-protection/store.ts
+++ b/src/stores/data-protection/store.ts
@@ -1,8 +1,27 @@
 import { create } from 'zustand';
 
-import { getDataProtectionCapabilities, requestProtectedGrant, verifyStepUp } from '@/api/data-protection/data-protection';
+import {
+  beginStepUpSso,
+  cancelStepUpApproval,
+  completeStepUpApproval,
+  completeStepUpFederated,
+  getDataProtectionCapabilities,
+  getStepUpApprovalStatus,
+  getStepUpMethods,
+  getStepUpPasskeyOptions,
+  requestProtectedGrant,
+  requestStepUpApproval,
+  type StepUpResult,
+  verifyStepUp,
+  verifyStepUpPasskey,
+} from '@/api/data-protection/data-protection';
 import { setProtectedGrantProvider } from '@/lib/data-protection/grant-provider';
 import { logger } from '@/lib/logging';
+import { type ApprovalWaitResult, waitForApproval } from '@/lib/mfa/approval-wait';
+import { toMfaProblem } from '@/lib/mfa/errors';
+import { getPasskeyAssertion, passkeysSupported } from '@/lib/mfa/passkey';
+import { isPasskeyCeremonyError } from '@/lib/mfa/passkey-errors';
+import { runSsoRoundTrip } from '@/lib/mfa/sso-browser';
 import { registerStoreReset } from '@/lib/storage/clear-all-data';
 
 // ---------------------------------------------------------------------------
@@ -13,7 +32,11 @@ import { registerStoreReset } from '@/lib/storage/clear-all-data';
 // starts locked. The window is ABSOLUTE — activity never extends it.
 // ---------------------------------------------------------------------------
 
-export type StepUpErrorCode = 'invalid_totp' | 'mfa_not_enrolled' | 'too_many_attempts' | 'grants_not_configured' | 'unknown';
+/**
+ * Why the last step-up did not produce a grant. The first five are the TOTP path's own; the other methods report the
+ * server's code (or `passkey_*` / `sso_*` for a prompt or browser round trip that did not finish), shown via mfaErrorKey.
+ */
+export type StepUpErrorCode = 'invalid_totp' | 'mfa_not_enrolled' | 'too_many_attempts' | 'grants_not_configured' | 'unknown' | (string & {});
 
 /** What ensureGrant() concluded. The caller shows the OTP prompt only for 'step_up_required'. */
 export type GrantOutcome = 'granted' | 'step_up_required' | 'unavailable';
@@ -43,6 +66,19 @@ export interface DataProtectionState {
   openPrompt: () => void;
   closePrompt: () => void;
   lastError: StepUpErrorCode | null;
+  /** The step-up methods this member has and the department accepts for protected data; null until loaded. */
+  stepUpMethods: string[] | null;
+  preferredStepUpMethod: string | null;
+  loadStepUpMethods: () => Promise<void>;
+  /** A passkey for this app (plan section 8.1). */
+  verifyPasskey: () => Promise<boolean>;
+  /** Approve with Responder: returns the number to show on this screen only. */
+  requestApproval: () => Promise<{ id: string; number: string } | null>;
+  waitForApproval: (approvalRequestId: string, signal?: AbortSignal) => Promise<ApprovalWaitResult>;
+  completeApproval: (approvalRequestId: string) => Promise<boolean>;
+  cancelApproval: (approvalRequestId: string) => Promise<void>;
+  /** The department's identity provider, where it accepts its provider's MFA for protected data (plan section 7.8). */
+  verifyFederated: () => Promise<boolean>;
   fetchCapabilities: () => Promise<void>;
   /**
    * Tries to obtain a grant without prompting. Returns 'granted' when the department has exempted
@@ -78,6 +114,32 @@ const parseErrorCode = (error: unknown): StepUpErrorCode => {
 
 const problemType = (error: unknown): string | undefined => (error as { response?: { data?: { type?: string } } })?.response?.data?.type;
 
+/** The grant a step-up returned, when it is a usable one; a token-less or already-expired answer is a failure. */
+const grantFrom = (result: StepUpResult | undefined): { grantToken: string; stepUpExpiresAt: number } | null => {
+  const expiresAt = result?.StepUpExpiresOnUtc ? Date.parse(result.StepUpExpiresOnUtc) : NaN;
+  return result?.GrantToken && Number.isFinite(expiresAt) && expiresAt > Date.now() ? { grantToken: result.GrantToken, stepUpExpiresAt: expiresAt } : null;
+};
+
+/** Runs one step-up method; the grant it returns (memory only) becomes the window, and any refusal its code. */
+const stepUp = async (method: string, run: () => Promise<StepUpResult | null>): Promise<boolean> => {
+  dataProtectionStore.setState({ isVerifying: true, lastError: null });
+  try {
+    const result = await run();
+    if (!result) {
+      dataProtectionStore.setState({ isVerifying: false });
+      return false;
+    }
+    const grant = grantFrom(result);
+    dataProtectionStore.setState(grant ? { ...grant, isVerifying: false, lastError: null } : { isVerifying: false, lastError: 'unknown' });
+    return !!grant;
+  } catch (error) {
+    const code = isPasskeyCeremonyError(error) ? `passkey_${error.reason}` : toMfaProblem(error).code;
+    logger.warn({ message: 'ADP step-up failed', context: { method, errorType: code } });
+    dataProtectionStore.setState({ isVerifying: false, lastError: code });
+    return false;
+  }
+};
+
 export const dataProtectionStore = create<DataProtectionState>()((set, get) => ({
   capabilities: null,
   isCapabilitiesLoaded: false,
@@ -87,6 +149,48 @@ export const dataProtectionStore = create<DataProtectionState>()((set, get) => (
   isRequestingGrant: false,
   isPromptOpen: false,
   lastError: null,
+  stepUpMethods: null,
+  preferredStepUpMethod: null,
+  loadStepUpMethods: async () => {
+    try {
+      const methods = await getStepUpMethods();
+      const usable = (methods?.Methods ?? []).filter((m) => m !== 'passkey' || passkeysSupported());
+      set({ stepUpMethods: usable, preferredStepUpMethod: methods?.Preferred ?? null });
+    } catch {
+      // An older server has no methods list: the authenticator code is the step-up it has always offered.
+      set({ stepUpMethods: ['totp'], preferredStepUpMethod: 'totp' });
+    }
+  },
+  verifyPasskey: () =>
+    stepUp('passkey', async () => {
+      const ceremony = await getStepUpPasskeyOptions();
+      const credential = await getPasskeyAssertion(ceremony.Options);
+      return verifyStepUpPasskey(ceremony.RequestId, credential);
+    }),
+  requestApproval: async () => {
+    set({ lastError: null });
+    try {
+      const started = await requestStepUpApproval();
+      return { id: started.ApprovalRequestId, number: started.MatchNumber };
+    } catch (error) {
+      set({ lastError: toMfaProblem(error).code });
+      return null;
+    }
+  },
+  waitForApproval: (approvalRequestId: string, signal?: AbortSignal) => waitForApproval(() => getStepUpApprovalStatus(approvalRequestId), signal),
+  completeApproval: (approvalRequestId: string) => stepUp('passkey_approval', () => completeStepUpApproval(approvalRequestId)),
+  cancelApproval: async (approvalRequestId: string) => {
+    await cancelStepUpApproval(approvalRequestId).catch(() => undefined);
+  },
+  verifyFederated: () =>
+    stepUp('federated', async () => {
+      const trip = await runSsoRoundTrip((secrets) => beginStepUpSso(secrets));
+      if (!trip.ok) {
+        set({ lastError: trip.code ?? `sso_${trip.reason}` });
+        return null;
+      }
+      return completeStepUpFederated(trip.trip.ssoTransactionId, trip.trip.ssoCode, trip.trip.codeVerifier);
+    }),
   openPrompt: () => set({ isPromptOpen: true, lastError: null }),
   closePrompt: () => set({ isPromptOpen: false }),
   fetchCapabilities: async () => {
@@ -207,6 +311,8 @@ registerStoreReset('dataProtection', () => {
     isRequestingGrant: false,
     isPromptOpen: false,
     lastError: null,
+    stepUpMethods: null,
+    preferredStepUpMethod: null,
   });
 });
 
diff --git a/src/stores/push-notification/__tests__/mfa-approval-parsing.test.ts b/src/stores/push-notification/__tests__/mfa-approval-parsing.test.ts
new file mode 100644
index 00000000..69283c0f
--- /dev/null
+++ b/src/stores/push-notification/__tests__/mfa-approval-parsing.test.ts
@@ -0,0 +1,10 @@
+import { isSafeRouteId, parseNotificationData } from '../store';
+
+describe('approval request pushes', () => {
+  it('reads "NA:{id}" as an approval request (passkey plan section 7.9), not a call or a message', () => {
+    expect(parseNotificationData({ eventCode: 'NA:ap-123', title: 'Sign-in approval requested', body: '', data: {} })).toMatchObject({ type: 'mfa-approval', id: 'ap-123' });
+    expect(parseNotificationData({ eventCode: 'na:ap-9', title: '', body: '', data: {} }).type).toBe('mfa-approval');
+    expect(isSafeRouteId('ap-123')).toBe(true);
+    expect(isSafeRouteId('../x')).toBe(false);
+  });
+});
diff --git a/src/stores/push-notification/store.ts b/src/stores/push-notification/store.ts
index 014e190a..397800ea 100644
--- a/src/stores/push-notification/store.ts
+++ b/src/stores/push-notification/store.ts
@@ -9,7 +9,7 @@ export interface PushNotificationData {
   data?: Record<string, unknown>;
 }
 
-export type NotificationType = 'call' | 'message' | 'chat' | 'group-chat' | 'weather' | 'communication-test' | 'work-order' | 'unknown';
+export type NotificationType = 'call' | 'message' | 'chat' | 'group-chat' | 'weather' | 'communication-test' | 'work-order' | 'mfa-approval' | 'unknown';
 
 export interface ParsedNotification {
   type: NotificationType;
@@ -35,6 +35,8 @@ interface PushNotificationModalState {
 const EVENT_CODE_TYPES: Record<string, NotificationType> = {
   ct: 'communication-test',
   nwo: 'work-order',
+  // "NA:{approvalRequestId}": another app asks this member to approve a sign-in or action (passkey plan section 7.9).
+  na: 'mfa-approval',
 };
 
 // First character of the event code prefix sent by the Resgrid backend, e.g.
diff --git a/src/translations/ar.json b/src/translations/ar.json
index bf9d0185..c8d24635 100644
--- a/src/translations/ar.json
+++ b/src/translations/ar.json
@@ -408,7 +408,7 @@
     "category": "الفئة (دورة، تمرين، مؤتمر)",
     "certificateAttached": "الشهادة مرفقة",
     "creditAdded": "تمت إضافة الساعات.",
-    "creditDate": "التاريخ (yyyy-mm-dd، فارغ لليوم)",
+    "creditDate": "التاريخ (اليوم افتراضيًا)",
     "creditNote": "ما هو",
     "credits": "{{hours}} من {{required}} ساعة تعليم مستمر",
     "creditsTitle": "{{hours}} ساعة تعليم مستمر",
@@ -427,13 +427,13 @@
     "form": {
       "area": "المجال أو المستوى",
       "choosePhoto": "اختيار صورة",
-      "expiresOn": "تاريخ الانتهاء (yyyy-mm-dd)",
+      "expiresOn": "تاريخ الانتهاء",
       "issuedBy": "الجهة المصدرة",
       "name": "الاسم",
       "number": "الرقم",
       "otherType": "أخرى (أدخل اسمًا)",
       "photoAttached": "تم إرفاق الصورة.",
-      "receivedOn": "تاريخ الحصول (yyyy-mm-dd)",
+      "receivedOn": "تاريخ الحصول",
       "save": "حفظ",
       "takePhoto": "صورة البطاقة",
       "type": "الشهادة"
@@ -443,7 +443,7 @@
     "hoursInvalid": "أدخل عدد ساعات أكبر من 0.",
     "issuedByIs": "صادرة عن {{name}}",
     "nameRequired": "اختر نوعًا أو أدخل اسمًا.",
-    "newExpiry": "تاريخ الانتهاء الجديد (yyyy-mm-dd)",
+    "newExpiry": "تاريخ الانتهاء الجديد",
     "newNumber": "رقم جديد (اختياري)",
     "noExpiry": "لا تنتهي",
     "none": "لم تضف أي شهادات بعد.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "البيانات المحمية غير متاحة بعد على هذا الخادم. تواصل مع المسؤول.",
     "step_up_verify": "تأكيد"
   },
+  "dateTimePicker": {
+    "clear": "مسح",
+    "date": "التاريخ",
+    "hour": "الساعة",
+    "minute": "الدقيقة"
+  },
   "form": {
     "invalid_url": "يرجى إدخال عنوان URL صالح يبدأ بـ http:// أو https://",
     "required": "هذا الحقل مطلوب"
@@ -1304,6 +1310,171 @@
       "subject_required": "الموضوع مطلوب"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "عمليات التحقق الأخيرة",
+      "activity_failed": "محاولة فاشلة باستخدام {{method}} {{app}}",
+      "activity_ok": "تم التحقق باستخدام {{method}} {{app}}",
+      "add_passkey": "إضافة مفتاح مرور",
+      "approvals": "موافقات Responder",
+      "approvals_off": "تم إيقاف الموافقات",
+      "approvals_on": "يوافق على تسجيلات الدخول",
+      "authenticator": "تطبيق المصادقة",
+      "authenticator_off": "غير مُعد. أعدّه في Resgrid على الويب.",
+      "authenticator_on": "مفعّل منذ {{time}}",
+      "linked": "تسجيل الدخول عبر المؤسسة",
+      "linked_step_up": "يقبل التحقق الخاص بها",
+      "no_activity": "لا توجد عمليات تحقق في آخر 30 يومًا.",
+      "no_passkeys": "لا توجد مفاتيح مرور لهذا التطبيق بعد.",
+      "not_me": "لم أكن أنا",
+      "passkey_added": "تمت إضافة مفتاح المرور.",
+      "passkey_approves": "استخدمه للموافقة على تسجيلات الدخول",
+      "passkey_created": "أضيف في {{time}}",
+      "passkey_last_used": "آخر استخدام {{time}}",
+      "passkey_removed": "تمت إزالة مفتاح المرور.",
+      "passkeys_elsewhere": "{{app}}: {{count}} مفاتيح مرور",
+      "passkeys_here": "مفاتيح المرور لهذا التطبيق",
+      "password_placeholder": "كلمة المرور",
+      "reauth_body": "أدخل كلمة المرور للمتابعة.",
+      "reauth_provider_body": "يسجّل قسمك الدخول عبر مؤسسته. سجّل الدخول هناك مجددًا للمتابعة.",
+      "reauth_title": "أكّد هويتك",
+      "recovery_codes_left": "رموز الاسترداد المتبقية: {{count}}",
+      "remove": "إزالة",
+      "rename": "إعادة تسمية",
+      "reported": "تم الإبلاغ. انتهت الجلسة المرتبطة. ننصح بتغيير كلمة المرور.",
+      "save": "حفظ",
+      "step_up_body": "يتطلب تغيير طريقة تسجيل الدخول رمزًا جديدًا من تطبيق المصادقة أو مفتاح مرور لهذا التطبيق.",
+      "step_up_title": "تحقق بالعامل الثاني",
+      "stop_approvals": "إيقاف الموافقات",
+      "this_device": "هذا الجهاز",
+      "title": "تسجيل الدخول والأمان"
+    },
+    "approval": {
+      "cancel": "إيقاف الانتظار",
+      "number_accessibility": "رقم الموافقة {{number}}",
+      "number_label": "في Responder، أدخل هذا الرقم:",
+      "waiting": "في انتظار موافقتك في Responder…"
+    },
+    "approve": {
+      "app": "التطبيق: {{app}}",
+      "approve": "موافقة",
+      "approved": "تمت الموافقة. يمكنك العودة إلى الشاشة الأخرى.",
+      "denied": "تم الرفض. لم تتم الموافقة على أي شيء.",
+      "deny": "رفض",
+      "department": "القسم: {{department}}",
+      "done": "تم",
+      "expires": "تنتهي الصلاحية في {{time}}",
+      "installation": "الجهاز: {{label}}",
+      "none": "لا يوجد شيء بانتظار موافقتك.",
+      "not_me": "لم أكن أنا",
+      "number_body": "أدخل الرقم الظاهر على الشاشة الأخرى، ثم أكّد بمفتاح المرور. وافق فقط إذا بدأت هذا بنفسك.",
+      "number_mismatch": "هذا ليس الرقم الموجود على الشاشة الأخرى. المحاولات المتبقية: {{count}}.",
+      "number_placeholder": "الرقم",
+      "origin": "بالقرب من: {{origin}}",
+      "purpose": {
+        "adp": "شخص ما يريد عرض معلومات محمية",
+        "department_entry": "شخص ما ينتقل إلى قسم باسمك",
+        "login": "شخص ما يسجّل الدخول إلى حسابك",
+        "step_up": "شخص ما يؤكد إجراءً بحسابك",
+        "unlock": "شخص ما يفتح جهازًا مشتركًا باسمك"
+      },
+      "shared": "على جهاز مشترك",
+      "title": "الموافقة على تسجيل الدخول؟",
+      "unknown_app": "تطبيق Resgrid آخر"
+    },
+    "errors": {
+      "access_denied": "لم تسمح مؤسستك بتسجيل الدخول.",
+      "approval_denied": "تم رفض الطلب في Responder.",
+      "approval_expired": "انتهت صلاحية طلب الموافقة. اطلب مجددًا أو استخدم طريقة أخرى.",
+      "approval_pending": "لا تزال بانتظار الموافقة في Responder.",
+      "approval_suspended": "طلبات الموافقة متوقفة لبضع دقائق. استخدم طريقة أخرى.",
+      "approval_unavailable": "الموافقة عبر Responder غير متاحة لهذا الحساب هنا.",
+      "challenge_consumed": "استُخدم هذا الطلب من قبل. ابدأ من جديد.",
+      "challenge_expired": "انتهت صلاحية الطلب. ابدأ من جديد.",
+      "federated_identity_mismatch": "حساب المؤسسة هذا ليس الحساب المسجّل هنا.",
+      "federated_mfa_not_satisfied": "لم يؤكد تسجيل دخول مؤسستك عاملًا ثانيًا. استخدم طريقة أخرى.",
+      "invalid_recovery_code": "رمز الاسترداد غير صالح أو استُخدم من قبل.",
+      "invalid_totp": "الرمز غير صالح أو منتهي الصلاحية. أدخل الرمز الحالي من تطبيق المصادقة.",
+      "mfa_enrollment_required": "يتطلب قسمك المصادقة الثنائية. أعدّ تطبيق مصادقة في Resgrid على الويب ثم سجّل الدخول مجددًا.",
+      "mfa_method_not_allowed": "هذه الطريقة غير متاحة هنا. استخدم طريقة أخرى.",
+      "mfa_not_enrolled": "لم يتم إعداد المصادقة الثنائية لحسابك.",
+      "mfa_transaction_expired": "استغرق تسجيل الدخول وقتًا طويلاً. سجّل الدخول مجددًا.",
+      "mfa_transaction_invalid": "لم يعد تسجيل الدخول هذا صالحًا. سجّل الدخول مجددًا.",
+      "network_error": "تعذر الوصول إلى Resgrid. تحقق من اتصالك وحاول مرة أخرى.",
+      "passkey_cancelled": "أُغلق طلب مفتاح المرور. حاول مجددًا أو استخدم طريقة أخرى.",
+      "passkey_failed": "تعذر استخدام مفتاح المرور. حاول مجددًا أو استخدم طريقة أخرى.",
+      "passkey_no_credentials": "لم يُعثر على مفتاح مرور لهذا التطبيق على هذا الجهاز.",
+      "passkey_not_registered_for_client": "ليس لديك مفتاح مرور لهذا التطبيق.",
+      "passkey_not_supported": "مفاتيح المرور غير متاحة على هذا الجهاز. استخدم طريقة أخرى.",
+      "passkey_verification_failed": "تعذر التحقق من مفتاح المرور.",
+      "passkeys_unavailable": "مفاتيح المرور غير متاحة هنا.",
+      "policy_changed": "تغيرت سياسة تسجيل الدخول في قسمك. سجّل الدخول مجددًا.",
+      "reauthentication_required": "أكّد كلمة المرور أولاً.",
+      "recovery_transaction_expired": "استغرق الاسترداد وقتًا طويلاً. سجّل الدخول وابدأ من جديد.",
+      "recovery_transaction_invalid": "لم يعد هذا الاسترداد صالحًا. سجّل الدخول وابدأ من جديد.",
+      "service_unavailable": "تسجيل الدخول غير متاح مؤقتًا. حاول بعد قليل.",
+      "session_revoked": "انتهى تسجيل دخولك. سجّل الدخول مجددًا.",
+      "setup_expired": "انتهت صلاحية مفتاح الإعداد. يظهر مفتاح جديد؛ أضفه مجددًا.",
+      "shared_session_lock_changed": "قُفل هذا الجهاز مرة أخرى. افتحه مجددًا.",
+      "sso_cancelled": "أُغلق تسجيل الدخول عبر المؤسسة.",
+      "sso_denied": "لم تسمح مؤسستك بتسجيل الدخول.",
+      "sso_failed": "تعذر إكمال تسجيل الدخول عبر المؤسسة. ابدأ من جديد.",
+      "sso_reauthentication_required": "سجّل الدخول عبر مؤسستك للمتابعة.",
+      "sso_state_mismatch": "لم يعد تسجيل الدخول عبر المؤسسة إلى هذا التطبيق. ابدأ من جديد.",
+      "sso_unavailable": "تسجيل الدخول عبر المؤسسة غير متاح الآن.",
+      "step_up_required": "تحقق بالعامل الثاني أولاً.",
+      "too_many_attempts": "محاولات كثيرة جدًا. انتظر بضع دقائق وحاول مجددًا.",
+      "unknown_error": "لم ينجح ذلك. حاول مرة أخرى."
+    },
+    "login": {
+      "body": "كانت كلمة المرور صحيحة. أكمل تسجيل الدخول بإحدى هذه الطرق.",
+      "code_placeholder": "رمز من 6 أرقام",
+      "lost_factor": "فقدت تطبيق المصادقة",
+      "recovery_body": "أدخل أحد رموز الاسترداد التي حفظتها. يعمل كل رمز مرة واحدة.",
+      "recovery_placeholder": "رمز الاسترداد",
+      "title": "تحقق من هويتك",
+      "use_approval": "الموافقة عبر Responder",
+      "use_other_method": "استخدام طريقة أخرى",
+      "use_passkey": "استخدام مفتاح مرور",
+      "use_provider": "التحقق عبر مؤسستك",
+      "use_recovery_code": "استخدام رمز استرداد",
+      "verify": "تحقق"
+    },
+    "methods": {
+      "federated": "تسجيل دخول المؤسسة",
+      "passkey": "مفتاح مرور",
+      "passkey_approval": "موافقة Responder",
+      "recovery_code": "رمز استرداد",
+      "totp": "رمز المصادقة"
+    },
+    "recovery": {
+      "back_to_sign_in": "العودة إلى تسجيل الدخول",
+      "begin": "متابعة",
+      "cancel": "إلغاء الاسترداد",
+      "code_body": "أدخل رمز استرداد لاستبدال تطبيق المصادقة. ستضيف تطبيقًا جديدًا بعد ذلك، وتُنهى كل الجلسات.",
+      "done_body": "تم استبدال تطبيق المصادقة وإنهاء كل الجلسات. احفظ رموز الاسترداد الجديدة ثم سجّل الدخول.",
+      "finish": "استبدال تطبيق المصادقة",
+      "help_body": "يتطلب الاسترداد رمز استرداد يُدخل بعد كلمة المرور أو تسجيل دخول المؤسسة. بدونه، اطلب المساعدة من مسؤول قسمك أو دعم Resgrid؛ لا يمكن إيقاف المصادقة الثنائية من هنا.",
+      "no_code": "ليس لدي رمز استرداد",
+      "remove_passkeys": "إزالة مفاتيح المرور المفقودة",
+      "replace_body": "أضف هذا المفتاح إلى تطبيق مصادقة جديد وأدخل الرمز الذي يظهره. اختر مفاتيح المرور المفقودة لإزالتها.",
+      "sign_in": "تسجيل الدخول",
+      "title": "استرداد حسابك"
+    },
+    "recovery_codes": {
+      "body": "احتفظ بها في مكان آمن. يعمل كل منها مرة واحدة إذا فقدت تطبيق المصادقة. لن تظهر مجددًا.",
+      "copied": "تم النسخ",
+      "copy": "نسخ الرموز",
+      "saved": "لقد حفظتها",
+      "title": "احفظ رموز الاسترداد"
+    },
+    "setup": {
+      "body": "يتطلب قسمك المصادقة الثنائية. أضف هذا المفتاح إلى تطبيق المصادقة، ثم أدخل الرمز الذي يظهره.",
+      "key_label": "مفتاح الإعداد",
+      "open_app": "فتح في تطبيق المصادقة",
+      "title": "إعداد تطبيق مصادقة"
+    }
+  },
   "not_found": {
     "go_home": "اذهب إلى الشاشة الرئيسية!",
     "message": "هذه الشاشة غير موجودة.",
diff --git a/src/translations/de.json b/src/translations/de.json
index f3d6b87e..c53b003a 100644
--- a/src/translations/de.json
+++ b/src/translations/de.json
@@ -408,7 +408,7 @@
     "category": "Kategorie (Lehrgang, Übung, Tagung)",
     "certificateAttached": "Zertifikat angehängt",
     "creditAdded": "Stunden hinzugefügt.",
-    "creditDate": "Datum (jjjj-mm-tt, leer für heute)",
+    "creditDate": "Datum (standardmäßig heute)",
     "creditNote": "Was es war",
     "credits": "{{hours}} von {{required}} Fortbildungsstunden",
     "creditsTitle": "{{hours}} Fortbildungsstunden",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Bereich oder Stufe",
       "choosePhoto": "Foto auswählen",
-      "expiresOn": "Läuft ab (jjjj-mm-tt)",
+      "expiresOn": "Läuft ab",
       "issuedBy": "Ausgestellt von",
       "name": "Name",
       "number": "Nummer",
       "otherType": "Andere (Namen eingeben)",
       "photoAttached": "Foto angehängt.",
-      "receivedOn": "Erworben (jjjj-mm-tt)",
+      "receivedOn": "Erworben",
       "save": "Speichern",
       "takePhoto": "Foto des Ausweises",
       "type": "Qualifikation"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Geben Sie mehr als 0 Stunden ein.",
     "issuedByIs": "Ausgestellt von {{name}}",
     "nameRequired": "Wählen Sie einen Typ oder geben Sie einen Namen ein.",
-    "newExpiry": "Neues Ablaufdatum (jjjj-mm-tt)",
+    "newExpiry": "Neues Ablaufdatum",
     "newNumber": "Neue Nummer (optional)",
     "noExpiry": "Läuft nicht ab",
     "none": "Sie haben noch keine Qualifikationen hinzugefügt.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Geschützte Daten sind auf diesem Server noch nicht verfügbar. Wenden Sie sich an Ihre Administration.",
     "step_up_verify": "Bestätigen"
   },
+  "dateTimePicker": {
+    "clear": "Löschen",
+    "date": "Datum",
+    "hour": "Stunde",
+    "minute": "Minute"
+  },
   "form": {
     "invalid_url": "Bitte geben Sie eine gültige URL ein, die mit http:// oder https:// beginnt",
     "required": "Dieses Feld ist erforderlich"
@@ -1304,6 +1310,171 @@
       "subject_required": "Betreff ist erforderlich"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Letzte Bestätigungen",
+      "activity_failed": "Fehlgeschlagener Versuch mit {{method}} {{app}}",
+      "activity_ok": "Bestätigt mit {{method}} {{app}}",
+      "add_passkey": "Passkey hinzufügen",
+      "approvals": "Responder-Bestätigungen",
+      "approvals_off": "Bestätigungen beendet",
+      "approvals_on": "Bestätigt Anmeldungen",
+      "authenticator": "Authentifizierungs-App",
+      "authenticator_off": "Nicht eingerichtet. Richten Sie sie in Resgrid im Web ein.",
+      "authenticator_on": "Aktiv seit {{time}}",
+      "linked": "Anmeldung über die Organisation",
+      "linked_step_up": "akzeptiert deren Bestätigung",
+      "no_activity": "Keine Bestätigungen in den letzten 30 Tagen.",
+      "no_passkeys": "Noch keine Passkeys für diese App.",
+      "not_me": "Das war ich nicht",
+      "passkey_added": "Passkey hinzugefügt.",
+      "passkey_approves": "Zum Bestätigen von Anmeldungen verwenden",
+      "passkey_created": "Hinzugefügt {{time}}",
+      "passkey_last_used": "Zuletzt verwendet {{time}}",
+      "passkey_removed": "Passkey entfernt.",
+      "passkeys_elsewhere": "{{app}}: {{count}} Passkeys",
+      "passkeys_here": "Passkeys für diese App",
+      "password_placeholder": "Passwort",
+      "reauth_body": "Geben Sie Ihr Passwort ein, um fortzufahren.",
+      "reauth_provider_body": "Ihre Abteilung meldet sich über ihre Organisation an. Melden Sie sich dort erneut an, um fortzufahren.",
+      "reauth_title": "Bestätigen Sie Ihre Identität",
+      "recovery_codes_left": "Verbleibende Wiederherstellungscodes: {{count}}",
+      "remove": "Entfernen",
+      "rename": "Umbenennen",
+      "reported": "Gemeldet. Die zugehörige Sitzung wurde beendet. Ändern Sie ggf. Ihr Passwort.",
+      "save": "Speichern",
+      "step_up_body": "Zum Ändern Ihrer Anmeldung brauchen Sie einen neuen Code aus Ihrer Authentifizierungs-App oder einen Passkey für diese App.",
+      "step_up_title": "Mit Ihrem zweiten Faktor bestätigen",
+      "stop_approvals": "Bestätigungen beenden",
+      "this_device": "Dieses Gerät",
+      "title": "Anmeldung und Sicherheit"
+    },
+    "approval": {
+      "cancel": "Nicht mehr warten",
+      "number_accessibility": "Bestätigungsnummer {{number}}",
+      "number_label": "Geben Sie diese Zahl in Responder ein:",
+      "waiting": "Warten auf Ihre Bestätigung in Responder …"
+    },
+    "approve": {
+      "app": "App: {{app}}",
+      "approve": "Bestätigen",
+      "approved": "Bestätigt. Sie können zum anderen Bildschirm zurückkehren.",
+      "denied": "Abgelehnt. Es wurde nichts bestätigt.",
+      "deny": "Ablehnen",
+      "department": "Abteilung: {{department}}",
+      "done": "Fertig",
+      "expires": "Läuft ab um {{time}}",
+      "installation": "Gerät: {{label}}",
+      "none": "Nichts wartet auf Ihre Bestätigung.",
+      "not_me": "Das war ich nicht",
+      "number_body": "Geben Sie die Zahl vom anderen Bildschirm ein und bestätigen Sie mit Ihrem Passkey. Bestätigen Sie nur, wenn Sie dies selbst begonnen haben.",
+      "number_mismatch": "Das ist nicht die Zahl vom anderen Bildschirm. Verbleibende Versuche: {{count}}.",
+      "number_placeholder": "Zahl",
+      "origin": "In der Nähe von: {{origin}}",
+      "purpose": {
+        "adp": "Jemand möchte geschützte Informationen ansehen",
+        "department_entry": "Jemand wechselt als Sie in eine Abteilung",
+        "login": "Jemand meldet sich bei Ihrem Konto an",
+        "step_up": "Jemand bestätigt eine Aktion mit Ihrem Konto",
+        "unlock": "Jemand entsperrt ein gemeinsames Gerät als Sie"
+      },
+      "shared": "Auf einem gemeinsamen Gerät",
+      "title": "Anmeldung bestätigen?",
+      "unknown_app": "Eine andere Resgrid-App"
+    },
+    "errors": {
+      "access_denied": "Ihre Organisation hat die Anmeldung nicht erlaubt.",
+      "approval_denied": "Die Anfrage wurde in Responder abgelehnt.",
+      "approval_expired": "Die Bestätigungsanfrage ist abgelaufen. Fragen Sie erneut oder nutzen Sie eine andere Methode.",
+      "approval_pending": "Warten weiter auf die Bestätigung in Responder.",
+      "approval_suspended": "Bestätigungsanfragen sind für einige Minuten pausiert. Nutzen Sie eine andere Methode.",
+      "approval_unavailable": "Mit Responder bestätigen ist hier für dieses Konto nicht verfügbar.",
+      "challenge_consumed": "Die Anfrage wurde bereits verwendet. Beginnen Sie erneut.",
+      "challenge_expired": "Die Anfrage ist abgelaufen. Beginnen Sie erneut.",
+      "federated_identity_mismatch": "Dieses Organisationskonto ist nicht das hier angemeldete.",
+      "federated_mfa_not_satisfied": "Die Anmeldung Ihrer Organisation hat keinen zweiten Faktor bestätigt. Nutzen Sie eine andere Methode.",
+      "invalid_recovery_code": "Dieser Wiederherstellungscode ist ungültig oder wurde schon verwendet.",
+      "invalid_totp": "Der Code ist ungültig oder abgelaufen. Geben Sie den aktuellen Code ein.",
+      "mfa_enrollment_required": "Ihre Abteilung verlangt Zwei-Faktor-Authentifizierung. Richten Sie im Web eine Authentifizierungs-App ein und melden Sie sich erneut an.",
+      "mfa_method_not_allowed": "Diese Methode ist hier nicht verfügbar. Verwenden Sie eine andere.",
+      "mfa_not_enrolled": "Für Ihr Konto ist keine Zwei-Faktor-Authentifizierung eingerichtet.",
+      "mfa_transaction_expired": "Die Anmeldung hat zu lange gedauert. Melden Sie sich erneut an.",
+      "mfa_transaction_invalid": "Diese Anmeldung ist nicht mehr gültig. Melden Sie sich erneut an.",
+      "network_error": "Resgrid ist nicht erreichbar. Prüfen Sie Ihre Verbindung und versuchen Sie es erneut.",
+      "passkey_cancelled": "Die Passkey-Abfrage wurde geschlossen. Versuchen Sie es erneut oder nutzen Sie eine andere Methode.",
+      "passkey_failed": "Der Passkey konnte nicht verwendet werden. Versuchen Sie es erneut oder nutzen Sie eine andere Methode.",
+      "passkey_no_credentials": "Auf diesem Gerät wurde kein Passkey für diese App gefunden.",
+      "passkey_not_registered_for_client": "Sie haben keinen Passkey für diese App.",
+      "passkey_not_supported": "Passkeys sind auf diesem Gerät nicht verfügbar. Nutzen Sie eine andere Methode.",
+      "passkey_verification_failed": "Der Passkey konnte nicht bestätigt werden.",
+      "passkeys_unavailable": "Passkeys sind hier nicht verfügbar.",
+      "policy_changed": "Die Anmelderichtlinie Ihrer Abteilung hat sich geändert. Melden Sie sich erneut an.",
+      "reauthentication_required": "Bestätigen Sie zuerst Ihr Passwort.",
+      "recovery_transaction_expired": "Die Wiederherstellung hat zu lange gedauert. Melden Sie sich an und beginnen Sie erneut.",
+      "recovery_transaction_invalid": "Diese Wiederherstellung ist nicht mehr gültig. Melden Sie sich an und beginnen Sie erneut.",
+      "service_unavailable": "Die Anmeldung ist vorübergehend nicht verfügbar. Versuchen Sie es gleich erneut.",
+      "session_revoked": "Ihre Anmeldung wurde beendet. Melden Sie sich erneut an.",
+      "setup_expired": "Der Einrichtungsschlüssel ist abgelaufen. Ein neuer wird angezeigt; fügen Sie ihn erneut hinzu.",
+      "shared_session_lock_changed": "Dieses Gerät wurde erneut gesperrt. Entsperren Sie es noch einmal.",
+      "sso_cancelled": "Die Organisationsanmeldung wurde geschlossen.",
+      "sso_denied": "Ihre Organisation hat die Anmeldung nicht erlaubt.",
+      "sso_failed": "Die Organisationsanmeldung konnte nicht abgeschlossen werden. Beginnen Sie erneut.",
+      "sso_reauthentication_required": "Melden Sie sich über Ihre Organisation an, um fortzufahren.",
+      "sso_state_mismatch": "Die Organisationsanmeldung kam nicht zu dieser App zurück. Beginnen Sie erneut.",
+      "sso_unavailable": "Die Organisationsanmeldung ist gerade nicht verfügbar.",
+      "step_up_required": "Bestätigen Sie zuerst mit Ihrem zweiten Faktor.",
+      "too_many_attempts": "Zu viele Versuche. Warten Sie einige Minuten.",
+      "unknown_error": "Das hat nicht funktioniert. Versuchen Sie es erneut."
+    },
+    "login": {
+      "body": "Ihr Passwort war richtig. Schließen Sie die Anmeldung mit einer dieser Methoden ab.",
+      "code_placeholder": "6-stelliger Code",
+      "lost_factor": "Ich habe meinen Authenticator verloren",
+      "recovery_body": "Geben Sie einen Ihrer gespeicherten Wiederherstellungscodes ein. Jeder Code funktioniert einmal.",
+      "recovery_placeholder": "Wiederherstellungscode",
+      "title": "Bestätigen Sie, dass Sie es sind",
+      "use_approval": "Mit Responder bestätigen",
+      "use_other_method": "Andere Methode verwenden",
+      "use_passkey": "Passkey verwenden",
+      "use_provider": "Mit Ihrer Organisation bestätigen",
+      "use_recovery_code": "Wiederherstellungscode verwenden",
+      "verify": "Bestätigen"
+    },
+    "methods": {
+      "federated": "Organisationsanmeldung",
+      "passkey": "Passkey",
+      "passkey_approval": "Responder-Bestätigung",
+      "recovery_code": "Wiederherstellungscode",
+      "totp": "Authenticator-Code"
+    },
+    "recovery": {
+      "back_to_sign_in": "Zurück zur Anmeldung",
+      "begin": "Weiter",
+      "cancel": "Wiederherstellung abbrechen",
+      "code_body": "Geben Sie einen Wiederherstellungscode ein, um Ihre Authentifizierungs-App zu ersetzen. Danach richten Sie eine neue ein, und alle Sitzungen werden abgemeldet.",
+      "done_body": "Ihr Authenticator wurde ersetzt und alle Sitzungen wurden abgemeldet. Speichern Sie die neuen Wiederherstellungscodes und melden Sie sich an.",
+      "finish": "Authenticator ersetzen",
+      "help_body": "Die Wiederherstellung braucht einen Wiederherstellungscode nach Passwort oder Organisationsanmeldung. Ohne Code wenden Sie sich an Ihre Abteilungsverwaltung oder den Resgrid-Support; die Zwei-Faktor-Authentifizierung lässt sich hier nicht abschalten.",
+      "no_code": "Ich habe keinen Wiederherstellungscode",
+      "remove_passkeys": "Verlorene Passkeys entfernen",
+      "replace_body": "Fügen Sie diesen Schlüssel einer neuen Authentifizierungs-App hinzu und geben Sie den angezeigten Code ein. Wählen Sie verlorene Passkeys zum Entfernen aus.",
+      "sign_in": "Anmelden",
+      "title": "Konto wiederherstellen"
+    },
+    "recovery_codes": {
+      "body": "Bewahren Sie sie sicher auf. Jeder funktioniert einmal, falls Sie Ihren Authenticator verlieren. Sie werden nicht erneut angezeigt.",
+      "copied": "Kopiert",
+      "copy": "Codes kopieren",
+      "saved": "Ich habe sie gespeichert",
+      "title": "Wiederherstellungscodes speichern"
+    },
+    "setup": {
+      "body": "Ihre Abteilung verlangt Zwei-Faktor-Authentifizierung. Fügen Sie diesen Schlüssel Ihrer Authentifizierungs-App hinzu und geben Sie den angezeigten Code ein.",
+      "key_label": "Einrichtungsschlüssel",
+      "open_app": "In Authentifizierungs-App öffnen",
+      "title": "Authentifizierungs-App einrichten"
+    }
+  },
   "not_found": {
     "go_home": "Zur Startseite!",
     "message": "Diese Seite existiert nicht.",
diff --git a/src/translations/el.json b/src/translations/el.json
index 1a710c3c..2e54d42d 100644
--- a/src/translations/el.json
+++ b/src/translations/el.json
@@ -408,7 +408,7 @@
     "category": "Κατηγορία (σεμινάριο, άσκηση, συνέδριο)",
     "certificateAttached": "επισυνάφθηκε πιστοποιητικό",
     "creditAdded": "Οι ώρες προστέθηκαν.",
-    "creditDate": "Ημερομηνία (εεεε-μμ-ηη, κενό για σήμερα)",
+    "creditDate": "Ημερομηνία (προεπιλογή: σήμερα)",
     "creditNote": "Τι ήταν",
     "credits": "{{hours}} από {{required}} ώρες συνεχιζόμενης εκπαίδευσης",
     "creditsTitle": "{{hours}} ώρες συνεχιζόμενης εκπαίδευσης",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Τομέας ή επίπεδο",
       "choosePhoto": "Επιλογή φωτογραφίας",
-      "expiresOn": "Λήξη (εεεε-μμ-ηη)",
+      "expiresOn": "Λήξη",
       "issuedBy": "Εκδόθηκε από",
       "name": "Όνομα",
       "number": "Αριθμός",
       "otherType": "Άλλη (εισαγάγετε όνομα)",
       "photoAttached": "Η φωτογραφία επισυνάφθηκε.",
-      "receivedOn": "Απόκτηση (εεεε-μμ-ηη)",
+      "receivedOn": "Απόκτηση",
       "save": "Αποθήκευση",
       "takePhoto": "Φωτογραφία κάρτας",
       "type": "Πιστοποίηση"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Εισαγάγετε ώρες μεγαλύτερες από 0.",
     "issuedByIs": "Εκδόθηκε από {{name}}",
     "nameRequired": "Επιλέξτε τύπο ή εισαγάγετε όνομα.",
-    "newExpiry": "Νέα ημερομηνία λήξης (εεεε-μμ-ηη)",
+    "newExpiry": "Νέα ημερομηνία λήξης",
     "newNumber": "Νέος αριθμός (προαιρετικό)",
     "noExpiry": "Δεν λήγει",
     "none": "Δεν έχετε προσθέσει ακόμη πιστοποιήσεις.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Τα προστατευμένα δεδομένα δεν είναι ακόμη διαθέσιμα σε αυτόν τον διακομιστή. Επικοινωνήστε με τον διαχειριστή σας.",
     "step_up_verify": "Επαλήθευση"
   },
+  "dateTimePicker": {
+    "clear": "Εκκαθάριση",
+    "date": "Ημερομηνία",
+    "hour": "Ώρα",
+    "minute": "Λεπτό"
+  },
   "form": {
     "invalid_url": "Εισαγάγετε έγκυρη διεύθυνση URL που ξεκινά με http:// ή https://",
     "required": "Αυτό το πεδίο είναι υποχρεωτικό"
@@ -1304,6 +1310,171 @@
       "subject_required": "Το θέμα είναι υποχρεωτικό"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Πρόσφατες επαληθεύσεις",
+      "activity_failed": "Αποτυχημένη προσπάθεια με {{method}} {{app}}",
+      "activity_ok": "Επαλήθευση με {{method}} {{app}}",
+      "add_passkey": "Προσθήκη κλειδιού πρόσβασης",
+      "approvals": "Εγκρίσεις Responder",
+      "approvals_off": "Οι εγκρίσεις σταμάτησαν",
+      "approvals_on": "Εγκρίνει συνδέσεις",
+      "authenticator": "Εφαρμογή ελέγχου ταυτότητας",
+      "authenticator_off": "Δεν έχει ρυθμιστεί. Ρυθμίστε τη στο Resgrid στον ιστό.",
+      "authenticator_on": "Ενεργό από {{time}}",
+      "linked": "Σύνδεση μέσω οργανισμού",
+      "linked_step_up": "δέχεται την επαλήθευσή του",
+      "no_activity": "Καμία επαλήθευση τις τελευταίες 30 ημέρες.",
+      "no_passkeys": "Δεν υπάρχουν ακόμη κλειδιά πρόσβασης για αυτή την εφαρμογή.",
+      "not_me": "Δεν ήμουν εγώ",
+      "passkey_added": "Το κλειδί πρόσβασης προστέθηκε.",
+      "passkey_approves": "Χρήση για έγκριση συνδέσεων",
+      "passkey_created": "Προστέθηκε {{time}}",
+      "passkey_last_used": "Τελευταία χρήση {{time}}",
+      "passkey_removed": "Το κλειδί πρόσβασης καταργήθηκε.",
+      "passkeys_elsewhere": "{{app}}: {{count}} κλειδιά πρόσβασης",
+      "passkeys_here": "Κλειδιά πρόσβασης για αυτή την εφαρμογή",
+      "password_placeholder": "Κωδικός πρόσβασης",
+      "reauth_body": "Εισαγάγετε τον κωδικό πρόσβασης για να συνεχίσετε.",
+      "reauth_provider_body": "Το τμήμα σας συνδέεται μέσω του οργανισμού του. Συνδεθείτε ξανά εκεί για να συνεχίσετε.",
+      "reauth_title": "Επιβεβαιώστε ότι είστε εσείς",
+      "recovery_codes_left": "Υπόλοιποι κωδικοί ανάκτησης: {{count}}",
+      "remove": "Κατάργηση",
+      "rename": "Μετονομασία",
+      "reported": "Αναφέρθηκε. Η σχετική συνεδρία τερματίστηκε. Σκεφτείτε να αλλάξετε κωδικό πρόσβασης.",
+      "save": "Αποθήκευση",
+      "step_up_body": "Για αλλαγή του τρόπου σύνδεσης χρειάζεται νέος κωδικός από την εφαρμογή ή κλειδί πρόσβασης για αυτή την εφαρμογή.",
+      "step_up_title": "Επαλήθευση με τον δεύτερο παράγοντα",
+      "stop_approvals": "Διακοπή εγκρίσεων",
+      "this_device": "Αυτή η συσκευή",
+      "title": "Σύνδεση και ασφάλεια"
+    },
+    "approval": {
+      "cancel": "Διακοπή αναμονής",
+      "number_accessibility": "Αριθμός έγκρισης {{number}}",
+      "number_label": "Στο Responder, εισαγάγετε αυτόν τον αριθμό:",
+      "waiting": "Αναμονή για την έγκρισή σας στο Responder…"
+    },
+    "approve": {
+      "app": "Εφαρμογή: {{app}}",
+      "approve": "Έγκριση",
+      "approved": "Εγκρίθηκε. Μπορείτε να επιστρέψετε στην άλλη οθόνη.",
+      "denied": "Απορρίφθηκε. Δεν εγκρίθηκε τίποτα.",
+      "deny": "Απόρριψη",
+      "department": "Τμήμα: {{department}}",
+      "done": "Τέλος",
+      "expires": "Λήγει στις {{time}}",
+      "installation": "Συσκευή: {{label}}",
+      "none": "Τίποτα δεν περιμένει την έγκρισή σας.",
+      "not_me": "Δεν ήμουν εγώ",
+      "number_body": "Εισαγάγετε τον αριθμό της άλλης οθόνης και επιβεβαιώστε με το κλειδί πρόσβασης. Εγκρίνετε μόνο αν το ξεκινήσατε εσείς.",
+      "number_mismatch": "Δεν είναι ο αριθμός της άλλης οθόνης. Υπόλοιπες προσπάθειες: {{count}}.",
+      "number_placeholder": "Αριθμός",
+      "origin": "Κοντά σε: {{origin}}",
+      "purpose": {
+        "adp": "Κάποιος θέλει να δει προστατευμένες πληροφορίες",
+        "department_entry": "Κάποιος μεταβαίνει σε τμήμα ως εσείς",
+        "login": "Κάποιος συνδέεται στον λογαριασμό σας",
+        "step_up": "Κάποιος επιβεβαιώνει μια ενέργεια με τον λογαριασμό σας",
+        "unlock": "Κάποιος ξεκλειδώνει κοινόχρηστη συσκευή ως εσείς"
+      },
+      "shared": "Σε κοινόχρηστη συσκευή",
+      "title": "Έγκριση σύνδεσης;",
+      "unknown_app": "Άλλη εφαρμογή Resgrid"
+    },
+    "errors": {
+      "access_denied": "Ο οργανισμός σας δεν επέτρεψε τη σύνδεση.",
+      "approval_denied": "Το αίτημα απορρίφθηκε στο Responder.",
+      "approval_expired": "Το αίτημα έγκρισης έληξε. Ζητήστε ξανά ή χρησιμοποιήστε άλλη μέθοδο.",
+      "approval_pending": "Αναμονή ακόμη για την έγκριση στο Responder.",
+      "approval_suspended": "Τα αιτήματα έγκρισης έχουν παυθεί για λίγα λεπτά.",
+      "approval_unavailable": "Η έγκριση με το Responder δεν είναι διαθέσιμη εδώ.",
+      "challenge_consumed": "Το αίτημα έχει ήδη χρησιμοποιηθεί. Ξεκινήστε ξανά.",
+      "challenge_expired": "Το αίτημα έληξε. Ξεκινήστε ξανά.",
+      "federated_identity_mismatch": "Αυτός ο λογαριασμός οργανισμού δεν είναι ο συνδεδεμένος εδώ.",
+      "federated_mfa_not_satisfied": "Η σύνδεση του οργανισμού δεν επιβεβαίωσε δεύτερο παράγοντα.",
+      "invalid_recovery_code": "Ο κωδικός ανάκτησης δεν είναι έγκυρος ή έχει ήδη χρησιμοποιηθεί.",
+      "invalid_totp": "Ο κωδικός δεν είναι έγκυρος ή έληξε. Εισαγάγετε τον τρέχοντα κωδικό.",
+      "mfa_enrollment_required": "Το τμήμα σας απαιτεί έλεγχο δύο παραγόντων. Ρυθμίστε εφαρμογή στον ιστό και συνδεθείτε ξανά.",
+      "mfa_method_not_allowed": "Αυτή η μέθοδος δεν είναι διαθέσιμη εδώ.",
+      "mfa_not_enrolled": "Δεν έχει ρυθμιστεί έλεγχος δύο παραγόντων.",
+      "mfa_transaction_expired": "Η σύνδεση άργησε πολύ. Συνδεθείτε ξανά.",
+      "mfa_transaction_invalid": "Αυτή η σύνδεση δεν ισχύει πλέον. Συνδεθείτε ξανά.",
+      "network_error": "Δεν ήταν δυνατή η σύνδεση με το Resgrid. Ελέγξτε τη σύνδεσή σας.",
+      "passkey_cancelled": "Το αίτημα κλειδιού έκλεισε. Δοκιμάστε ξανά ή άλλη μέθοδο.",
+      "passkey_failed": "Δεν ήταν δυνατή η χρήση του κλειδιού. Δοκιμάστε ξανά ή άλλη μέθοδο.",
+      "passkey_no_credentials": "Δεν βρέθηκε κλειδί πρόσβασης για αυτή την εφαρμογή στη συσκευή.",
+      "passkey_not_registered_for_client": "Δεν έχετε κλειδί πρόσβασης για αυτή την εφαρμογή.",
+      "passkey_not_supported": "Τα κλειδιά πρόσβασης δεν είναι διαθέσιμα σε αυτή τη συσκευή.",
+      "passkey_verification_failed": "Δεν ήταν δυνατή η επαλήθευση του κλειδιού.",
+      "passkeys_unavailable": "Τα κλειδιά πρόσβασης δεν είναι διαθέσιμα εδώ.",
+      "policy_changed": "Η πολιτική σύνδεσης του τμήματος άλλαξε. Συνδεθείτε ξανά.",
+      "reauthentication_required": "Επιβεβαιώστε πρώτα τον κωδικό πρόσβασης.",
+      "recovery_transaction_expired": "Η ανάκτηση άργησε πολύ. Συνδεθείτε και ξεκινήστε ξανά.",
+      "recovery_transaction_invalid": "Αυτή η ανάκτηση δεν ισχύει πλέον. Συνδεθείτε και ξεκινήστε ξανά.",
+      "service_unavailable": "Η σύνδεση δεν είναι προσωρινά διαθέσιμη.",
+      "session_revoked": "Η σύνδεσή σας τερματίστηκε. Συνδεθείτε ξανά.",
+      "setup_expired": "Το κλειδί ρύθμισης έληξε. Εμφανίζεται νέο· προσθέστε το ξανά.",
+      "shared_session_lock_changed": "Η συσκευή κλειδώθηκε ξανά. Ξεκλειδώστε την ξανά.",
+      "sso_cancelled": "Η σύνδεση οργανισμού έκλεισε.",
+      "sso_denied": "Ο οργανισμός σας δεν επέτρεψε τη σύνδεση.",
+      "sso_failed": "Δεν ολοκληρώθηκε η σύνδεση οργανισμού. Ξεκινήστε ξανά.",
+      "sso_reauthentication_required": "Συνδεθείτε μέσω του οργανισμού σας για να συνεχίσετε.",
+      "sso_state_mismatch": "Η σύνδεση οργανισμού δεν επέστρεψε σε αυτή την εφαρμογή.",
+      "sso_unavailable": "Η σύνδεση οργανισμού δεν είναι διαθέσιμη τώρα.",
+      "step_up_required": "Επαληθεύστε πρώτα με τον δεύτερο παράγοντα.",
+      "too_many_attempts": "Πάρα πολλές προσπάθειες. Περιμένετε λίγα λεπτά.",
+      "unknown_error": "Δεν λειτούργησε. Δοκιμάστε ξανά."
+    },
+    "login": {
+      "body": "Ο κωδικός πρόσβασης ήταν σωστός. Ολοκληρώστε τη σύνδεση με μία από αυτές τις μεθόδους.",
+      "code_placeholder": "6ψήφιος κωδικός",
+      "lost_factor": "Έχασα την εφαρμογή ελέγχου ταυτότητας",
+      "recovery_body": "Εισαγάγετε έναν από τους κωδικούς ανάκτησης που αποθηκεύσατε. Κάθε κωδικός λειτουργεί μία φορά.",
+      "recovery_placeholder": "Κωδικός ανάκτησης",
+      "title": "Επιβεβαιώστε ότι είστε εσείς",
+      "use_approval": "Έγκριση με το Responder",
+      "use_other_method": "Χρήση άλλης μεθόδου",
+      "use_passkey": "Χρήση κλειδιού πρόσβασης",
+      "use_provider": "Επαλήθευση μέσω του οργανισμού σας",
+      "use_recovery_code": "Χρήση κωδικού ανάκτησης",
+      "verify": "Επαλήθευση"
+    },
+    "methods": {
+      "federated": "σύνδεση οργανισμού",
+      "passkey": "κλειδί πρόσβασης",
+      "passkey_approval": "έγκριση Responder",
+      "recovery_code": "κωδικό ανάκτησης",
+      "totp": "κωδικό εφαρμογής"
+    },
+    "recovery": {
+      "back_to_sign_in": "Επιστροφή στη σύνδεση",
+      "begin": "Συνέχεια",
+      "cancel": "Ακύρωση ανάκτησης",
+      "code_body": "Εισαγάγετε κωδικό ανάκτησης για να αντικαταστήσετε την εφαρμογή. Στη συνέχεια θα προσθέσετε νέα και όλες οι συνεδρίες θα αποσυνδεθούν.",
+      "done_body": "Η εφαρμογή αντικαταστάθηκε και όλες οι συνεδρίες αποσυνδέθηκαν. Αποθηκεύστε τους νέους κωδικούς ανάκτησης και συνδεθείτε.",
+      "finish": "Αντικατάσταση εφαρμογής",
+      "help_body": "Η ανάκτηση απαιτεί κωδικό ανάκτησης μετά τον κωδικό πρόσβασης ή τη σύνδεση του οργανισμού. Χωρίς αυτόν, ζητήστε βοήθεια από τον διαχειριστή του τμήματος ή την υποστήριξη Resgrid· ο έλεγχος δύο παραγόντων δεν απενεργοποιείται από εδώ.",
+      "no_code": "Δεν έχω κωδικό ανάκτησης",
+      "remove_passkeys": "Κατάργηση χαμένων κλειδιών πρόσβασης",
+      "replace_body": "Προσθέστε αυτό το κλειδί σε νέα εφαρμογή και εισαγάγετε τον κωδικό της. Επιλέξτε τα κλειδιά πρόσβασης που χάσατε για κατάργηση.",
+      "sign_in": "Σύνδεση",
+      "title": "Ανάκτηση λογαριασμού"
+    },
+    "recovery_codes": {
+      "body": "Φυλάξτε τους σε ασφαλές μέρος. Ο καθένας λειτουργεί μία φορά αν χάσετε την εφαρμογή. Δεν θα εμφανιστούν ξανά.",
+      "copied": "Αντιγράφηκε",
+      "copy": "Αντιγραφή κωδικών",
+      "saved": "Τους αποθήκευσα",
+      "title": "Αποθηκεύστε τους κωδικούς ανάκτησης"
+    },
+    "setup": {
+      "body": "Το τμήμα σας απαιτεί έλεγχο ταυτότητας δύο παραγόντων. Προσθέστε αυτό το κλειδί στην εφαρμογή σας και εισαγάγετε τον κωδικό που εμφανίζει.",
+      "key_label": "Κλειδί ρύθμισης",
+      "open_app": "Άνοιγμα στην εφαρμογή ελέγχου ταυτότητας",
+      "title": "Ρύθμιση εφαρμογής ελέγχου ταυτότητας"
+    }
+  },
   "not_found": {
     "go_home": "Μετάβαση στην αρχική οθόνη!",
     "message": "Αυτή η οθόνη δεν υπάρχει.",
diff --git a/src/translations/en.json b/src/translations/en.json
index 9c0bbeb3..3bf6ee5e 100644
--- a/src/translations/en.json
+++ b/src/translations/en.json
@@ -408,7 +408,7 @@
     "category": "Category (course, drill, conference)",
     "certificateAttached": "certificate attached",
     "creditAdded": "Hours added.",
-    "creditDate": "Date (yyyy-mm-dd, blank for today)",
+    "creditDate": "Date (defaults to today)",
     "creditNote": "What it was",
     "credits": "{{hours}} of {{required}} continuing-education hours",
     "creditsTitle": "{{hours}} continuing-education hours",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Area or level",
       "choosePhoto": "Choose photo",
-      "expiresOn": "Expires (yyyy-mm-dd)",
+      "expiresOn": "Expires on",
       "issuedBy": "Issued by",
       "name": "Name",
       "number": "Number",
       "otherType": "Other (enter a name)",
       "photoAttached": "Photo attached.",
-      "receivedOn": "Received (yyyy-mm-dd)",
+      "receivedOn": "Issued on",
       "save": "Save",
       "takePhoto": "Photo of card",
       "type": "Certification"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Enter a number of hours greater than 0.",
     "issuedByIs": "Issued by {{name}}",
     "nameRequired": "Pick a type or enter a name.",
-    "newExpiry": "New expiry date (yyyy-mm-dd)",
+    "newExpiry": "New expiry date",
     "newNumber": "New number (optional)",
     "noExpiry": "Does not expire",
     "none": "You have not added any certifications yet.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Protected data is not available on this server yet. Contact your administrator.",
     "step_up_verify": "Verify"
   },
+  "dateTimePicker": {
+    "clear": "Clear",
+    "date": "Date",
+    "hour": "Hour",
+    "minute": "Minute"
+  },
   "form": {
     "invalid_url": "Please enter a valid URL starting with http:// or https://",
     "required": "This field is required"
@@ -1304,6 +1310,171 @@
       "subject_required": "Subject is required"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Recent verifications",
+      "activity_failed": "Failed attempt with {{method}} {{app}}",
+      "activity_ok": "Verified with {{method}} {{app}}",
+      "add_passkey": "Add a passkey",
+      "approvals": "Responder approvals",
+      "approvals_off": "Approvals stopped",
+      "approvals_on": "Approves sign-ins",
+      "authenticator": "Authenticator app",
+      "authenticator_off": "Not set up. Set one up in Resgrid on the web.",
+      "authenticator_on": "On since {{time}}",
+      "linked": "Organization sign-in",
+      "linked_step_up": "accepts its verification",
+      "no_activity": "No verifications in the last 30 days.",
+      "no_passkeys": "No passkeys for this app yet.",
+      "not_me": "This wasn't me",
+      "passkey_added": "Passkey added.",
+      "passkey_approves": "Use to approve sign-ins",
+      "passkey_created": "Added {{time}}",
+      "passkey_last_used": "Last used {{time}}",
+      "passkey_removed": "Passkey removed.",
+      "passkeys_elsewhere": "{{app}}: {{count}} passkeys",
+      "passkeys_here": "Passkeys for this app",
+      "password_placeholder": "Password",
+      "reauth_body": "Enter your password to continue.",
+      "reauth_provider_body": "Your department signs in through its organization. Sign in there again to continue.",
+      "reauth_title": "Confirm it's you",
+      "recovery_codes_left": "Recovery codes left: {{count}}",
+      "remove": "Remove",
+      "rename": "Rename",
+      "reported": "Reported. The session it served has ended. Consider changing your password.",
+      "save": "Save",
+      "step_up_body": "Changing how you sign in needs a fresh code from your authenticator app or a passkey for this app.",
+      "step_up_title": "Verify with your second factor",
+      "stop_approvals": "Stop approvals",
+      "this_device": "This device",
+      "title": "Sign-in and security"
+    },
+    "approval": {
+      "cancel": "Stop waiting",
+      "number_accessibility": "Approval number {{number}}",
+      "number_label": "In Responder, enter this number:",
+      "waiting": "Waiting for your approval in Responder…"
+    },
+    "approve": {
+      "app": "App: {{app}}",
+      "approve": "Approve",
+      "approved": "Approved. You can return to the other screen.",
+      "denied": "Denied. Nothing was approved.",
+      "deny": "Deny",
+      "department": "Department: {{department}}",
+      "done": "Done",
+      "expires": "Expires at {{time}}",
+      "installation": "Device: {{label}}",
+      "none": "Nothing is waiting for your approval.",
+      "not_me": "This wasn't me",
+      "number_body": "Enter the number shown on the other screen, then confirm with your passkey. Only approve if you started this yourself.",
+      "number_mismatch": "That is not the number on the other screen. Attempts left: {{count}}.",
+      "number_placeholder": "Number",
+      "origin": "Near: {{origin}}",
+      "purpose": {
+        "adp": "Someone wants to view protected information",
+        "department_entry": "Someone is switching to a department as you",
+        "login": "Someone is signing in to your account",
+        "step_up": "Someone is confirming an action with your account",
+        "unlock": "Someone is unlocking a shared device as you"
+      },
+      "shared": "On a shared device",
+      "title": "Approve sign-in?",
+      "unknown_app": "Another Resgrid app"
+    },
+    "errors": {
+      "access_denied": "Your organization did not allow the sign-in.",
+      "approval_denied": "The request was denied in Responder.",
+      "approval_expired": "The approval request expired. Ask again or use another method.",
+      "approval_pending": "Still waiting for the approval in Responder.",
+      "approval_suspended": "Approval requests are paused for a few minutes. Use another method.",
+      "approval_unavailable": "Approve with Responder is not available for this account here.",
+      "challenge_consumed": "That request was already used. Start again.",
+      "challenge_expired": "The request expired. Start again.",
+      "federated_identity_mismatch": "That organization account is not the one signed in here.",
+      "federated_mfa_not_satisfied": "Your organization's sign-in did not confirm a second factor. Use another method.",
+      "invalid_recovery_code": "That recovery code is not valid or was already used.",
+      "invalid_totp": "That code is invalid or has expired. Enter the current code from your authenticator app.",
+      "mfa_enrollment_required": "Your department requires two-factor authentication. Set up an authenticator app in Resgrid on the web, then sign in again.",
+      "mfa_method_not_allowed": "That method is not available here. Use another one.",
+      "mfa_not_enrolled": "Two-factor authentication is not set up for your account.",
+      "mfa_transaction_expired": "The sign-in took too long. Sign in again.",
+      "mfa_transaction_invalid": "This sign-in is no longer valid. Sign in again.",
+      "network_error": "Could not reach Resgrid. Check your connection and try again.",
+      "passkey_cancelled": "The passkey prompt was closed. Try again or use another method.",
+      "passkey_failed": "The passkey could not be used. Try again or use another method.",
+      "passkey_no_credentials": "No passkey for this app was found on this device.",
+      "passkey_not_registered_for_client": "You have no passkey for this app.",
+      "passkey_not_supported": "Passkeys are not available on this device. Use another method.",
+      "passkey_verification_failed": "The passkey could not be verified.",
+      "passkeys_unavailable": "Passkeys are not available here.",
+      "policy_changed": "Your department's sign-in policy changed. Sign in again.",
+      "reauthentication_required": "Confirm your password first.",
+      "recovery_transaction_expired": "The recovery took too long. Sign in and start again.",
+      "recovery_transaction_invalid": "This recovery is no longer valid. Sign in and start again.",
+      "service_unavailable": "Sign-in is temporarily unavailable. Try again shortly.",
+      "session_revoked": "Your sign-in has ended. Sign in again.",
+      "setup_expired": "That setup key expired. A new one is shown; add it again.",
+      "shared_session_lock_changed": "This device locked again. Unlock it again.",
+      "sso_cancelled": "The organization sign-in was closed.",
+      "sso_denied": "Your organization did not allow the sign-in.",
+      "sso_failed": "The organization sign-in could not be completed. Start again.",
+      "sso_reauthentication_required": "Sign in through your organization to continue.",
+      "sso_state_mismatch": "The organization sign-in did not return to this app. Start again.",
+      "sso_unavailable": "Organization sign-in is not available right now.",
+      "step_up_required": "Verify with your second factor first.",
+      "too_many_attempts": "Too many attempts. Wait a few minutes and try again.",
+      "unknown_error": "That did not work. Try again."
+    },
+    "login": {
+      "body": "Your password was correct. Finish signing in with one of these methods.",
+      "code_placeholder": "6-digit code",
+      "lost_factor": "I lost my authenticator",
+      "recovery_body": "Enter one of the recovery codes you saved. Each code works once.",
+      "recovery_placeholder": "Recovery code",
+      "title": "Verify it's you",
+      "use_approval": "Approve with Responder",
+      "use_other_method": "Use another method",
+      "use_passkey": "Use a passkey",
+      "use_provider": "Verify with your organization",
+      "use_recovery_code": "Use a recovery code",
+      "verify": "Verify"
+    },
+    "methods": {
+      "federated": "organization sign-in",
+      "passkey": "passkey",
+      "passkey_approval": "Responder approval",
+      "recovery_code": "recovery code",
+      "totp": "authenticator code"
+    },
+    "recovery": {
+      "back_to_sign_in": "Back to sign in",
+      "begin": "Continue",
+      "cancel": "Cancel recovery",
+      "code_body": "Enter a recovery code to replace your authenticator app. You will then add a new one, and every session signs out.",
+      "done_body": "Your authenticator was replaced and every session signed out. Save your new recovery codes, then sign in.",
+      "finish": "Replace authenticator",
+      "help_body": "Recovery needs a recovery code, entered after your password or organization sign-in. Without one, ask your department administrator or Resgrid support for help; two-factor authentication cannot be turned off from here.",
+      "no_code": "I don't have a recovery code",
+      "remove_passkeys": "Remove lost passkeys",
+      "replace_body": "Add this key to a new authenticator app and enter the code it shows. Choose any passkeys you lost to remove them.",
+      "sign_in": "Sign in",
+      "title": "Recover your account"
+    },
+    "recovery_codes": {
+      "body": "Keep these somewhere safe. Each works once if you lose your authenticator. They will not be shown again.",
+      "copied": "Copied",
+      "copy": "Copy codes",
+      "saved": "I saved them",
+      "title": "Save your recovery codes"
+    },
+    "setup": {
+      "body": "Your department requires two-factor authentication. Add this key to your authenticator app, then enter the code it shows.",
+      "key_label": "Setup key",
+      "open_app": "Open in authenticator app",
+      "title": "Set up an authenticator app"
+    }
+  },
   "not_found": {
     "go_home": "Go to home screen!",
     "message": "This screen doesn't exist.",
diff --git a/src/translations/es.json b/src/translations/es.json
index ae9694f4..f0c804cf 100644
--- a/src/translations/es.json
+++ b/src/translations/es.json
@@ -408,7 +408,7 @@
     "category": "Categoría (curso, simulacro, congreso)",
     "certificateAttached": "certificado adjunto",
     "creditAdded": "Horas añadidas.",
-    "creditDate": "Fecha (aaaa-mm-dd, vacío para hoy)",
+    "creditDate": "Fecha (hoy por defecto)",
     "creditNote": "Qué fue",
     "credits": "{{hours}} de {{required}} horas de formación continua",
     "creditsTitle": "{{hours}} horas de formación continua",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Área o nivel",
       "choosePhoto": "Elegir foto",
-      "expiresOn": "Caduca (aaaa-mm-dd)",
+      "expiresOn": "Caduca",
       "issuedBy": "Emitida por",
       "name": "Nombre",
       "number": "Número",
       "otherType": "Otra (escriba un nombre)",
       "photoAttached": "Foto adjunta.",
-      "receivedOn": "Obtenida (aaaa-mm-dd)",
+      "receivedOn": "Obtenida",
       "save": "Guardar",
       "takePhoto": "Foto de la tarjeta",
       "type": "Certificación"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Introduzca más de 0 horas.",
     "issuedByIs": "Emitida por {{name}}",
     "nameRequired": "Elija un tipo o escriba un nombre.",
-    "newExpiry": "Nueva fecha de caducidad (aaaa-mm-dd)",
+    "newExpiry": "Nueva fecha de caducidad",
     "newNumber": "Nuevo número (opcional)",
     "noExpiry": "No caduca",
     "none": "Aún no ha añadido certificaciones.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Los datos protegidos aún no están disponibles en este servidor. Póngase en contacto con su administrador.",
     "step_up_verify": "Verificar"
   },
+  "dateTimePicker": {
+    "clear": "Borrar",
+    "date": "Fecha",
+    "hour": "Hora",
+    "minute": "Minuto"
+  },
   "form": {
     "invalid_url": "Por favor, introduce una URL válida que comience con http:// o https://",
     "required": "Este campo es obligatorio"
@@ -1304,6 +1310,171 @@
       "subject_required": "El asunto es obligatorio"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Verificaciones recientes",
+      "activity_failed": "Intento fallido con {{method}} {{app}}",
+      "activity_ok": "Verificado con {{method}} {{app}}",
+      "add_passkey": "Añadir una clave de acceso",
+      "approvals": "Aprobaciones de Responder",
+      "approvals_off": "Aprobaciones detenidas",
+      "approvals_on": "Aprueba inicios de sesión",
+      "authenticator": "Aplicación de autenticación",
+      "authenticator_off": "No configurada. Configúrela en Resgrid en la web.",
+      "authenticator_on": "Activo desde {{time}}",
+      "linked": "Inicio de sesión de la organización",
+      "linked_step_up": "acepta su verificación",
+      "no_activity": "Sin verificaciones en los últimos 30 días.",
+      "no_passkeys": "Aún no hay claves de acceso para esta aplicación.",
+      "not_me": "No he sido yo",
+      "passkey_added": "Clave de acceso añadida.",
+      "passkey_approves": "Usar para aprobar inicios de sesión",
+      "passkey_created": "Añadida el {{time}}",
+      "passkey_last_used": "Último uso: {{time}}",
+      "passkey_removed": "Clave de acceso eliminada.",
+      "passkeys_elsewhere": "{{app}}: {{count}} claves de acceso",
+      "passkeys_here": "Claves de acceso para esta aplicación",
+      "password_placeholder": "Contraseña",
+      "reauth_body": "Introduzca su contraseña para continuar.",
+      "reauth_provider_body": "Su departamento inicia sesión a través de su organización. Vuelva a iniciar sesión allí para continuar.",
+      "reauth_title": "Confirme que es usted",
+      "recovery_codes_left": "Códigos de recuperación restantes: {{count}}",
+      "remove": "Quitar",
+      "rename": "Cambiar nombre",
+      "reported": "Notificado. La sesión asociada ha terminado. Considere cambiar su contraseña.",
+      "save": "Guardar",
+      "step_up_body": "Para cambiar cómo inicia sesión se necesita un código nuevo de su aplicación de autenticación o una clave de acceso de esta aplicación.",
+      "step_up_title": "Verifique con su segundo factor",
+      "stop_approvals": "Detener aprobaciones",
+      "this_device": "Este dispositivo",
+      "title": "Inicio de sesión y seguridad"
+    },
+    "approval": {
+      "cancel": "Dejar de esperar",
+      "number_accessibility": "Número de aprobación {{number}}",
+      "number_label": "En Responder, introduzca este número:",
+      "waiting": "Esperando su aprobación en Responder…"
+    },
+    "approve": {
+      "app": "Aplicación: {{app}}",
+      "approve": "Aprobar",
+      "approved": "Aprobado. Puede volver a la otra pantalla.",
+      "denied": "Denegado. No se aprobó nada.",
+      "deny": "Denegar",
+      "department": "Departamento: {{department}}",
+      "done": "Listo",
+      "expires": "Caduca a las {{time}}",
+      "installation": "Dispositivo: {{label}}",
+      "none": "No hay nada pendiente de su aprobación.",
+      "not_me": "No he sido yo",
+      "number_body": "Introduzca el número que aparece en la otra pantalla y confirme con su clave de acceso. Apruebe solo si lo inició usted.",
+      "number_mismatch": "Ese no es el número de la otra pantalla. Intentos restantes: {{count}}.",
+      "number_placeholder": "Número",
+      "origin": "Cerca de: {{origin}}",
+      "purpose": {
+        "adp": "Alguien quiere ver información protegida",
+        "department_entry": "Alguien está cambiando a un departamento como usted",
+        "login": "Alguien está iniciando sesión en su cuenta",
+        "step_up": "Alguien está confirmando una acción con su cuenta",
+        "unlock": "Alguien está desbloqueando un dispositivo compartido como usted"
+      },
+      "shared": "En un dispositivo compartido",
+      "title": "¿Aprobar el inicio de sesión?",
+      "unknown_app": "Otra aplicación de Resgrid"
+    },
+    "errors": {
+      "access_denied": "Su organización no permitió el inicio de sesión.",
+      "approval_denied": "La solicitud se denegó en Responder.",
+      "approval_expired": "La solicitud de aprobación caducó. Vuelva a pedirla o use otro método.",
+      "approval_pending": "Aún esperando la aprobación en Responder.",
+      "approval_suspended": "Las solicitudes de aprobación están en pausa unos minutos. Use otro método.",
+      "approval_unavailable": "Aprobar con Responder no está disponible para esta cuenta aquí.",
+      "challenge_consumed": "Esa solicitud ya se usó. Empiece de nuevo.",
+      "challenge_expired": "La solicitud caducó. Empiece de nuevo.",
+      "federated_identity_mismatch": "Esa cuenta de la organización no es la que ha iniciado sesión aquí.",
+      "federated_mfa_not_satisfied": "El inicio de sesión de su organización no confirmó un segundo factor. Use otro método.",
+      "invalid_recovery_code": "El código de recuperación no es válido o ya se usó.",
+      "invalid_totp": "El código no es válido o ha caducado. Introduzca el código actual.",
+      "mfa_enrollment_required": "Su departamento requiere autenticación en dos pasos. Configure una aplicación en la web e inicie sesión de nuevo.",
+      "mfa_method_not_allowed": "Ese método no está disponible aquí. Use otro.",
+      "mfa_not_enrolled": "La autenticación en dos pasos no está configurada.",
+      "mfa_transaction_expired": "El inicio de sesión tardó demasiado. Inicie sesión de nuevo.",
+      "mfa_transaction_invalid": "Este inicio de sesión ya no es válido. Inicie sesión de nuevo.",
+      "network_error": "No se pudo conectar con Resgrid. Compruebe su conexión e inténtelo de nuevo.",
+      "passkey_cancelled": "Se cerró la solicitud de la clave de acceso. Inténtelo de nuevo o use otro método.",
+      "passkey_failed": "No se pudo usar la clave de acceso. Inténtelo de nuevo o use otro método.",
+      "passkey_no_credentials": "No se encontró ninguna clave de acceso para esta aplicación en este dispositivo.",
+      "passkey_not_registered_for_client": "No tiene ninguna clave de acceso para esta aplicación.",
+      "passkey_not_supported": "Las claves de acceso no están disponibles en este dispositivo. Use otro método.",
+      "passkey_verification_failed": "No se pudo verificar la clave de acceso.",
+      "passkeys_unavailable": "Las claves de acceso no están disponibles aquí.",
+      "policy_changed": "La política de inicio de sesión de su departamento cambió. Inicie sesión de nuevo.",
+      "reauthentication_required": "Confirme primero su contraseña.",
+      "recovery_transaction_expired": "La recuperación tardó demasiado. Inicie sesión y empiece de nuevo.",
+      "recovery_transaction_invalid": "Esta recuperación ya no es válida. Inicie sesión y empiece de nuevo.",
+      "service_unavailable": "El inicio de sesión no está disponible temporalmente. Inténtelo en breve.",
+      "session_revoked": "Su sesión ha terminado. Inicie sesión de nuevo.",
+      "setup_expired": "La clave de configuración caducó. Se muestra una nueva; añádala de nuevo.",
+      "shared_session_lock_changed": "Este dispositivo se bloqueó de nuevo. Desbloquéelo otra vez.",
+      "sso_cancelled": "Se cerró el inicio de sesión de la organización.",
+      "sso_denied": "Su organización no permitió el inicio de sesión.",
+      "sso_failed": "No se pudo completar el inicio de sesión de la organización. Empiece de nuevo.",
+      "sso_reauthentication_required": "Inicie sesión a través de su organización para continuar.",
+      "sso_state_mismatch": "El inicio de sesión de la organización no volvió a esta aplicación. Empiece de nuevo.",
+      "sso_unavailable": "El inicio de sesión de la organización no está disponible ahora.",
+      "step_up_required": "Verifique primero con su segundo factor.",
+      "too_many_attempts": "Demasiados intentos. Espere unos minutos.",
+      "unknown_error": "No funcionó. Inténtelo de nuevo."
+    },
+    "login": {
+      "body": "Su contraseña era correcta. Termine de iniciar sesión con uno de estos métodos.",
+      "code_placeholder": "Código de 6 dígitos",
+      "lost_factor": "Perdí mi autenticador",
+      "recovery_body": "Introduzca uno de los códigos de recuperación que guardó. Cada código funciona una vez.",
+      "recovery_placeholder": "Código de recuperación",
+      "title": "Verifique que es usted",
+      "use_approval": "Aprobar con Responder",
+      "use_other_method": "Usar otro método",
+      "use_passkey": "Usar una clave de acceso",
+      "use_provider": "Verificar con su organización",
+      "use_recovery_code": "Usar un código de recuperación",
+      "verify": "Verificar"
+    },
+    "methods": {
+      "federated": "inicio de sesión de la organización",
+      "passkey": "clave de acceso",
+      "passkey_approval": "aprobación de Responder",
+      "recovery_code": "código de recuperación",
+      "totp": "código del autenticador"
+    },
+    "recovery": {
+      "back_to_sign_in": "Volver a iniciar sesión",
+      "begin": "Continuar",
+      "cancel": "Cancelar la recuperación",
+      "code_body": "Introduzca un código de recuperación para sustituir su aplicación de autenticación. Después añadirá una nueva y se cerrarán todas las sesiones.",
+      "done_body": "Se sustituyó su autenticador y se cerraron todas las sesiones. Guarde sus nuevos códigos de recuperación e inicie sesión.",
+      "finish": "Sustituir autenticador",
+      "help_body": "La recuperación necesita un código de recuperación, introducido tras su contraseña o el inicio de sesión de su organización. Sin él, pida ayuda al administrador de su departamento o al soporte de Resgrid; la autenticación en dos pasos no se puede desactivar desde aquí.",
+      "no_code": "No tengo un código de recuperación",
+      "remove_passkeys": "Quitar claves de acceso perdidas",
+      "replace_body": "Añada esta clave a una nueva aplicación de autenticación e introduzca el código que muestra. Elija las claves de acceso perdidas para quitarlas.",
+      "sign_in": "Iniciar sesión",
+      "title": "Recuperar su cuenta"
+    },
+    "recovery_codes": {
+      "body": "Guárdelos en un lugar seguro. Cada uno funciona una vez si pierde su autenticador. No se volverán a mostrar.",
+      "copied": "Copiados",
+      "copy": "Copiar códigos",
+      "saved": "Ya los guardé",
+      "title": "Guarde sus códigos de recuperación"
+    },
+    "setup": {
+      "body": "Su departamento requiere autenticación en dos pasos. Añada esta clave a su aplicación de autenticación e introduzca el código que muestra.",
+      "key_label": "Clave de configuración",
+      "open_app": "Abrir en la aplicación de autenticación",
+      "title": "Configurar una aplicación de autenticación"
+    }
+  },
   "not_found": {
     "go_home": "¡Ir a la pantalla de inicio!",
     "message": "Esta pantalla no existe.",
diff --git a/src/translations/fr.json b/src/translations/fr.json
index 3cc75249..e4fc88ef 100644
--- a/src/translations/fr.json
+++ b/src/translations/fr.json
@@ -408,7 +408,7 @@
     "category": "Catégorie (cours, exercice, congrès)",
     "certificateAttached": "certificat joint",
     "creditAdded": "Heures ajoutées.",
-    "creditDate": "Date (aaaa-mm-jj, vide pour aujourd'hui)",
+    "creditDate": "Date (aujourd’hui par défaut)",
     "creditNote": "De quoi il s'agit",
     "credits": "{{hours}} sur {{required}} heures de formation continue",
     "creditsTitle": "{{hours}} heures de formation continue",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Domaine ou niveau",
       "choosePhoto": "Choisir une photo",
-      "expiresOn": "Expire (aaaa-mm-jj)",
+      "expiresOn": "Expire",
       "issuedBy": "Délivrée par",
       "name": "Nom",
       "number": "Numéro",
       "otherType": "Autre (saisir un nom)",
       "photoAttached": "Photo jointe.",
-      "receivedOn": "Obtenue (aaaa-mm-jj)",
+      "receivedOn": "Obtenue",
       "save": "Enregistrer",
       "takePhoto": "Photo de la carte",
       "type": "Certification"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Saisissez un nombre d'heures supérieur à 0.",
     "issuedByIs": "Délivrée par {{name}}",
     "nameRequired": "Choisissez un type ou saisissez un nom.",
-    "newExpiry": "Nouvelle date d'expiration (aaaa-mm-jj)",
+    "newExpiry": "Nouvelle date d'expiration",
     "newNumber": "Nouveau numéro (facultatif)",
     "noExpiry": "N'expire pas",
     "none": "Vous n'avez encore ajouté aucune certification.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Les données protégées ne sont pas encore disponibles sur ce serveur. Contactez votre administrateur.",
     "step_up_verify": "Vérifier"
   },
+  "dateTimePicker": {
+    "clear": "Effacer",
+    "date": "Date",
+    "hour": "Heure",
+    "minute": "Minute"
+  },
   "form": {
     "invalid_url": "Veuillez saisir une URL valide commençant par http:// ou https://",
     "required": "Ce champ est obligatoire"
@@ -1304,6 +1310,171 @@
       "subject_required": "L'objet est obligatoire"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Vérifications récentes",
+      "activity_failed": "Échec avec {{method}} {{app}}",
+      "activity_ok": "Vérifié avec {{method}} {{app}}",
+      "add_passkey": "Ajouter une clé d’accès",
+      "approvals": "Approbations Responder",
+      "approvals_off": "Approbations arrêtées",
+      "approvals_on": "Approuve les connexions",
+      "authenticator": "Application d’authentification",
+      "authenticator_off": "Non configurée. Configurez-la dans Resgrid sur le web.",
+      "authenticator_on": "Actif depuis {{time}}",
+      "linked": "Connexion de l’organisation",
+      "linked_step_up": "accepte sa vérification",
+      "no_activity": "Aucune vérification ces 30 derniers jours.",
+      "no_passkeys": "Aucune clé d’accès pour cette application.",
+      "not_me": "Ce n’était pas moi",
+      "passkey_added": "Clé d’accès ajoutée.",
+      "passkey_approves": "Utiliser pour approuver les connexions",
+      "passkey_created": "Ajoutée le {{time}}",
+      "passkey_last_used": "Dernière utilisation : {{time}}",
+      "passkey_removed": "Clé d’accès supprimée.",
+      "passkeys_elsewhere": "{{app}} : {{count}} clés d’accès",
+      "passkeys_here": "Clés d’accès pour cette application",
+      "password_placeholder": "Mot de passe",
+      "reauth_body": "Saisissez votre mot de passe pour continuer.",
+      "reauth_provider_body": "Votre service se connecte via son organisation. Reconnectez-vous-y pour continuer.",
+      "reauth_title": "Confirmez votre identité",
+      "recovery_codes_left": "Codes de récupération restants : {{count}}",
+      "remove": "Supprimer",
+      "rename": "Renommer",
+      "reported": "Signalé. La session concernée a été fermée. Pensez à changer votre mot de passe.",
+      "save": "Enregistrer",
+      "step_up_body": "Modifier votre connexion demande un nouveau code de votre application ou une clé d’accès de cette application.",
+      "step_up_title": "Vérifiez avec votre second facteur",
+      "stop_approvals": "Arrêter les approbations",
+      "this_device": "Cet appareil",
+      "title": "Connexion et sécurité"
+    },
+    "approval": {
+      "cancel": "Ne plus attendre",
+      "number_accessibility": "Numéro d’approbation {{number}}",
+      "number_label": "Dans Responder, saisissez ce nombre :",
+      "waiting": "En attente de votre approbation dans Responder…"
+    },
+    "approve": {
+      "app": "Application : {{app}}",
+      "approve": "Approuver",
+      "approved": "Approuvé. Vous pouvez revenir à l’autre écran.",
+      "denied": "Refusé. Rien n’a été approuvé.",
+      "deny": "Refuser",
+      "department": "Service : {{department}}",
+      "done": "Terminé",
+      "expires": "Expire à {{time}}",
+      "installation": "Appareil : {{label}}",
+      "none": "Rien n’attend votre approbation.",
+      "not_me": "Ce n’était pas moi",
+      "number_body": "Saisissez le nombre affiché sur l’autre écran, puis confirmez avec votre clé d’accès. N’approuvez que si vous en êtes à l’origine.",
+      "number_mismatch": "Ce n’est pas le nombre de l’autre écran. Tentatives restantes : {{count}}.",
+      "number_placeholder": "Nombre",
+      "origin": "Près de : {{origin}}",
+      "purpose": {
+        "adp": "Quelqu’un veut consulter des informations protégées",
+        "department_entry": "Quelqu’un passe à un service en votre nom",
+        "login": "Quelqu’un se connecte à votre compte",
+        "step_up": "Quelqu’un confirme une action avec votre compte",
+        "unlock": "Quelqu’un déverrouille un appareil partagé en votre nom"
+      },
+      "shared": "Sur un appareil partagé",
+      "title": "Approuver la connexion ?",
+      "unknown_app": "Une autre application Resgrid"
+    },
+    "errors": {
+      "access_denied": "Votre organisation n’a pas autorisé la connexion.",
+      "approval_denied": "La demande a été refusée dans Responder.",
+      "approval_expired": "La demande d’approbation a expiré. Redemandez-la ou utilisez une autre méthode.",
+      "approval_pending": "Toujours en attente de l’approbation dans Responder.",
+      "approval_suspended": "Les demandes d’approbation sont suspendues quelques minutes. Utilisez une autre méthode.",
+      "approval_unavailable": "Approuver avec Responder n’est pas disponible ici pour ce compte.",
+      "challenge_consumed": "Cette demande a déjà été utilisée. Recommencez.",
+      "challenge_expired": "La demande a expiré. Recommencez.",
+      "federated_identity_mismatch": "Ce compte d’organisation n’est pas celui connecté ici.",
+      "federated_mfa_not_satisfied": "La connexion de votre organisation n’a pas confirmé de second facteur. Utilisez une autre méthode.",
+      "invalid_recovery_code": "Ce code de récupération est invalide ou déjà utilisé.",
+      "invalid_totp": "Ce code est invalide ou expiré. Saisissez le code actuel.",
+      "mfa_enrollment_required": "Votre service exige l’authentification à deux facteurs. Configurez une application sur le web, puis reconnectez-vous.",
+      "mfa_method_not_allowed": "Cette méthode n’est pas disponible ici. Utilisez-en une autre.",
+      "mfa_not_enrolled": "L’authentification à deux facteurs n’est pas configurée.",
+      "mfa_transaction_expired": "La connexion a pris trop de temps. Reconnectez-vous.",
+      "mfa_transaction_invalid": "Cette connexion n’est plus valide. Reconnectez-vous.",
+      "network_error": "Impossible de joindre Resgrid. Vérifiez votre connexion et réessayez.",
+      "passkey_cancelled": "La demande de clé d’accès a été fermée. Réessayez ou utilisez une autre méthode.",
+      "passkey_failed": "La clé d’accès n’a pas pu être utilisée. Réessayez ou utilisez une autre méthode.",
+      "passkey_no_credentials": "Aucune clé d’accès pour cette application sur cet appareil.",
+      "passkey_not_registered_for_client": "Vous n’avez aucune clé d’accès pour cette application.",
+      "passkey_not_supported": "Les clés d’accès ne sont pas disponibles sur cet appareil. Utilisez une autre méthode.",
+      "passkey_verification_failed": "La clé d’accès n’a pas pu être vérifiée.",
+      "passkeys_unavailable": "Les clés d’accès ne sont pas disponibles ici.",
+      "policy_changed": "La politique de connexion de votre service a changé. Reconnectez-vous.",
+      "reauthentication_required": "Confirmez d’abord votre mot de passe.",
+      "recovery_transaction_expired": "La récupération a pris trop de temps. Connectez-vous et recommencez.",
+      "recovery_transaction_invalid": "Cette récupération n’est plus valide. Connectez-vous et recommencez.",
+      "service_unavailable": "La connexion est temporairement indisponible. Réessayez sous peu.",
+      "session_revoked": "Votre session est terminée. Reconnectez-vous.",
+      "setup_expired": "La clé de configuration a expiré. Une nouvelle est affichée ; ajoutez-la de nouveau.",
+      "shared_session_lock_changed": "Cet appareil s’est de nouveau verrouillé. Déverrouillez-le à nouveau.",
+      "sso_cancelled": "La connexion de l’organisation a été fermée.",
+      "sso_denied": "Votre organisation n’a pas autorisé la connexion.",
+      "sso_failed": "La connexion de l’organisation n’a pas abouti. Recommencez.",
+      "sso_reauthentication_required": "Connectez-vous via votre organisation pour continuer.",
+      "sso_state_mismatch": "La connexion de l’organisation n’est pas revenue à cette application. Recommencez.",
+      "sso_unavailable": "La connexion de l’organisation n’est pas disponible pour le moment.",
+      "step_up_required": "Vérifiez d’abord avec votre second facteur.",
+      "too_many_attempts": "Trop de tentatives. Patientez quelques minutes.",
+      "unknown_error": "Cela n’a pas fonctionné. Réessayez."
+    },
+    "login": {
+      "body": "Votre mot de passe était correct. Terminez la connexion avec l’une de ces méthodes.",
+      "code_placeholder": "Code à 6 chiffres",
+      "lost_factor": "J’ai perdu mon authentificateur",
+      "recovery_body": "Saisissez l’un des codes de récupération enregistrés. Chaque code ne fonctionne qu’une fois.",
+      "recovery_placeholder": "Code de récupération",
+      "title": "Confirmez votre identité",
+      "use_approval": "Approuver avec Responder",
+      "use_other_method": "Utiliser une autre méthode",
+      "use_passkey": "Utiliser une clé d’accès",
+      "use_provider": "Vérifier avec votre organisation",
+      "use_recovery_code": "Utiliser un code de récupération",
+      "verify": "Vérifier"
+    },
+    "methods": {
+      "federated": "connexion de l’organisation",
+      "passkey": "clé d’accès",
+      "passkey_approval": "approbation Responder",
+      "recovery_code": "code de récupération",
+      "totp": "code d’authentification"
+    },
+    "recovery": {
+      "back_to_sign_in": "Retour à la connexion",
+      "begin": "Continuer",
+      "cancel": "Annuler la récupération",
+      "code_body": "Saisissez un code de récupération pour remplacer votre application. Vous en ajouterez ensuite une nouvelle et toutes les sessions seront fermées.",
+      "done_body": "Votre authentificateur a été remplacé et toutes les sessions fermées. Enregistrez vos nouveaux codes, puis connectez-vous.",
+      "finish": "Remplacer l’authentificateur",
+      "help_body": "La récupération nécessite un code de récupération, saisi après votre mot de passe ou la connexion de votre organisation. Sans code, demandez de l’aide à l’administrateur de votre service ou au support Resgrid ; l’authentification à deux facteurs ne peut pas être désactivée ici.",
+      "no_code": "Je n’ai pas de code de récupération",
+      "remove_passkeys": "Supprimer les clés d’accès perdues",
+      "replace_body": "Ajoutez cette clé à une nouvelle application et saisissez le code affiché. Choisissez les clés d’accès perdues pour les supprimer.",
+      "sign_in": "Se connecter",
+      "title": "Récupérer votre compte"
+    },
+    "recovery_codes": {
+      "body": "Conservez-les en lieu sûr. Chacun fonctionne une fois si vous perdez votre authentificateur. Ils ne seront plus affichés.",
+      "copied": "Copiés",
+      "copy": "Copier les codes",
+      "saved": "Je les ai enregistrés",
+      "title": "Enregistrez vos codes de récupération"
+    },
+    "setup": {
+      "body": "Votre service exige l’authentification à deux facteurs. Ajoutez cette clé à votre application, puis saisissez le code affiché.",
+      "key_label": "Clé de configuration",
+      "open_app": "Ouvrir dans l’application d’authentification",
+      "title": "Configurer une application d’authentification"
+    }
+  },
   "not_found": {
     "go_home": "Aller à l'écran d'accueil !",
     "message": "Cet écran n'existe pas.",
diff --git a/src/translations/it.json b/src/translations/it.json
index 1b9f3d89..dc99bed9 100644
--- a/src/translations/it.json
+++ b/src/translations/it.json
@@ -408,7 +408,7 @@
     "category": "Categoria (corso, esercitazione, convegno)",
     "certificateAttached": "certificato allegato",
     "creditAdded": "Ore aggiunte.",
-    "creditDate": "Data (aaaa-mm-gg, vuoto per oggi)",
+    "creditDate": "Data (oggi per impostazione predefinita)",
     "creditNote": "Di cosa si trattava",
     "credits": "{{hours}} su {{required}} ore di formazione continua",
     "creditsTitle": "{{hours}} ore di formazione continua",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Ambito o livello",
       "choosePhoto": "Scegli foto",
-      "expiresOn": "Scade (aaaa-mm-gg)",
+      "expiresOn": "Scade",
       "issuedBy": "Rilasciata da",
       "name": "Nome",
       "number": "Numero",
       "otherType": "Altro (inserisci un nome)",
       "photoAttached": "Foto allegata.",
-      "receivedOn": "Conseguita (aaaa-mm-gg)",
+      "receivedOn": "Conseguita",
       "save": "Salva",
       "takePhoto": "Foto della tessera",
       "type": "Certificazione"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Inserisci più di 0 ore.",
     "issuedByIs": "Rilasciata da {{name}}",
     "nameRequired": "Scegli un tipo o inserisci un nome.",
-    "newExpiry": "Nuova data di scadenza (aaaa-mm-gg)",
+    "newExpiry": "Nuova data di scadenza",
     "newNumber": "Nuovo numero (facoltativo)",
     "noExpiry": "Non scade",
     "none": "Non hai ancora aggiunto certificazioni.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "I dati protetti non sono ancora disponibili su questo server. Contatta l'amministratore.",
     "step_up_verify": "Verifica"
   },
+  "dateTimePicker": {
+    "clear": "Cancella",
+    "date": "Data",
+    "hour": "Ora",
+    "minute": "Minuto"
+  },
   "form": {
     "invalid_url": "Inserire un URL valido che inizi con http:// o https://",
     "required": "Questo campo è obbligatorio"
@@ -1304,6 +1310,171 @@
       "subject_required": "L'oggetto è obbligatorio"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Verifiche recenti",
+      "activity_failed": "Tentativo non riuscito con {{method}} {{app}}",
+      "activity_ok": "Verificato con {{method}} {{app}}",
+      "add_passkey": "Aggiungi una passkey",
+      "approvals": "Approvazioni Responder",
+      "approvals_off": "Approvazioni interrotte",
+      "approvals_on": "Approva gli accessi",
+      "authenticator": "App di autenticazione",
+      "authenticator_off": "Non configurata. Configurala in Resgrid sul web.",
+      "authenticator_on": "Attiva dal {{time}}",
+      "linked": "Accesso dell’organizzazione",
+      "linked_step_up": "accetta la sua verifica",
+      "no_activity": "Nessuna verifica negli ultimi 30 giorni.",
+      "no_passkeys": "Ancora nessuna passkey per questa app.",
+      "not_me": "Non ero io",
+      "passkey_added": "Passkey aggiunta.",
+      "passkey_approves": "Usa per approvare gli accessi",
+      "passkey_created": "Aggiunta il {{time}}",
+      "passkey_last_used": "Ultimo utilizzo: {{time}}",
+      "passkey_removed": "Passkey rimossa.",
+      "passkeys_elsewhere": "{{app}}: {{count}} passkey",
+      "passkeys_here": "Passkey per questa app",
+      "password_placeholder": "Password",
+      "reauth_body": "Inserisci la password per continuare.",
+      "reauth_provider_body": "Il tuo reparto accede tramite la propria organizzazione. Accedi di nuovo lì per continuare.",
+      "reauth_title": "Conferma che sei tu",
+      "recovery_codes_left": "Codici di recupero rimasti: {{count}}",
+      "remove": "Rimuovi",
+      "rename": "Rinomina",
+      "reported": "Segnalato. La sessione associata è stata chiusa. Valuta di cambiare la password.",
+      "save": "Salva",
+      "step_up_body": "Per cambiare il modo di accesso serve un nuovo codice dall’app di autenticazione o una passkey di questa app.",
+      "step_up_title": "Verifica con il secondo fattore",
+      "stop_approvals": "Interrompi approvazioni",
+      "this_device": "Questo dispositivo",
+      "title": "Accesso e sicurezza"
+    },
+    "approval": {
+      "cancel": "Smetti di attendere",
+      "number_accessibility": "Numero di approvazione {{number}}",
+      "number_label": "In Responder, inserisci questo numero:",
+      "waiting": "In attesa della tua approvazione in Responder…"
+    },
+    "approve": {
+      "app": "App: {{app}}",
+      "approve": "Approva",
+      "approved": "Approvato. Puoi tornare all’altro schermo.",
+      "denied": "Rifiutato. Non è stato approvato nulla.",
+      "deny": "Rifiuta",
+      "department": "Reparto: {{department}}",
+      "done": "Fatto",
+      "expires": "Scade alle {{time}}",
+      "installation": "Dispositivo: {{label}}",
+      "none": "Niente attende la tua approvazione.",
+      "not_me": "Non ero io",
+      "number_body": "Inserisci il numero mostrato sull’altro schermo, poi conferma con la tua passkey. Approva solo se l’hai avviato tu.",
+      "number_mismatch": "Non è il numero dell’altro schermo. Tentativi rimasti: {{count}}.",
+      "number_placeholder": "Numero",
+      "origin": "Vicino a: {{origin}}",
+      "purpose": {
+        "adp": "Qualcuno vuole vedere informazioni protette",
+        "department_entry": "Qualcuno sta passando a un reparto come te",
+        "login": "Qualcuno sta accedendo al tuo account",
+        "step_up": "Qualcuno sta confermando un’azione con il tuo account",
+        "unlock": "Qualcuno sta sbloccando un dispositivo condiviso come te"
+      },
+      "shared": "Su un dispositivo condiviso",
+      "title": "Approvare l’accesso?",
+      "unknown_app": "Un’altra app Resgrid"
+    },
+    "errors": {
+      "access_denied": "L’organizzazione non ha consentito l’accesso.",
+      "approval_denied": "La richiesta è stata rifiutata in Responder.",
+      "approval_expired": "La richiesta di approvazione è scaduta. Richiedila o usa un altro metodo.",
+      "approval_pending": "Ancora in attesa dell’approvazione in Responder.",
+      "approval_suspended": "Le richieste di approvazione sono sospese per qualche minuto. Usa un altro metodo.",
+      "approval_unavailable": "Approva con Responder non è disponibile qui per questo account.",
+      "challenge_consumed": "La richiesta è già stata usata. Ricomincia.",
+      "challenge_expired": "La richiesta è scaduta. Ricomincia.",
+      "federated_identity_mismatch": "Quell’account dell’organizzazione non è quello connesso qui.",
+      "federated_mfa_not_satisfied": "L’accesso dell’organizzazione non ha confermato un secondo fattore. Usa un altro metodo.",
+      "invalid_recovery_code": "Il codice di recupero non è valido o è già stato usato.",
+      "invalid_totp": "Il codice non è valido o è scaduto. Inserisci il codice attuale.",
+      "mfa_enrollment_required": "Il reparto richiede l’autenticazione a due fattori. Configura un’app sul web e accedi di nuovo.",
+      "mfa_method_not_allowed": "Questo metodo non è disponibile qui. Usane un altro.",
+      "mfa_not_enrolled": "L’autenticazione a due fattori non è configurata.",
+      "mfa_transaction_expired": "L’accesso ha impiegato troppo. Accedi di nuovo.",
+      "mfa_transaction_invalid": "Questo accesso non è più valido. Accedi di nuovo.",
+      "network_error": "Impossibile raggiungere Resgrid. Controlla la connessione e riprova.",
+      "passkey_cancelled": "La richiesta passkey è stata chiusa. Riprova o usa un altro metodo.",
+      "passkey_failed": "Impossibile usare la passkey. Riprova o usa un altro metodo.",
+      "passkey_no_credentials": "Nessuna passkey per questa app su questo dispositivo.",
+      "passkey_not_registered_for_client": "Non hai passkey per questa app.",
+      "passkey_not_supported": "Le passkey non sono disponibili su questo dispositivo. Usa un altro metodo.",
+      "passkey_verification_failed": "Impossibile verificare la passkey.",
+      "passkeys_unavailable": "Le passkey non sono disponibili qui.",
+      "policy_changed": "Il criterio di accesso del reparto è cambiato. Accedi di nuovo.",
+      "reauthentication_required": "Conferma prima la password.",
+      "recovery_transaction_expired": "Il recupero ha impiegato troppo. Accedi e ricomincia.",
+      "recovery_transaction_invalid": "Questo recupero non è più valido. Accedi e ricomincia.",
+      "service_unavailable": "L’accesso non è temporaneamente disponibile. Riprova a breve.",
+      "session_revoked": "La sessione è terminata. Accedi di nuovo.",
+      "setup_expired": "La chiave di configurazione è scaduta. Ne viene mostrata una nuova; aggiungila di nuovo.",
+      "shared_session_lock_changed": "Il dispositivo si è bloccato di nuovo. Sbloccalo di nuovo.",
+      "sso_cancelled": "L’accesso dell’organizzazione è stato chiuso.",
+      "sso_denied": "L’organizzazione non ha consentito l’accesso.",
+      "sso_failed": "Impossibile completare l’accesso dell’organizzazione. Ricomincia.",
+      "sso_reauthentication_required": "Accedi tramite la tua organizzazione per continuare.",
+      "sso_state_mismatch": "L’accesso dell’organizzazione non è tornato a questa app. Ricomincia.",
+      "sso_unavailable": "L’accesso dell’organizzazione non è disponibile ora.",
+      "step_up_required": "Verifica prima con il secondo fattore.",
+      "too_many_attempts": "Troppi tentativi. Attendi qualche minuto.",
+      "unknown_error": "Non ha funzionato. Riprova."
+    },
+    "login": {
+      "body": "La password era corretta. Completa l’accesso con uno di questi metodi.",
+      "code_placeholder": "Codice a 6 cifre",
+      "lost_factor": "Ho perso l’autenticatore",
+      "recovery_body": "Inserisci uno dei codici di recupero salvati. Ogni codice funziona una volta.",
+      "recovery_placeholder": "Codice di recupero",
+      "title": "Conferma che sei tu",
+      "use_approval": "Approva con Responder",
+      "use_other_method": "Usa un altro metodo",
+      "use_passkey": "Usa una passkey",
+      "use_provider": "Verifica con la tua organizzazione",
+      "use_recovery_code": "Usa un codice di recupero",
+      "verify": "Verifica"
+    },
+    "methods": {
+      "federated": "accesso dell’organizzazione",
+      "passkey": "passkey",
+      "passkey_approval": "approvazione Responder",
+      "recovery_code": "codice di recupero",
+      "totp": "codice dell’autenticatore"
+    },
+    "recovery": {
+      "back_to_sign_in": "Torna all’accesso",
+      "begin": "Continua",
+      "cancel": "Annulla recupero",
+      "code_body": "Inserisci un codice di recupero per sostituire l’app di autenticazione. Poi ne aggiungerai una nuova e tutte le sessioni verranno chiuse.",
+      "done_body": "L’autenticatore è stato sostituito e tutte le sessioni sono state chiuse. Salva i nuovi codici di recupero, poi accedi.",
+      "finish": "Sostituisci autenticatore",
+      "help_body": "Il recupero richiede un codice di recupero, inserito dopo la password o l’accesso dell’organizzazione. Senza, chiedi aiuto all’amministratore del reparto o al supporto Resgrid; l’autenticazione a due fattori non si può disattivare da qui.",
+      "no_code": "Non ho un codice di recupero",
+      "remove_passkeys": "Rimuovi le passkey perse",
+      "replace_body": "Aggiungi questa chiave a una nuova app e inserisci il codice mostrato. Scegli le passkey perse per rimuoverle.",
+      "sign_in": "Accedi",
+      "title": "Recupera il tuo account"
+    },
+    "recovery_codes": {
+      "body": "Conservali in un luogo sicuro. Ognuno funziona una volta se perdi l’autenticatore. Non verranno mostrati di nuovo.",
+      "copied": "Copiati",
+      "copy": "Copia codici",
+      "saved": "Li ho salvati",
+      "title": "Salva i codici di recupero"
+    },
+    "setup": {
+      "body": "Il tuo reparto richiede l’autenticazione a due fattori. Aggiungi questa chiave all’app di autenticazione e inserisci il codice mostrato.",
+      "key_label": "Chiave di configurazione",
+      "open_app": "Apri nell’app di autenticazione",
+      "title": "Configura un’app di autenticazione"
+    }
+  },
   "not_found": {
     "go_home": "Vai alla schermata iniziale!",
     "message": "Questa schermata non esiste.",
diff --git a/src/translations/pl.json b/src/translations/pl.json
index e59d3c75..e8aea157 100644
--- a/src/translations/pl.json
+++ b/src/translations/pl.json
@@ -408,7 +408,7 @@
     "category": "Kategoria (kurs, ćwiczenia, konferencja)",
     "certificateAttached": "dołączono certyfikat",
     "creditAdded": "Dodano godziny.",
-    "creditDate": "Data (rrrr-mm-dd, puste = dziś)",
+    "creditDate": "Data (domyślnie dzisiaj)",
     "creditNote": "Czego dotyczyło",
     "credits": "{{hours}} z {{required}} godzin doskonalenia",
     "creditsTitle": "{{hours}} godzin doskonalenia",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Zakres lub poziom",
       "choosePhoto": "Wybierz zdjęcie",
-      "expiresOn": "Wygasa (rrrr-mm-dd)",
+      "expiresOn": "Wygasa",
       "issuedBy": "Wydane przez",
       "name": "Nazwa",
       "number": "Numer",
       "otherType": "Inne (wpisz nazwę)",
       "photoAttached": "Dołączono zdjęcie.",
-      "receivedOn": "Uzyskane (rrrr-mm-dd)",
+      "receivedOn": "Uzyskane",
       "save": "Zapisz",
       "takePhoto": "Zdjęcie legitymacji",
       "type": "Uprawnienie"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Wpisz liczbę godzin większą od 0.",
     "issuedByIs": "Wydane przez {{name}}",
     "nameRequired": "Wybierz rodzaj lub wpisz nazwę.",
-    "newExpiry": "Nowa data ważności (rrrr-mm-dd)",
+    "newExpiry": "Nowa data ważności",
     "newNumber": "Nowy numer (opcjonalnie)",
     "noExpiry": "Nie wygasa",
     "none": "Nie dodano jeszcze żadnych uprawnień.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Chronione dane nie są jeszcze dostępne na tym serwerze. Skontaktuj się z administratorem.",
     "step_up_verify": "Potwierdź"
   },
+  "dateTimePicker": {
+    "clear": "Wyczyść",
+    "date": "Data",
+    "hour": "Godzina",
+    "minute": "Minuta"
+  },
   "form": {
     "invalid_url": "Proszę wprowadzić prawidłowy URL zaczynający się od http:// lub https://",
     "required": "To pole jest wymagane"
@@ -1304,6 +1310,171 @@
       "subject_required": "Temat jest wymagany"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Ostatnie weryfikacje",
+      "activity_failed": "Nieudana próba: {{method}} {{app}}",
+      "activity_ok": "Zweryfikowano: {{method}} {{app}}",
+      "add_passkey": "Dodaj klucz dostępu",
+      "approvals": "Zatwierdzenia w Responder",
+      "approvals_off": "Zatwierdzenia wstrzymane",
+      "approvals_on": "Zatwierdza logowania",
+      "authenticator": "Aplikacja uwierzytelniająca",
+      "authenticator_off": "Nie skonfigurowano. Skonfiguruj ją w Resgrid w przeglądarce.",
+      "authenticator_on": "Włączona od {{time}}",
+      "linked": "Logowanie przez organizację",
+      "linked_step_up": "akceptuje jej weryfikację",
+      "no_activity": "Brak weryfikacji w ostatnich 30 dniach.",
+      "no_passkeys": "Brak kluczy dostępu dla tej aplikacji.",
+      "not_me": "To nie ja",
+      "passkey_added": "Dodano klucz dostępu.",
+      "passkey_approves": "Używaj do zatwierdzania logowań",
+      "passkey_created": "Dodano {{time}}",
+      "passkey_last_used": "Ostatnio użyto {{time}}",
+      "passkey_removed": "Usunięto klucz dostępu.",
+      "passkeys_elsewhere": "{{app}}: klucze dostępu: {{count}}",
+      "passkeys_here": "Klucze dostępu dla tej aplikacji",
+      "password_placeholder": "Hasło",
+      "reauth_body": "Wpisz hasło, aby kontynuować.",
+      "reauth_provider_body": "Twój dział loguje się przez organizację. Zaloguj się tam ponownie, aby kontynuować.",
+      "reauth_title": "Potwierdź tożsamość",
+      "recovery_codes_left": "Pozostałe kody odzyskiwania: {{count}}",
+      "remove": "Usuń",
+      "rename": "Zmień nazwę",
+      "reported": "Zgłoszono. Powiązana sesja została zakończona. Rozważ zmianę hasła.",
+      "save": "Zapisz",
+      "step_up_body": "Zmiana sposobu logowania wymaga nowego kodu z aplikacji lub klucza dostępu tej aplikacji.",
+      "step_up_title": "Zweryfikuj drugim składnikiem",
+      "stop_approvals": "Wstrzymaj zatwierdzenia",
+      "this_device": "To urządzenie",
+      "title": "Logowanie i bezpieczeństwo"
+    },
+    "approval": {
+      "cancel": "Przestań czekać",
+      "number_accessibility": "Numer zatwierdzenia {{number}}",
+      "number_label": "W Responder wpisz tę liczbę:",
+      "waiting": "Oczekiwanie na zatwierdzenie w Responder…"
+    },
+    "approve": {
+      "app": "Aplikacja: {{app}}",
+      "approve": "Zatwierdź",
+      "approved": "Zatwierdzono. Możesz wrócić do drugiego ekranu.",
+      "denied": "Odrzucono. Nic nie zostało zatwierdzone.",
+      "deny": "Odrzuć",
+      "department": "Dział: {{department}}",
+      "done": "Gotowe",
+      "expires": "Wygasa o {{time}}",
+      "installation": "Urządzenie: {{label}}",
+      "none": "Nic nie czeka na zatwierdzenie.",
+      "not_me": "To nie ja",
+      "number_body": "Wpisz liczbę z drugiego ekranu i potwierdź kluczem dostępu. Zatwierdzaj tylko, jeśli to Ty to rozpocząłeś.",
+      "number_mismatch": "To nie jest liczba z drugiego ekranu. Pozostałe próby: {{count}}.",
+      "number_placeholder": "Liczba",
+      "origin": "W pobliżu: {{origin}}",
+      "purpose": {
+        "adp": "Ktoś chce zobaczyć chronione informacje",
+        "department_entry": "Ktoś przełącza się do działu jako Ty",
+        "login": "Ktoś loguje się na Twoje konto",
+        "step_up": "Ktoś potwierdza działanie Twoim kontem",
+        "unlock": "Ktoś odblokowuje współdzielone urządzenie jako Ty"
+      },
+      "shared": "Na współdzielonym urządzeniu",
+      "title": "Zatwierdzić logowanie?",
+      "unknown_app": "Inna aplikacja Resgrid"
+    },
+    "errors": {
+      "access_denied": "Organizacja nie zezwoliła na logowanie.",
+      "approval_denied": "Żądanie zostało odrzucone w Responder.",
+      "approval_expired": "Prośba o zatwierdzenie wygasła. Poproś ponownie lub użyj innej metody.",
+      "approval_pending": "Nadal oczekiwanie na zatwierdzenie w Responder.",
+      "approval_suspended": "Prośby o zatwierdzenie wstrzymano na kilka minut. Użyj innej metody.",
+      "approval_unavailable": "Zatwierdzanie w Responder jest tu niedostępne dla tego konta.",
+      "challenge_consumed": "To żądanie zostało już użyte. Zacznij od nowa.",
+      "challenge_expired": "Żądanie wygasło. Zacznij od nowa.",
+      "federated_identity_mismatch": "To konto organizacji nie jest zalogowane tutaj.",
+      "federated_mfa_not_satisfied": "Logowanie organizacji nie potwierdziło drugiego składnika. Użyj innej metody.",
+      "invalid_recovery_code": "Kod odzyskiwania jest nieprawidłowy lub został już użyty.",
+      "invalid_totp": "Kod jest nieprawidłowy lub wygasł. Wpisz bieżący kod.",
+      "mfa_enrollment_required": "Dział wymaga uwierzytelniania dwuskładnikowego. Skonfiguruj aplikację w przeglądarce i zaloguj się ponownie.",
+      "mfa_method_not_allowed": "Ta metoda jest tu niedostępna. Użyj innej.",
+      "mfa_not_enrolled": "Uwierzytelnianie dwuskładnikowe nie jest skonfigurowane.",
+      "mfa_transaction_expired": "Logowanie trwało zbyt długo. Zaloguj się ponownie.",
+      "mfa_transaction_invalid": "To logowanie jest już nieważne. Zaloguj się ponownie.",
+      "network_error": "Nie można połączyć się z Resgrid. Sprawdź połączenie i spróbuj ponownie.",
+      "passkey_cancelled": "Okno klucza dostępu zostało zamknięte. Spróbuj ponownie lub użyj innej metody.",
+      "passkey_failed": "Nie można użyć klucza dostępu. Spróbuj ponownie lub użyj innej metody.",
+      "passkey_no_credentials": "Na tym urządzeniu nie ma klucza dostępu tej aplikacji.",
+      "passkey_not_registered_for_client": "Nie masz klucza dostępu do tej aplikacji.",
+      "passkey_not_supported": "Klucze dostępu nie są dostępne na tym urządzeniu. Użyj innej metody.",
+      "passkey_verification_failed": "Nie można zweryfikować klucza dostępu.",
+      "passkeys_unavailable": "Klucze dostępu są tu niedostępne.",
+      "policy_changed": "Zasady logowania w dziale się zmieniły. Zaloguj się ponownie.",
+      "reauthentication_required": "Najpierw potwierdź hasło.",
+      "recovery_transaction_expired": "Odzyskiwanie trwało zbyt długo. Zaloguj się i zacznij od nowa.",
+      "recovery_transaction_invalid": "To odzyskiwanie jest już nieważne. Zaloguj się i zacznij od nowa.",
+      "service_unavailable": "Logowanie jest chwilowo niedostępne. Spróbuj za chwilę.",
+      "session_revoked": "Sesja się zakończyła. Zaloguj się ponownie.",
+      "setup_expired": "Klucz konfiguracji wygasł. Pokazano nowy; dodaj go ponownie.",
+      "shared_session_lock_changed": "Urządzenie zablokowało się ponownie. Odblokuj je jeszcze raz.",
+      "sso_cancelled": "Logowanie organizacji zostało zamknięte.",
+      "sso_denied": "Organizacja nie zezwoliła na logowanie.",
+      "sso_failed": "Nie udało się dokończyć logowania organizacji. Zacznij od nowa.",
+      "sso_reauthentication_required": "Zaloguj się przez organizację, aby kontynuować.",
+      "sso_state_mismatch": "Logowanie organizacji nie wróciło do tej aplikacji. Zacznij od nowa.",
+      "sso_unavailable": "Logowanie organizacji jest teraz niedostępne.",
+      "step_up_required": "Najpierw zweryfikuj drugim składnikiem.",
+      "too_many_attempts": "Zbyt wiele prób. Odczekaj kilka minut.",
+      "unknown_error": "Nie udało się. Spróbuj ponownie."
+    },
+    "login": {
+      "body": "Hasło było poprawne. Dokończ logowanie jedną z tych metod.",
+      "code_placeholder": "6-cyfrowy kod",
+      "lost_factor": "Zgubiłem aplikację uwierzytelniającą",
+      "recovery_body": "Wpisz jeden z zapisanych kodów odzyskiwania. Każdy kod działa raz.",
+      "recovery_placeholder": "Kod odzyskiwania",
+      "title": "Potwierdź, że to Ty",
+      "use_approval": "Zatwierdź w Responder",
+      "use_other_method": "Użyj innej metody",
+      "use_passkey": "Użyj klucza dostępu",
+      "use_provider": "Zweryfikuj przez swoją organizację",
+      "use_recovery_code": "Użyj kodu odzyskiwania",
+      "verify": "Zweryfikuj"
+    },
+    "methods": {
+      "federated": "logowanie organizacji",
+      "passkey": "klucz dostępu",
+      "passkey_approval": "zatwierdzenie w Responder",
+      "recovery_code": "kod odzyskiwania",
+      "totp": "kod z aplikacji"
+    },
+    "recovery": {
+      "back_to_sign_in": "Wróć do logowania",
+      "begin": "Dalej",
+      "cancel": "Anuluj odzyskiwanie",
+      "code_body": "Wpisz kod odzyskiwania, aby zastąpić aplikację uwierzytelniającą. Potem dodasz nową, a wszystkie sesje zostaną wylogowane.",
+      "done_body": "Aplikacja została zastąpiona, a wszystkie sesje wylogowane. Zapisz nowe kody odzyskiwania i zaloguj się.",
+      "finish": "Zastąp aplikację",
+      "help_body": "Odzyskiwanie wymaga kodu odzyskiwania wpisanego po haśle lub logowaniu organizacji. Bez niego poproś o pomoc administratora działu lub wsparcie Resgrid; uwierzytelniania dwuskładnikowego nie można tu wyłączyć.",
+      "no_code": "Nie mam kodu odzyskiwania",
+      "remove_passkeys": "Usuń utracone klucze dostępu",
+      "replace_body": "Dodaj ten klucz do nowej aplikacji i wpisz wyświetlony kod. Wybierz utracone klucze dostępu, aby je usunąć.",
+      "sign_in": "Zaloguj się",
+      "title": "Odzyskaj konto"
+    },
+    "recovery_codes": {
+      "body": "Przechowuj je bezpiecznie. Każdy działa raz, jeśli zgubisz aplikację. Nie zostaną pokazane ponownie.",
+      "copied": "Skopiowano",
+      "copy": "Kopiuj kody",
+      "saved": "Zapisałem je",
+      "title": "Zapisz kody odzyskiwania"
+    },
+    "setup": {
+      "body": "Twój dział wymaga uwierzytelniania dwuskładnikowego. Dodaj ten klucz do aplikacji i wpisz wyświetlony kod.",
+      "key_label": "Klucz konfiguracji",
+      "open_app": "Otwórz w aplikacji uwierzytelniającej",
+      "title": "Skonfiguruj aplikację uwierzytelniającą"
+    }
+  },
   "not_found": {
     "go_home": "Przejdź do ekranu głównego!",
     "message": "Ten ekran nie istnieje.",
diff --git a/src/translations/sv.json b/src/translations/sv.json
index 195912cf..bee66848 100644
--- a/src/translations/sv.json
+++ b/src/translations/sv.json
@@ -408,7 +408,7 @@
     "category": "Kategori (kurs, övning, konferens)",
     "certificateAttached": "intyg bifogat",
     "creditAdded": "Timmar tillagda.",
-    "creditDate": "Datum (åååå-mm-dd, tomt för i dag)",
+    "creditDate": "Datum (idag som standard)",
     "creditNote": "Vad det var",
     "credits": "{{hours}} av {{required}} timmar vidareutbildning",
     "creditsTitle": "{{hours}} timmar vidareutbildning",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Område eller nivå",
       "choosePhoto": "Välj foto",
-      "expiresOn": "Går ut (åååå-mm-dd)",
+      "expiresOn": "Går ut",
       "issuedBy": "Utfärdad av",
       "name": "Namn",
       "number": "Nummer",
       "otherType": "Annan (ange namn)",
       "photoAttached": "Foto bifogat.",
-      "receivedOn": "Erhållen (åååå-mm-dd)",
+      "receivedOn": "Erhållen",
       "save": "Spara",
       "takePhoto": "Foto av kortet",
       "type": "Behörighet"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Ange fler än 0 timmar.",
     "issuedByIs": "Utfärdad av {{name}}",
     "nameRequired": "Välj en typ eller ange ett namn.",
-    "newExpiry": "Nytt utgångsdatum (åååå-mm-dd)",
+    "newExpiry": "Nytt utgångsdatum",
     "newNumber": "Nytt nummer (valfritt)",
     "noExpiry": "Går inte ut",
     "none": "Du har inte lagt till några behörigheter än.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Skyddade uppgifter är ännu inte tillgängliga på den här servern. Kontakta din administratör.",
     "step_up_verify": "Bekräfta"
   },
+  "dateTimePicker": {
+    "clear": "Rensa",
+    "date": "Datum",
+    "hour": "Timme",
+    "minute": "Minut"
+  },
   "form": {
     "invalid_url": "Ange en giltig URL som börjar med http:// eller https://",
     "required": "Det här fältet är obligatoriskt"
@@ -1304,6 +1310,171 @@
       "subject_required": "Ämne krävs"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Senaste verifieringar",
+      "activity_failed": "Misslyckat försök med {{method}} {{app}}",
+      "activity_ok": "Verifierad med {{method}} {{app}}",
+      "add_passkey": "Lägg till en nyckel",
+      "approvals": "Godkännanden i Responder",
+      "approvals_off": "Godkännanden stoppade",
+      "approvals_on": "Godkänner inloggningar",
+      "authenticator": "Autentiseringsapp",
+      "authenticator_off": "Inte konfigurerad. Konfigurera den i Resgrid på webben.",
+      "authenticator_on": "På sedan {{time}}",
+      "linked": "Organisationens inloggning",
+      "linked_step_up": "godtar dess verifiering",
+      "no_activity": "Inga verifieringar de senaste 30 dagarna.",
+      "no_passkeys": "Inga nycklar för den här appen än.",
+      "not_me": "Det var inte jag",
+      "passkey_added": "Nyckeln har lagts till.",
+      "passkey_approves": "Använd för att godkänna inloggningar",
+      "passkey_created": "Tillagd {{time}}",
+      "passkey_last_used": "Senast använd {{time}}",
+      "passkey_removed": "Nyckeln har tagits bort.",
+      "passkeys_elsewhere": "{{app}}: {{count}} nycklar",
+      "passkeys_here": "Nycklar för den här appen",
+      "password_placeholder": "Lösenord",
+      "reauth_body": "Ange ditt lösenord för att fortsätta.",
+      "reauth_provider_body": "Din avdelning loggar in via sin organisation. Logga in där igen för att fortsätta.",
+      "reauth_title": "Bekräfta att det är du",
+      "recovery_codes_left": "Återställningskoder kvar: {{count}}",
+      "remove": "Ta bort",
+      "rename": "Byt namn",
+      "reported": "Rapporterat. Den tillhörande sessionen har avslutats. Överväg att byta lösenord.",
+      "save": "Spara",
+      "step_up_body": "Att ändra hur du loggar in kräver en ny kod från autentiseringsappen eller en nyckel för den här appen.",
+      "step_up_title": "Verifiera med din andra faktor",
+      "stop_approvals": "Stoppa godkännanden",
+      "this_device": "Den här enheten",
+      "title": "Inloggning och säkerhet"
+    },
+    "approval": {
+      "cancel": "Sluta vänta",
+      "number_accessibility": "Godkännandenummer {{number}}",
+      "number_label": "Ange det här numret i Responder:",
+      "waiting": "Väntar på ditt godkännande i Responder …"
+    },
+    "approve": {
+      "app": "App: {{app}}",
+      "approve": "Godkänn",
+      "approved": "Godkänt. Du kan gå tillbaka till den andra skärmen.",
+      "denied": "Nekat. Inget godkändes.",
+      "deny": "Neka",
+      "department": "Avdelning: {{department}}",
+      "done": "Klar",
+      "expires": "Går ut {{time}}",
+      "installation": "Enhet: {{label}}",
+      "none": "Inget väntar på ditt godkännande.",
+      "not_me": "Det var inte jag",
+      "number_body": "Ange numret som visas på den andra skärmen och bekräfta med din nyckel. Godkänn bara om du själv startade detta.",
+      "number_mismatch": "Det är inte numret på den andra skärmen. Försök kvar: {{count}}.",
+      "number_placeholder": "Nummer",
+      "origin": "Nära: {{origin}}",
+      "purpose": {
+        "adp": "Någon vill se skyddad information",
+        "department_entry": "Någon byter till en avdelning som du",
+        "login": "Någon loggar in på ditt konto",
+        "step_up": "Någon bekräftar en åtgärd med ditt konto",
+        "unlock": "Någon låser upp en delad enhet som du"
+      },
+      "shared": "På en delad enhet",
+      "title": "Godkänna inloggningen?",
+      "unknown_app": "En annan Resgrid-app"
+    },
+    "errors": {
+      "access_denied": "Din organisation tillät inte inloggningen.",
+      "approval_denied": "Begäran nekades i Responder.",
+      "approval_expired": "Godkännandebegäran gick ut. Fråga igen eller använd en annan metod.",
+      "approval_pending": "Väntar fortfarande på godkännande i Responder.",
+      "approval_suspended": "Godkännandebegäranden är pausade några minuter. Använd en annan metod.",
+      "approval_unavailable": "Godkänn med Responder är inte tillgängligt här.",
+      "challenge_consumed": "Begäran har redan använts. Börja om.",
+      "challenge_expired": "Begäran gick ut. Börja om.",
+      "federated_identity_mismatch": "Det organisationskontot är inte det som är inloggat här.",
+      "federated_mfa_not_satisfied": "Organisationens inloggning bekräftade ingen andra faktor. Använd en annan metod.",
+      "invalid_recovery_code": "Återställningskoden är ogiltig eller redan använd.",
+      "invalid_totp": "Koden är ogiltig eller har gått ut. Ange den aktuella koden.",
+      "mfa_enrollment_required": "Avdelningen kräver tvåstegsverifiering. Konfigurera en app på webben och logga in igen.",
+      "mfa_method_not_allowed": "Metoden är inte tillgänglig här. Använd en annan.",
+      "mfa_not_enrolled": "Tvåstegsverifiering är inte konfigurerad.",
+      "mfa_transaction_expired": "Inloggningen tog för lång tid. Logga in igen.",
+      "mfa_transaction_invalid": "Inloggningen är inte längre giltig. Logga in igen.",
+      "network_error": "Kunde inte nå Resgrid. Kontrollera anslutningen och försök igen.",
+      "passkey_cancelled": "Nyckelprompten stängdes. Försök igen eller använd en annan metod.",
+      "passkey_failed": "Nyckeln kunde inte användas. Försök igen eller använd en annan metod.",
+      "passkey_no_credentials": "Ingen nyckel för den här appen hittades på enheten.",
+      "passkey_not_registered_for_client": "Du har ingen nyckel för den här appen.",
+      "passkey_not_supported": "Nycklar är inte tillgängliga på enheten. Använd en annan metod.",
+      "passkey_verification_failed": "Nyckeln kunde inte verifieras.",
+      "passkeys_unavailable": "Nycklar är inte tillgängliga här.",
+      "policy_changed": "Avdelningens inloggningsregler har ändrats. Logga in igen.",
+      "reauthentication_required": "Bekräfta ditt lösenord först.",
+      "recovery_transaction_expired": "Återställningen tog för lång tid. Logga in och börja om.",
+      "recovery_transaction_invalid": "Återställningen är inte längre giltig. Logga in och börja om.",
+      "service_unavailable": "Inloggning är tillfälligt otillgänglig. Försök snart igen.",
+      "session_revoked": "Din inloggning har avslutats. Logga in igen.",
+      "setup_expired": "Konfigurationsnyckeln har gått ut. En ny visas; lägg till den igen.",
+      "shared_session_lock_changed": "Enheten låstes igen. Lås upp den igen.",
+      "sso_cancelled": "Organisationsinloggningen stängdes.",
+      "sso_denied": "Din organisation tillät inte inloggningen.",
+      "sso_failed": "Organisationsinloggningen kunde inte slutföras. Börja om.",
+      "sso_reauthentication_required": "Logga in via din organisation för att fortsätta.",
+      "sso_state_mismatch": "Organisationsinloggningen återvände inte till appen. Börja om.",
+      "sso_unavailable": "Organisationsinloggning är inte tillgänglig just nu.",
+      "step_up_required": "Verifiera med din andra faktor först.",
+      "too_many_attempts": "För många försök. Vänta några minuter.",
+      "unknown_error": "Det fungerade inte. Försök igen."
+    },
+    "login": {
+      "body": "Lösenordet var rätt. Slutför inloggningen med någon av dessa metoder.",
+      "code_placeholder": "6-siffrig kod",
+      "lost_factor": "Jag har tappat min autentiseringsapp",
+      "recovery_body": "Ange en av återställningskoderna du sparade. Varje kod fungerar en gång.",
+      "recovery_placeholder": "Återställningskod",
+      "title": "Bekräfta att det är du",
+      "use_approval": "Godkänn med Responder",
+      "use_other_method": "Använd en annan metod",
+      "use_passkey": "Använd en nyckel",
+      "use_provider": "Verifiera med din organisation",
+      "use_recovery_code": "Använd en återställningskod",
+      "verify": "Verifiera"
+    },
+    "methods": {
+      "federated": "organisationsinloggning",
+      "passkey": "nyckel",
+      "passkey_approval": "godkännande i Responder",
+      "recovery_code": "återställningskod",
+      "totp": "autentiseringskod"
+    },
+    "recovery": {
+      "back_to_sign_in": "Tillbaka till inloggning",
+      "begin": "Fortsätt",
+      "cancel": "Avbryt återställning",
+      "code_body": "Ange en återställningskod för att ersätta din autentiseringsapp. Sedan lägger du till en ny, och alla sessioner loggas ut.",
+      "done_body": "Din autentiseringsapp ersattes och alla sessioner loggades ut. Spara de nya återställningskoderna och logga in.",
+      "finish": "Ersätt autentiseringsapp",
+      "help_body": "Återställning kräver en återställningskod efter lösenordet eller organisationens inloggning. Utan en kod, be avdelningens administratör eller Resgrids support om hjälp; tvåstegsverifiering kan inte stängas av härifrån.",
+      "no_code": "Jag har ingen återställningskod",
+      "remove_passkeys": "Ta bort nycklar du tappat",
+      "replace_body": "Lägg till nyckeln i en ny autentiseringsapp och ange koden den visar. Välj nycklar du tappat för att ta bort dem.",
+      "sign_in": "Logga in",
+      "title": "Återställ ditt konto"
+    },
+    "recovery_codes": {
+      "body": "Förvara dem säkert. Varje kod fungerar en gång om du tappar din autentiseringsapp. De visas inte igen.",
+      "copied": "Kopierat",
+      "copy": "Kopiera koder",
+      "saved": "Jag har sparat dem",
+      "title": "Spara dina återställningskoder"
+    },
+    "setup": {
+      "body": "Din avdelning kräver tvåstegsverifiering. Lägg till nyckeln i din autentiseringsapp och ange koden den visar.",
+      "key_label": "Konfigurationsnyckel",
+      "open_app": "Öppna i autentiseringsappen",
+      "title": "Konfigurera en autentiseringsapp"
+    }
+  },
   "not_found": {
     "go_home": "Gå till startskärmen!",
     "message": "Den här skärmen finns inte.",
diff --git a/src/translations/uk.json b/src/translations/uk.json
index 0b62e257..1e1d2f7c 100644
--- a/src/translations/uk.json
+++ b/src/translations/uk.json
@@ -408,7 +408,7 @@
     "category": "Категорія (курс, навчання, конференція)",
     "certificateAttached": "сертифікат додано",
     "creditAdded": "Години додано.",
-    "creditDate": "Дата (рррр-мм-дд, порожньо — сьогодні)",
+    "creditDate": "Дата (за замовчуванням сьогодні)",
     "creditNote": "Що це було",
     "credits": "{{hours}} з {{required}} годин підвищення кваліфікації",
     "creditsTitle": "{{hours}} годин підвищення кваліфікації",
@@ -427,13 +427,13 @@
     "form": {
       "area": "Напрям або рівень",
       "choosePhoto": "Вибрати фото",
-      "expiresOn": "Закінчується (рррр-мм-дд)",
+      "expiresOn": "Закінчується",
       "issuedBy": "Ким видано",
       "name": "Назва",
       "number": "Номер",
       "otherType": "Інше (введіть назву)",
       "photoAttached": "Фото додано.",
-      "receivedOn": "Отримано (рррр-мм-дд)",
+      "receivedOn": "Отримано",
       "save": "Зберегти",
       "takePhoto": "Фото картки",
       "type": "Посвідчення"
@@ -443,7 +443,7 @@
     "hoursInvalid": "Введіть кількість годин більше 0.",
     "issuedByIs": "Видано: {{name}}",
     "nameRequired": "Виберіть тип або введіть назву.",
-    "newExpiry": "Нова дата закінчення (рррр-мм-дд)",
+    "newExpiry": "Нова дата закінчення",
     "newNumber": "Новий номер (необов'язково)",
     "noExpiry": "Безстрокове",
     "none": "Ви ще не додали жодних посвідчень.",
@@ -990,6 +990,12 @@
     "step_up_unavailable": "Захищені дані ще недоступні на цьому сервері. Зверніться до адміністратора.",
     "step_up_verify": "Підтвердити"
   },
+  "dateTimePicker": {
+    "clear": "Очистити",
+    "date": "Дата",
+    "hour": "Година",
+    "minute": "Хвилина"
+  },
   "form": {
     "invalid_url": "Будь ласка, введіть дійсний URL, що починається з http:// або https://",
     "required": "Це поле є обов'язковим"
@@ -1304,6 +1310,171 @@
       "subject_required": "Тема є обов'язковою"
     }
   },
+  "mfa": {
+    "account": {
+      "activity": "Нещодавні перевірки",
+      "activity_failed": "Невдала спроба: {{method}} {{app}}",
+      "activity_ok": "Підтверджено: {{method}} {{app}}",
+      "add_passkey": "Додати ключ доступу",
+      "approvals": "Підтвердження в Responder",
+      "approvals_off": "Підтвердження зупинено",
+      "approvals_on": "Підтверджує входи",
+      "authenticator": "Застосунок автентифікації",
+      "authenticator_off": "Не налаштовано. Налаштуйте в Resgrid у вебі.",
+      "authenticator_on": "Увімкнено з {{time}}",
+      "linked": "Вхід через організацію",
+      "linked_step_up": "приймає її перевірку",
+      "no_activity": "Жодних перевірок за останні 30 днів.",
+      "no_passkeys": "Ще немає ключів доступу для цього застосунку.",
+      "not_me": "Це був не я",
+      "passkey_added": "Ключ доступу додано.",
+      "passkey_approves": "Використовувати для підтвердження входів",
+      "passkey_created": "Додано {{time}}",
+      "passkey_last_used": "Востаннє використано {{time}}",
+      "passkey_removed": "Ключ доступу видалено.",
+      "passkeys_elsewhere": "{{app}}: ключів доступу — {{count}}",
+      "passkeys_here": "Ключі доступу для цього застосунку",
+      "password_placeholder": "Пароль",
+      "reauth_body": "Введіть пароль, щоб продовжити.",
+      "reauth_provider_body": "Ваш підрозділ входить через свою організацію. Увійдіть там знову, щоб продовжити.",
+      "reauth_title": "Підтвердьте, що це ви",
+      "recovery_codes_left": "Залишилося кодів відновлення: {{count}}",
+      "remove": "Видалити",
+      "rename": "Перейменувати",
+      "reported": "Повідомлено. Пов’язаний сеанс завершено. Варто змінити пароль.",
+      "save": "Зберегти",
+      "step_up_body": "Для зміни способу входу потрібен новий код із застосунку або ключ доступу цього застосунку.",
+      "step_up_title": "Підтвердьте другим фактором",
+      "stop_approvals": "Зупинити підтвердження",
+      "this_device": "Цей пристрій",
+      "title": "Вхід і безпека"
+    },
+    "approval": {
+      "cancel": "Припинити очікування",
+      "number_accessibility": "Номер підтвердження {{number}}",
+      "number_label": "У Responder введіть це число:",
+      "waiting": "Очікування підтвердження в Responder…"
+    },
+    "approve": {
+      "app": "Застосунок: {{app}}",
+      "approve": "Підтвердити",
+      "approved": "Підтверджено. Можете повернутися до іншого екрана.",
+      "denied": "Відхилено. Нічого не підтверджено.",
+      "deny": "Відхилити",
+      "department": "Підрозділ: {{department}}",
+      "done": "Готово",
+      "expires": "Діє до {{time}}",
+      "installation": "Пристрій: {{label}}",
+      "none": "Нічого не очікує вашого підтвердження.",
+      "not_me": "Це був не я",
+      "number_body": "Введіть число з іншого екрана та підтвердьте ключем доступу. Підтверджуйте, лише якщо ви це почали самі.",
+      "number_mismatch": "Це не число з іншого екрана. Залишилося спроб: {{count}}.",
+      "number_placeholder": "Число",
+      "origin": "Поблизу: {{origin}}",
+      "purpose": {
+        "adp": "Хтось хоче переглянути захищену інформацію",
+        "department_entry": "Хтось переходить до підрозділу від вашого імені",
+        "login": "Хтось входить у ваш обліковий запис",
+        "step_up": "Хтось підтверджує дію вашим обліковим записом",
+        "unlock": "Хтось розблоковує спільний пристрій від вашого імені"
+      },
+      "shared": "На спільному пристрої",
+      "title": "Підтвердити вхід?",
+      "unknown_app": "Інший застосунок Resgrid"
+    },
+    "errors": {
+      "access_denied": "Ваша організація не дозволила вхід.",
+      "approval_denied": "Запит відхилено в Responder.",
+      "approval_expired": "Термін запиту минув. Надішліть знову або скористайтеся іншим способом.",
+      "approval_pending": "Досі очікування підтвердження в Responder.",
+      "approval_suspended": "Запити на підтвердження призупинено на кілька хвилин.",
+      "approval_unavailable": "Підтвердження через Responder тут недоступне.",
+      "challenge_consumed": "Цей запит уже використано. Почніть знову.",
+      "challenge_expired": "Термін запиту минув. Почніть знову.",
+      "federated_identity_mismatch": "Цей обліковий запис організації не той, що тут увійшов.",
+      "federated_mfa_not_satisfied": "Вхід організації не підтвердив другий фактор. Скористайтеся іншим способом.",
+      "invalid_recovery_code": "Код відновлення недійсний або вже використаний.",
+      "invalid_totp": "Код недійсний або прострочений. Введіть поточний код.",
+      "mfa_enrollment_required": "Підрозділ вимагає двофакторної автентифікації. Налаштуйте застосунок у вебі та увійдіть знову.",
+      "mfa_method_not_allowed": "Цей спосіб тут недоступний. Скористайтеся іншим.",
+      "mfa_not_enrolled": "Двофакторну автентифікацію не налаштовано.",
+      "mfa_transaction_expired": "Вхід тривав надто довго. Увійдіть знову.",
+      "mfa_transaction_invalid": "Цей вхід уже недійсний. Увійдіть знову.",
+      "network_error": "Не вдалося зв’язатися з Resgrid. Перевірте з’єднання.",
+      "passkey_cancelled": "Запит ключа закрито. Спробуйте ще раз або інший спосіб.",
+      "passkey_failed": "Не вдалося використати ключ доступу. Спробуйте ще раз або інший спосіб.",
+      "passkey_no_credentials": "На цьому пристрої немає ключа доступу для цього застосунку.",
+      "passkey_not_registered_for_client": "У вас немає ключа доступу для цього застосунку.",
+      "passkey_not_supported": "Ключі доступу недоступні на цьому пристрої. Скористайтеся іншим способом.",
+      "passkey_verification_failed": "Не вдалося перевірити ключ доступу.",
+      "passkeys_unavailable": "Ключі доступу тут недоступні.",
+      "policy_changed": "Правила входу вашого підрозділу змінилися. Увійдіть знову.",
+      "reauthentication_required": "Спершу підтвердьте пароль.",
+      "recovery_transaction_expired": "Відновлення тривало надто довго. Увійдіть і почніть знову.",
+      "recovery_transaction_invalid": "Це відновлення вже недійсне. Увійдіть і почніть знову.",
+      "service_unavailable": "Вхід тимчасово недоступний. Спробуйте трохи пізніше.",
+      "session_revoked": "Ваш сеанс завершено. Увійдіть знову.",
+      "setup_expired": "Термін ключа налаштування минув. Показано новий; додайте його знову.",
+      "shared_session_lock_changed": "Пристрій знову заблоковано. Розблокуйте ще раз.",
+      "sso_cancelled": "Вхід через організацію закрито.",
+      "sso_denied": "Ваша організація не дозволила вхід.",
+      "sso_failed": "Не вдалося завершити вхід через організацію. Почніть знову.",
+      "sso_reauthentication_required": "Увійдіть через організацію, щоб продовжити.",
+      "sso_state_mismatch": "Вхід через організацію не повернувся до застосунку. Почніть знову.",
+      "sso_unavailable": "Вхід через організацію зараз недоступний.",
+      "step_up_required": "Спершу підтвердьте другим фактором.",
+      "too_many_attempts": "Забагато спроб. Зачекайте кілька хвилин.",
+      "unknown_error": "Не вдалося. Спробуйте ще раз."
+    },
+    "login": {
+      "body": "Пароль правильний. Завершіть вхід одним із цих способів.",
+      "code_placeholder": "6-значний код",
+      "lost_factor": "Я втратив автентифікатор",
+      "recovery_body": "Введіть один зі збережених кодів відновлення. Кожен код працює один раз.",
+      "recovery_placeholder": "Код відновлення",
+      "title": "Підтвердьте, що це ви",
+      "use_approval": "Підтвердити в Responder",
+      "use_other_method": "Інший спосіб",
+      "use_passkey": "Використати ключ доступу",
+      "use_provider": "Підтвердити через вашу організацію",
+      "use_recovery_code": "Використати код відновлення",
+      "verify": "Підтвердити"
+    },
+    "methods": {
+      "federated": "вхід через організацію",
+      "passkey": "ключ доступу",
+      "passkey_approval": "підтвердження в Responder",
+      "recovery_code": "код відновлення",
+      "totp": "код автентифікатора"
+    },
+    "recovery": {
+      "back_to_sign_in": "Назад до входу",
+      "begin": "Продовжити",
+      "cancel": "Скасувати відновлення",
+      "code_body": "Введіть код відновлення, щоб замінити застосунок автентифікації. Потім ви додасте новий, і всі сеанси завершаться.",
+      "done_body": "Автентифікатор замінено, усі сеанси завершено. Збережіть нові коди відновлення та увійдіть.",
+      "finish": "Замінити автентифікатор",
+      "help_body": "Для відновлення потрібен код відновлення після пароля або входу через організацію. Без нього зверніться до адміністратора підрозділу чи підтримки Resgrid; двофакторну автентифікацію тут вимкнути не можна.",
+      "no_code": "У мене немає коду відновлення",
+      "remove_passkeys": "Видалити втрачені ключі доступу",
+      "replace_body": "Додайте цей ключ до нового застосунку та введіть показаний код. Виберіть втрачені ключі доступу, щоб видалити їх.",
+      "sign_in": "Увійти",
+      "title": "Відновлення облікового запису"
+    },
+    "recovery_codes": {
+      "body": "Зберігайте їх у безпечному місці. Кожен працює один раз, якщо ви втратите автентифікатор. Їх більше не буде показано.",
+      "copied": "Скопійовано",
+      "copy": "Копіювати коди",
+      "saved": "Я їх зберіг",
+      "title": "Збережіть коди відновлення"
+    },
+    "setup": {
+      "body": "Ваш підрозділ вимагає двофакторної автентифікації. Додайте цей ключ до застосунку та введіть показаний код.",
+      "key_label": "Ключ налаштування",
+      "open_app": "Відкрити в застосунку автентифікації",
+      "title": "Налаштуйте застосунок автентифікації"
+    }
+  },
   "not_found": {
     "go_home": "Перейти на головний екран!",
     "message": "Цей екран не існує.",
diff --git a/yarn.lock b/yarn.lock
index 630f9053..63bf5c8e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -12221,6 +12221,11 @@ react-native-mmkv@3.3.3:
   resolved "https://registry.yarnpkg.com/react-native-mmkv/-/react-native-mmkv-3.3.3.tgz#1f0326f6314e23725af8145964343224d074e6cd"
   integrity sha512-GMsfOmNzx0p5+CtrCFRVtpOOMYNJXuksBVARSQrCFaZwjUyHJdQzcN900GGaFFNTxw2fs8s5Xje//RDKj9+PZA==
 
+react-native-passkey@3.6.2:
+  version "3.6.2"
+  resolved "https://registry.yarnpkg.com/react-native-passkey/-/react-native-passkey-3.6.2.tgz#a0ee3526fb0b5e11cef102d466b18333502365d2"
+  integrity sha512-3x7uS0EYx3KkHYdYDvDOOmw5DVrKqqDDJxP9Lwph922EwHJT6HR5/2cQs4+MfK6iE/N0FCCNjUJEvQ8XuYj+/A==
+
 react-native-permissions@^5.4.1:
   version "5.4.1"
   resolved "https://registry.yarnpkg.com/react-native-permissions/-/react-native-permissions-5.4.1.tgz#b147e5901f2f5d847b367f2ba6e60378ebcee90c"