diff --git a/apps/web/src/routes/index.tsx b/apps/web/src/routes/index.tsx
index c4eea9b..aada620 100644
--- a/apps/web/src/routes/index.tsx
+++ b/apps/web/src/routes/index.tsx
@@ -18,21 +18,24 @@ export const Route = createFileRoute('/')({
   beforeLoad: async ({ search }) => {
     const token = getToken()
     if (!token) return
-    try {
-      const me = await api.get<MeResponse>('/api/v1/auth/me')
+
+    // SSO handoff first — avoid /me round-trip (rate-limit loops under redirect storms)
+    if (search.return_to) {
       const allowlist = await ensureReturnToAllowlist()
-      if (
-        search.return_to &&
-        isReturnToAllowed(search.return_to, allowlist)
-      ) {
+      if (isReturnToAllowed(search.return_to, allowlist)) {
         const exp = new Date(Date.now() + 60 * 60 * 1000).toISOString()
         window.location.href = buildSsoRedirectUrl(
           search.return_to,
           token,
           exp,
         )
+        await new Promise(() => {})
         return
       }
+    }
+
+    try {
+      const me = await api.get<MeResponse>('/api/v1/auth/me')
       throw redirect({ to: me.is_admin ? '/admin' : '/apps' })
     } catch (err) {
       if (err && typeof err === 'object' && 'to' in err) throw err