diff --git a/ui/index.html b/ui/index.html
index 6a5781e711d..8c2cbaa6f54 100644
--- a/ui/index.html
+++ b/ui/index.html
@@ -15,7 +15,7 @@
     <link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png" />
     <!-- PAPERCLIP_FAVICON_END -->
     <link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png" />
-    <link rel="manifest" href="/site.webmanifest" />
+    <link rel="manifest" href="/site.webmanifest" crossorigin="use-credentials" />
     <script>
       (() => {
         const key = "paperclip.theme";
diff --git a/ui/public/sw.js b/ui/public/sw.js
index f90d12156f8..a3f21e725f8 100644
--- a/ui/public/sw.js
+++ b/ui/public/sw.js
@@ -1,4 +1,7 @@
-const CACHE_NAME = "paperclip-v2";
+const CACHE_NAME = "paperclip-v3";
+
+// Auth-sensitive / self-referential paths the SW must never intercept.
+const PASS_THROUGH = new Set(["/site.webmanifest", "/sw.js"]);
 
 self.addEventListener("install", () => {
   self.skipWaiting();
@@ -17,26 +20,40 @@ self.addEventListener("fetch", (event) => {
   const { request } = event;
   const url = new URL(request.url);
 
-  // Skip non-GET requests and API calls
-  if (request.method !== "GET" || url.pathname.startsWith("/api")) {
+  // Skip non-GET, API calls, cross-origin requests, and auth-sensitive assets.
+  // Returning (not calling respondWith) lets the network handle them untouched.
+  if (
+    request.method !== "GET" ||
+    url.origin !== self.location.origin ||
+    url.pathname.startsWith("/api") ||
+    PASS_THROUGH.has(url.pathname)
+  ) {
     return;
   }
 
-  // Network-first for everything — cache is only an offline fallback
+  // Network-first; cache is only an offline fallback.
   event.respondWith(
     fetch(request)
       .then((response) => {
-        if (response.ok && url.origin === self.location.origin) {
+        // Never cache redirected / opaqueredirect responses (auth challenges).
+        if (
+          response.ok &&
+          !response.redirected &&
+          response.type !== "opaqueredirect"
+        ) {
           const clone = response.clone();
           caches.open(CACHE_NAME).then((cache) => cache.put(request, clone));
         }
         return response;
       })
-      .catch(() => {
+      .catch(async () => {
+        // Always resolve to a real Response — never undefined.
         if (request.mode === "navigate") {
-          return caches.match("/") || new Response("Offline", { status: 503 });
+          const cached = await caches.match("/");
+          return cached || new Response("Offline", { status: 503 });
         }
-        return caches.match(request);
+        const cached = await caches.match(request);
+        return cached || new Response("", { status: 504, statusText: "Offline" });
       })
   );
 });