diff --git a/app/Http/Controllers/Auth/SsoLoginController.php b/app/Http/Controllers/Auth/SsoLoginController.php
index 45fdb3a..6532c13 100644
--- a/app/Http/Controllers/Auth/SsoLoginController.php
+++ b/app/Http/Controllers/Auth/SsoLoginController.php
@@ -19,7 +19,7 @@ use Illuminate\View\View;
  */
 class SsoLoginController extends Controller
 {
-    public function connect(Request $request): RedirectResponse|View|View
+    public function connect(Request $request): RedirectResponse|View
     {
         $intended = (string) $request->query('redirect', route('servers.dashboard'));
 
@@ -68,10 +68,12 @@ class SsoLoginController extends Controller
         return redirect()->away($authorizeUrl);
     }
 
-    public function callback(Request $request): RedirectResponse|View|View
+    public function callback(Request $request): RedirectResponse|View
     {
         $intended = (string) $request->session()->get('sso.intended', route('servers.dashboard'));
 
+        $popup = (bool) $request->session()->get('sso.popup');
+
         if ($request->filled('error')) {
             if (in_array($request->query('error'), ['login_required', 'interaction_required', 'consent_required'], true)
                 && ! $request->boolean('interactive')) {
@@ -81,12 +83,12 @@ class SsoLoginController extends Controller
                 ]);
             }
 
-            return $this->finishCallback($request, $intended, (string) $request->query('error_description', $request->query('error')));
+            return $this->finishCallback($request, $intended, (string) $request->query('error_description', $request->query('error')), $popup);
         }
 
         if (! $request->filled('code')
             || $request->query('state') !== $request->session()->pull('sso.state')) {
-            return $this->finishCallback($request, $intended, 'invalid_state');
+            return $this->finishCallback($request, $intended, 'invalid_state', $popup);
         }
 
         $issuer = rtrim((string) config('services.ladill_sso.issuer'), '/');
@@ -100,12 +102,12 @@ class SsoLoginController extends Controller
             'code_verifier' => (string) $request->session()->pull('sso.verifier'),
         ]);
         if ($tokenRes->failed()) {
-            return $this->finishCallback($request, $intended, 'token_exchange_failed');
+            return $this->finishCallback($request, $intended, 'token_exchange_failed', $popup);
         }
 
         $claims = Http::withToken((string) $tokenRes->json('access_token'))->acceptJson()->get($issuer.'/oauth/userinfo');
         if ($claims->failed() || ! $claims->json('sub')) {
-            return $this->finishCallback($request, $intended, 'userinfo_failed');
+            return $this->finishCallback($request, $intended, 'userinfo_failed', $popup);
         }
 
         $user = User::updateOrCreate(
@@ -123,7 +125,7 @@ class SsoLoginController extends Controller
         $request->session()->regenerate();
         $request->session()->forget('mailbox_link_banner_dismissed');
 
-        return $this->finishCallback($request, $intended);
+        return $this->finishCallback($request, $intended, null, $popup);
     }
 
     public function logout(Request $request): RedirectResponse
@@ -185,13 +187,18 @@ class SsoLoginController extends Controller
         return strtolower((string) $user->email) !== $mailbox;
     }
 
-    private function finishCallback(Request $request, string $intended, ?string $error = null): RedirectResponse|View
+    private function finishCallback(Request $request, string $intended, ?string $error = null, bool $popup = false): RedirectResponse|View
     {
-        if ($request->session()->pull('sso.popup')) {
+        if ($popup) {
             return view('auth.sso-popup-done', [
                 'intended' => $intended,
                 'error' => $error,
                 'appOrigin' => rtrim((string) config('app.url'), '/'),
+                'fallbackUrl' => route('sso.connect', [
+                    'redirect' => $intended,
+                    'interactive' => 1,
+                    'fallback' => 1,
+                ]),
             ]);
         }
 
@@ -202,7 +209,7 @@ class SsoLoginController extends Controller
             ]);
         }
 
-        return $this->finishCallback($request, $intended);
+        return $this->safeRedirect($intended, route('servers.dashboard'));
     }
 
     private function defaultSignedOutUrl(): string
diff --git a/resources/views/auth/sso-popup-done.blade.php b/resources/views/auth/sso-popup-done.blade.php
index 354b878..cfa0a36 100644
--- a/resources/views/auth/sso-popup-done.blade.php
+++ b/resources/views/auth/sso-popup-done.blade.php
@@ -6,18 +6,11 @@
     <meta name="robots" content="noindex">
 </head>
 <body>
-    @php
-        $ssoFallbackUrl = $fallbackUrl ?? route('sso.connect', [
-            'redirect' => $intended,
-            'interactive' => 1,
-            'fallback' => 1,
-        ]);
-    @endphp
     <script>
         (function () {
             var intended = @json($intended);
             var appOrigin = @json($appOrigin);
-            var fallbackUrl = @json($ssoFallbackUrl);
+            var fallbackUrl = @json($fallbackUrl);
             @if ($error)
             if (window.opener) {
                 window.opener.postMessage({ type: 'ladill:sso:error' }, appOrigin);