diff --git a/CHANGELOG.md b/CHANGELOG.md
index 81f49edeb..15dd9e55b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -109,6 +109,14 @@ key_refused`; against an older backend the previous behaviour stands.
only way out was **Back** or the five-minute timeout. The URL now survives
until the sign-in ends.
([#351](https://github.com/quickbeard/codev-code/pull/351))
+- **The desktop sign-in shows the link, not just a Copy button** — the SSO step
+ now prints the sign-in URL above **Open login page** and **Copy link**, so
+ you can see where you are being sent, select part of it, or read it across to
+ a phone when the browser cannot open on this machine. Before, the link
+ existed only behind those two buttons — and if the browser never opened,
+ **Copy link** was a blind promise with nothing to check it against. The
+ terminal app has always printed the link; the desktop app now matches.
+ ([#356](https://github.com/quickbeard/codev-code/pull/356))
- **Backing out of a sign-in actually stops it** — **Back** in the desktop
dialog, **Log out**, and now **esc** on the TUI's SSO step abort the attempt:
the local callback listener closes and a browser callback that lands
diff --git a/packages/app/src/components/gateway/dialog-configure.tsx b/packages/app/src/components/gateway/dialog-configure.tsx
index 27e292c57..bbf4ea347 100644
--- a/packages/app/src/components/gateway/dialog-configure.tsx
+++ b/packages/app/src/components/gateway/dialog-configure.tsx
@@ -228,6 +228,16 @@ export function DialogConfigure(props: { dismissable?: boolean } = {}) {
{(url) => (
{language.t("gateway.configure.sso.pending")}
+ {/* The link itself, not only the buttons that act on it: when
+ the browser never opened — or opened on a machine that is
+ not this one — Copy link is a blind promise, and the URL
+ is what someone reads across to a phone. Wrapped rather
+ than truncated, since a clipped authorize URL is
+ unusable, and selectable so part of it can be taken.
+ Parity with the TUI, which prints the link. */}
+