diff --git a/src/components/dashboard/auth-gate.tsx b/src/components/dashboard/auth-gate.tsx
index fb12945..034183b 100644
--- a/src/components/dashboard/auth-gate.tsx
+++ b/src/components/dashboard/auth-gate.tsx
@@ -2,7 +2,7 @@
 
 import { useEffect } from "react";
 import { useRouter } from "next/navigation";
-import { useAuth } from "@abe-kap/appshell-sdk/react";
+import { useAuth, useAppShell } from "@abe-kap/appshell-sdk/react";
 import { isShellConfigured } from "@/lib/appshell";
 
 /**
@@ -14,16 +14,21 @@ import { isShellConfigured } from "@/lib/appshell";
 export function AuthGate({ children }: { children: React.ReactNode }) {
   const router = useRouter();
   const { status } = useAuth();
+  const { ready } = useAppShell();
   const shell = isShellConfigured();
 
   useEffect(() => {
-    if (shell && status === "unauthenticated") router.replace("/portal/login");
-  }, [shell, status, router]);
+    // Only bounce to login once the SDK has finished booting AND restore() has
+    // resolved to unauthenticated. Redirecting while boot is still in flight would
+    // drop a perfectly valid session on reload (the status is transiently not-yet
+    // "authenticated" during boot).
+    if (shell && ready && status === "unauthenticated") router.replace("/portal/login");
+  }, [shell, ready, status, router]);
 
-  if (shell && status !== "authenticated") {
+  if (shell && (!ready || status !== "authenticated")) {
     return (
       <div style={{ minHeight: "60vh", display: "grid", placeItems: "center", color: "var(--muted, #888)" }}>
-        {status === "loading" ? "Loading your workspace…" : "Redirecting to sign in…"}
+        {ready && status === "unauthenticated" ? "Redirecting to sign in…" : "Loading your workspace…"}
       </div>
     );
   }