diff --git a/CHANGELOG.md b/CHANGELOG.md
index c9724bdbd5..30cda58c74 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,20 @@
 
 This file tracks product releases for Roomote (single monorepo version). Automated release entries are prepended by `pnpm run version`.
 
+## 1.19.6 (2026-10-31)
+
+Roomote 1.19.6 restores reliable all-repository automations across GitHub organizations and makes it easier to clean up sessions without losing your place.
+
+### Highlights
+
+- Run all-repository automations when multiple GitHub organizations are connected.
+- Select and delete sessions in bulk from either overview, keeping your current view and filters.
+
+### Patch changes
+
+- All-repository automations now start reliably when connected GitHub repositories span multiple organizations, instead of failing to create source-control credentials after another GitHub App installation is added.
+- Select and delete multiple sessions from the Sessions list or board again, with page-scoped selection and failed deletions retained for retry. Deleting one or several sessions keeps you in the current overview with its filters and page instead of redirecting home.
+
 ## 1.19.5 (2026-10-29)
 
 Roomote 1.19.5 improves GitHub work across organizations and restores integration-key access for scheduled and manually run custom automations.
diff --git a/apps/docs/fast-sessions.mdx b/apps/docs/fast-sessions.mdx
index 247da4a234..0c4d65cbfd 100644
--- a/apps/docs/fast-sessions.mdx
+++ b/apps/docs/fast-sessions.mdx
@@ -158,6 +158,15 @@ reversible and hides the session and its linked tasks from ordinary lists and
 search until it is unarchived. Deleting a session uses the existing confirmation
 and cleanup safeguards.
 
+In the Sessions list or board, choose **Select sessions** to show checkboxes.
+Select sessions individually, or choose **All** to select every session you can
+manage on the current page. **Delete (n)** confirms and deletes the selection
+using the same cleanup safeguards as individual deletion. If some deletions
+fail, those sessions stay selected for retry. Exit selection mode to resume
+opening sessions normally; changing views, filters, or pages clears selection.
+Deleting one or several sessions from either overview keeps you on that view
+with its current filters and page.
+
 On desktop, you can keep several task workspaces open beside the session,
 resize them, and switch between the conversation and task panels without losing
 your place. On smaller screens, Roomote shows one workspace at a time so the
diff --git a/apps/docs/self-hosting/operations.mdx b/apps/docs/self-hosting/operations.mdx
index 4de75ee2af..3a704a681c 100644
--- a/apps/docs/self-hosting/operations.mdx
+++ b/apps/docs/self-hosting/operations.mdx
@@ -95,6 +95,11 @@ one. Check the running application version and applied schema migration at any
 time under **Settings → Deployment → Diagnostics**; both are also recorded in
 every backup bundle's manifest.
 
+When upgrading from Roomote 1.19.5 or earlier to 1.19.6 or later, upgrade all
+servers handling sign-in and account linking together. Restart any sign-in or
+account-linking attempts begun before the upgrade. Existing signed-in sessions
+are retained, and registered OAuth callback URLs do not need to change.
+
 Roomote surfaces release history and available updates in the web app:
 
 - **Admins** on self-hosted deployments see an update notice in the sidenav when
diff --git a/apps/web/package.json b/apps/web/package.json
index 42a3a6cf66..d46b264dfe 100644
--- a/apps/web/package.json
+++ b/apps/web/package.json
@@ -28,7 +28,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "3.1000.0",
     "@aws-sdk/s3-request-presigner": "3.1000.0",
-    "@better-auth/drizzle-adapter": "^1.6.22",
+    "@better-auth/drizzle-adapter": "^1.7.12",
     "@codemirror/lang-yaml": "^6.0.0",
     "@codemirror/merge": "^6.0.0",
     "@codemirror/state": "^6.0.0",
@@ -92,7 +92,7 @@
     "@zxcvbn-ts/core": "^4.1.2",
     "ai": "^6.0.116",
     "ansi-to-react": "^6.2.6",
-    "better-auth": "^1.6.22",
+    "better-auth": "^1.7.12",
     "better-sse": "^0.16.1",
     "change-case": "^5.4.4",
     "class-variance-authority": "^0.7.1",
diff --git a/apps/web/src/app/(authenticated)/sessions/SessionBoard.tsx b/apps/web/src/app/(authenticated)/sessions/SessionBoard.tsx
index ee42e25c4b..89711bb09a 100644
--- a/apps/web/src/app/(authenticated)/sessions/SessionBoard.tsx
+++ b/apps/web/src/app/(authenticated)/sessions/SessionBoard.tsx
@@ -41,6 +41,7 @@ import {
 
 import { BasicTooltip, Button, Funnel } from '@/components/system';
 import { useSessionStatusMutation } from '@/components/sessions/use-session-status-mutation';
+import { useSessionSelectionActive } from '@/components/sessions/SessionSelection';
 import {
   canDropSessionBoardCard,
   getSessionBoardDropStatus,
@@ -454,6 +455,8 @@ export function SessionBoardCard({
 }) {
   const reducedMotion = useReducedMotion() ?? false;
   const registry = useContext(SessionBoardCardRegistryContext);
+  const selecting = useSessionSelectionActive();
+  const canDrag = canManage && !selecting;
   const dnd = useContext(SessionBoardDndContext);
   const [isFlying, setIsFlying] = useState(false);
   const dragData = useRef<SessionBoardDragData>({
@@ -470,7 +473,7 @@ export function SessionBoardCard({
   const draggable = useDraggable({
     id: sessionId,
     data: dragData.current,
-    disabled: !canManage || dnd?.statusMutationPending === true,
+    disabled: !canDrag || dnd?.statusMutationPending === true,
   });
 
   useLayoutEffect(() => {
@@ -529,14 +532,14 @@ export function SessionBoardCard({
         <div
           ref={setDragNodeRef}
           style={{ transform: dragTransform }}
-          className={`relative w-full ${canManage ? 'cursor-grab active:cursor-grabbing' : ''}`}
-          {...(canManage ? draggable.attributes : {})}
-          {...(canManage ? dragListeners : {})}
-          role={canManage ? 'group' : undefined}
-          aria-label={canManage ? `Move ${title} to another status` : undefined}
+          className={`relative w-full ${canDrag ? 'cursor-grab active:cursor-grabbing' : ''}`}
+          {...(canDrag ? draggable.attributes : {})}
+          {...(canDrag ? dragListeners : {})}
+          role={canDrag ? 'group' : undefined}
+          aria-label={canDrag ? `Move ${title} to another status` : undefined}
           aria-pressed={undefined}
-          title={canManage ? 'Drag to change session status' : undefined}
-          data-session-board-drag-activator={canManage ? true : undefined}
+          title={canDrag ? 'Drag to change session status' : undefined}
+          data-session-board-drag-activator={canDrag ? true : undefined}
         >
           {children}
         </div>
diff --git a/apps/web/src/app/(authenticated)/sessions/SessionCard.tsx b/apps/web/src/app/(authenticated)/sessions/SessionCard.tsx
index 86fc568a15..56be723041 100644
--- a/apps/web/src/app/(authenticated)/sessions/SessionCard.tsx
+++ b/apps/web/src/app/(authenticated)/sessions/SessionCard.tsx
@@ -1,4 +1,3 @@
-import Link from 'next/link';
 import { format, formatDistanceToNow, isSameDay, isSameYear } from 'date-fns';
 import type { SessionManualStatus } from '@roomote/types';
 
@@ -21,6 +20,11 @@ import { SessionInferenceCostBreakdown } from '@/components/sessions/SessionInfe
 import { PrivateSessionIcon } from '@/components/sessions/PrivateSessionIcon';
 import { getSessionSurfaceLabel } from '@/components/sessions/session-surfaces';
 import { TaskAutomationIcon } from '@/components/tasks/TaskAutomationIcon';
+import {
+  SessionSelectionControl,
+  SessionSelectionLink,
+  SessionSelectionRow,
+} from '@/components/sessions/SessionSelection';
 import { SessionActions } from '../../(sandbox)/sessions/[sessionId]/SessionDeleteAction';
 
 type SessionCardData = {
@@ -108,41 +112,53 @@ export function SessionCard({
   const accessibleActivityTimestamp = activityDate.toLocaleString();
 
   return (
-    <div className="ph-no-capture group/card relative flex w-full @container items-start gap-3 p-4 transition-colors hover:bg-accent-foreground/10 group-data-[dragging=true]/board:hover:bg-transparent">
-      <Link
+    <SessionSelectionRow
+      sessionId={session.id}
+      className="ph-no-capture group/card relative flex w-full @container items-start gap-3 p-4 transition-colors hover:bg-accent-foreground/10 group-data-[dragging=true]/board:hover:bg-transparent"
+    >
+      <SessionSelectionLink
+        sessionId={session.id}
+        title={session.title}
+        canManage={session.canManage ?? false}
         href={`/sessions/${session.id}`}
         className="absolute inset-0 z-0 focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring"
       >
         <span className="sr-only">{session.title}</span>
-      </Link>
+      </SessionSelectionLink>
       <div className="pointer-events-none relative z-10 mt-1 shrink-0">
-        {session.ownerKind === 'automation' ? (
-          <span
-            className="flex size-8 items-center justify-center overflow-clip rounded-full border border-border bg-white dark:bg-muted"
-            aria-hidden="true"
-          >
-            <TaskAutomationIcon
-              automationKey={session.ownerAutomation}
-              className="size-7"
+        <SessionSelectionControl
+          sessionId={session.id}
+          title={session.title}
+          canManage={session.canManage ?? false}
+        >
+          {session.ownerKind === 'automation' ? (
+            <span
+              className="flex size-8 items-center justify-center overflow-clip rounded-full border border-border bg-white dark:bg-muted"
+              aria-hidden="true"
+            >
+              <TaskAutomationIcon
+                automationKey={session.ownerAutomation}
+                className="size-7"
+              />
+            </span>
+          ) : (
+            <Avatar
+              imageUrl={session.ownerImageUrl}
+              name={ownerDisplayName}
+              email={session.ownerEmail ?? undefined}
+              size="md"
+              alt=""
+              loading="eager"
+              decoding="sync"
             />
-          </span>
-        ) : (
-          <Avatar
-            imageUrl={session.ownerImageUrl}
-            name={ownerDisplayName}
-            email={session.ownerEmail ?? undefined}
-            size="md"
-            alt=""
-            loading="eager"
-            decoding="sync"
-          />
-        )}
-        {session.unread && session.ownerUserId === viewerUserId ? (
-          <span
-            aria-label="Unread activity"
-            className="absolute top-0 right-0 size-2 rounded-full bg-accent-foreground ring-2 ring-background"
-          />
-        ) : null}
+          )}
+          {session.unread && session.ownerUserId === viewerUserId ? (
+            <span
+              aria-label="Unread activity"
+              className="absolute top-0 right-0 size-2 rounded-full bg-accent-foreground ring-2 ring-background"
+            />
+          ) : null}
+        </SessionSelectionControl>
       </div>
       <div className="pointer-events-none relative z-10 min-w-0 flex-1">
         <div className="flex items-start justify-between gap-2 text-xs text-muted-foreground/75 md:items-center">
@@ -230,6 +246,6 @@ export function SessionCard({
           />
         </div>
       ) : null}
-    </div>
+    </SessionSelectionRow>
   );
 }
diff --git a/apps/web/src/app/(authenticated)/sessions/page.client.test.tsx b/apps/web/src/app/(authenticated)/sessions/page.client.test.tsx
index fde8fdb283..b774137df3 100644
--- a/apps/web/src/app/(authenticated)/sessions/page.client.test.tsx
+++ b/apps/web/src/app/(authenticated)/sessions/page.client.test.tsx
@@ -1,20 +1,47 @@
-import { render, screen, waitFor, within } from '@testing-library/react';
-
-const { getSessionsMock, sessionStatusState } = vi.hoisted(() => ({
-  getSessionsMock: vi.fn(),
-  sessionStatusState: {
-    current: ['active', 'needs_input', 'blocked', 'ready', 'done'] as Array<
-      'active' | 'needs_input' | 'blocked' | 'ready' | 'done'
-    >,
-  },
-}));
+import {
+  act,
+  fireEvent,
+  render,
+  screen,
+  waitFor,
+  within,
+} from '@testing-library/react';
+
+const { getSessionsMock, sessionStatusState, remove, refresh, push } =
+  vi.hoisted(() => ({
+    remove: vi.fn(),
+    refresh: vi.fn(),
+    push: vi.fn(),
+    getSessionsMock: vi.fn(),
+    sessionStatusState: {
+      current: ['active', 'needs_input', 'blocked', 'ready', 'done'] as Array<
+        'active' | 'needs_input' | 'blocked' | 'ready' | 'done'
+      >,
+    },
+  }));
 
 vi.mock('next/navigation', () => ({
   usePathname: () => '/sessions',
-  useRouter: () => ({ replace: vi.fn() }),
+  useRouter: () => ({ replace: vi.fn(), refresh, push }),
   useSearchParams: () => new URLSearchParams(),
 }));
 
+vi.mock('@/trpc/client', () => ({
+  useTRPC: () => ({ sessions: { delete: { mutationOptions: () => ({}) } } }),
+}));
+vi.mock('@tanstack/react-query', () => ({
+  useMutation: () => ({ mutateAsync: remove }),
+}));
+vi.mock(
+  '../../(sandbox)/sessions/[sessionId]/SessionDeleteAction',
+  async (importOriginal) => ({
+    ...(await importOriginal<object>()),
+    SessionActions: () => (
+      <button type="button" aria-label="More session actions" />
+    ),
+  }),
+);
+
 vi.mock('@/components/sessions/use-session-status-mutation', () => ({
   useSessionStatusMutation: () => ({ isPending: false, mutate: vi.fn() }),
 }));
@@ -37,6 +64,7 @@ vi.mock('@/lib/server/sessions', () => ({
       ownerEmail: 'test@example.com',
       ownerImageUrl: null,
       ownerUserId: 'user-1',
+      canManage: status !== 'blocked',
       privacy: 'shared',
       sourceSurface: 'web',
       activityAt: 1_788_000_000,
@@ -62,6 +90,7 @@ vi.mock('@/lib/server/sessions', () => ({
 describe('Sessions list', () => {
   beforeEach(() => {
     getSessionsMock.mockClear();
+    remove.mockReset().mockResolvedValue({ deleted: true });
     sessionStatusState.current = [
       'active',
       'needs_input',
@@ -71,6 +100,230 @@ describe('Sessions list', () => {
     ];
   });
 
+  it.each(['list', 'board'])(
+    'supports individual and page-wide selection without navigation or dragging in %s view',
+    async (view) => {
+      const { container } = render(
+        await SessionsPage({ searchParams: Promise.resolve({ view }) }),
+      );
+      const sessionLink = screen.getByRole('link', { name: /^Review active/ });
+      expect(sessionLink).toHaveAttribute('href', '/sessions/active');
+      fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+      expect(
+        screen.queryByRole('link', { name: /^Review active/ }),
+      ).not.toBeInTheDocument();
+      expect(
+        container.querySelector('[data-session-board-drag-activator]'),
+      ).toBeNull();
+      fireEvent.click(
+        screen.getByRole('button', { name: /^Select session: Review active/ }),
+      );
+      expect(
+        screen.getByRole('checkbox', { name: /^Select Review active/ }),
+      ).toBeChecked();
+      expect(
+        screen.getByRole('checkbox', {
+          name: 'Select all sessions on this page',
+        }),
+      ).toBePartiallyChecked();
+      expect(
+        screen.getByRole('checkbox', { name: /^Select Review blocked/ }),
+      ).toBeDisabled();
+      fireEvent.click(
+        screen.getByRole('checkbox', {
+          name: 'Select all sessions on this page',
+        }),
+      );
+      expect(screen.getByRole('button', { name: 'Delete (4)' })).toBeEnabled();
+      expect(
+        screen.getByRole('checkbox', {
+          name: 'Select all sessions on this page',
+        }),
+      ).toBeChecked();
+      fireEvent.click(
+        screen.getByRole('checkbox', { name: /^Select Review ready/ }),
+      );
+      expect(screen.getByRole('button', { name: 'Delete (3)' })).toBeEnabled();
+      expect(push).not.toHaveBeenCalled();
+      fireEvent.click(
+        screen.getByRole('button', { name: 'Exit selection mode' }),
+      );
+      expect(
+        screen.getByRole('link', { name: /^Review active/ }),
+      ).toHaveAttribute('href', '/sessions/active');
+      fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+      expect(screen.getByRole('button', { name: 'Delete (0)' })).toBeDisabled();
+    },
+  );
+
+  it.each(['list', 'board'])(
+    'confirms bulk deletion and refreshes the current %s view without redirecting',
+    async (view) => {
+      render(
+        await SessionsPage({
+          searchParams: Promise.resolve({
+            view,
+            user: 'user-1',
+            before: 'cursor',
+          }),
+        }),
+      );
+      fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+      fireEvent.click(
+        screen.getByRole('checkbox', {
+          name: 'Select all sessions on this page',
+        }),
+      );
+      fireEvent.click(screen.getByRole('button', { name: 'Delete (4)' }));
+      expect(remove).not.toHaveBeenCalled();
+      fireEvent.click(
+        within(screen.getByRole('dialog')).getByRole('button', {
+          name: 'Cancel',
+        }),
+      );
+      expect(screen.getByRole('button', { name: 'Delete (4)' })).toBeEnabled();
+      fireEvent.click(screen.getByRole('button', { name: 'Delete (4)' }));
+      fireEvent.click(
+        within(screen.getByRole('dialog')).getByRole('button', {
+          name: 'Delete (4)',
+        }),
+      );
+      await waitFor(() => expect(refresh).toHaveBeenCalledOnce());
+      expect(remove.mock.calls.map(([input]) => input.sessionId)).toEqual([
+        'active',
+        'needs_input',
+        'ready',
+        'done',
+      ]);
+      expect(push).not.toHaveBeenCalled();
+      expect(screen.queryByRole('dialog')).not.toBeInTheDocument();
+      expect(
+        screen.getByRole('button', { name: 'Select sessions' }),
+      ).toBeEnabled();
+    },
+  );
+
+  it('keeps only failed deletions selected, including rejected requests, and permits retry', async () => {
+    remove
+      .mockResolvedValueOnce({ deleted: true })
+      .mockResolvedValueOnce({ deleted: false, reason: 'session_busy' })
+      .mockRejectedValueOnce(new Error('network'))
+      .mockResolvedValueOnce({ deleted: true });
+    render(await SessionsPage({ searchParams: Promise.resolve({}) }));
+    fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+    fireEvent.click(
+      screen.getByRole('checkbox', {
+        name: 'Select all sessions on this page',
+      }),
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Delete (4)' }));
+    fireEvent.click(
+      within(screen.getByRole('dialog')).getByRole('button', {
+        name: 'Delete (4)',
+      }),
+    );
+    await waitFor(() => expect(refresh).toHaveBeenCalledOnce());
+    expect(
+      screen.getByRole('checkbox', { name: /^Select Review needs_input/ }),
+    ).toBeChecked();
+    expect(
+      screen.getByRole('checkbox', { name: /^Select Review ready/ }),
+    ).toBeChecked();
+    expect(
+      screen.getByRole('checkbox', { name: /^Select Review active/ }),
+    ).not.toBeChecked();
+    expect(screen.getByRole('button', { name: 'Delete (2)' })).toBeEnabled();
+    fireEvent.click(screen.getByRole('button', { name: 'Delete (2)' }));
+    fireEvent.click(
+      within(screen.getByRole('dialog')).getByRole('button', {
+        name: 'Delete (2)',
+      }),
+    );
+    await waitFor(() => expect(refresh).toHaveBeenCalledTimes(2));
+    expect(
+      remove.mock.calls.slice(4).map(([input]) => input.sessionId),
+    ).toEqual(['needs_input', 'ready']);
+  });
+
+  it.each(['list', 'board'])(
+    'locks selection while deleting a single selected session in %s view',
+    async (view) => {
+      let finish!: (result: { deleted: boolean }) => void;
+      remove.mockImplementationOnce(
+        () =>
+          new Promise((resolve) => {
+            finish = resolve;
+          }),
+      );
+      render(await SessionsPage({ searchParams: Promise.resolve({ view }) }));
+      fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+      fireEvent.click(
+        screen.getByRole('checkbox', { name: /^Select Review active/ }),
+      );
+      fireEvent.click(screen.getByRole('button', { name: 'Delete (1)' }));
+      fireEvent.click(
+        within(screen.getByRole('dialog')).getByRole('button', {
+          name: 'Delete (1)',
+        }),
+      );
+      expect(
+        screen.getByRole('button', { name: 'Deleting...' }),
+      ).toBeDisabled();
+      expect(screen.getByRole('button', { name: 'Cancel' })).toBeDisabled();
+      expect(
+        screen.getByRole('checkbox', {
+          name: 'Select all sessions on this page',
+          hidden: true,
+        }),
+      ).toBeDisabled();
+      expect(remove).toHaveBeenCalledOnce();
+      await act(async () => finish({ deleted: true }));
+      expect(refresh).toHaveBeenCalledOnce();
+      expect(push).not.toHaveBeenCalled();
+      expect(
+        screen.getByRole('button', { name: 'Select sessions' }),
+      ).toBeEnabled();
+    },
+  );
+
+  it('prunes selections on refresh, including an empty result, and resets on view/filter/page changes', async () => {
+    const { rerender } = render(
+      await SessionsPage({ searchParams: Promise.resolve({}) }),
+    );
+    fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+    fireEvent.click(
+      screen.getByRole('checkbox', {
+        name: 'Select all sessions on this page',
+      }),
+    );
+    sessionStatusState.current = ['active'];
+    rerender(await SessionsPage({ searchParams: Promise.resolve({}) }));
+    expect(screen.getByRole('button', { name: 'Delete (1)' })).toBeEnabled();
+    sessionStatusState.current = [];
+    rerender(await SessionsPage({ searchParams: Promise.resolve({}) }));
+    expect(screen.getByRole('button', { name: 'Delete (0)' })).toBeDisabled();
+    sessionStatusState.current = ['active', 'ready'];
+    rerender(await SessionsPage({ searchParams: Promise.resolve({}) }));
+    expect(screen.getByRole('button', { name: 'Delete (0)' })).toBeDisabled();
+    for (const params of [
+      { view: 'board' },
+      { view: 'board', status: 'active' },
+      { view: 'board', before: 'older' },
+    ]) {
+      fireEvent.click(
+        screen.getByRole('checkbox', {
+          name: 'Select all sessions on this page',
+        }),
+      );
+      rerender(await SessionsPage({ searchParams: Promise.resolve(params) }));
+      expect(
+        screen.getByRole('button', { name: 'Select sessions' }),
+      ).toBeEnabled();
+      fireEvent.click(screen.getByRole('button', { name: 'Select sessions' }));
+      expect(screen.getByRole('button', { name: 'Delete (0)' })).toBeDisabled();
+    }
+  });
+
   it('keeps every session and long-content link accessible, including older sessions', async () => {
     const { container } = render(
       await SessionsPage({ searchParams: Promise.resolve({}) }),
diff --git a/apps/web/src/app/(authenticated)/sessions/page.tsx b/apps/web/src/app/(authenticated)/sessions/page.tsx
index 9ad9eab1ce..0398ac20e7 100644
--- a/apps/web/src/app/(authenticated)/sessions/page.tsx
+++ b/apps/web/src/app/(authenticated)/sessions/page.tsx
@@ -19,6 +19,7 @@ import {
   type SessionScope,
 } from '@/lib/server/sessions';
 import { Empty, EmptyDescription, EmptyHeader } from '@/components/system';
+import { SessionSelection } from '@/components/sessions/SessionSelection';
 
 import { SessionsFilters } from './SessionsFilters';
 import { SessionCard } from './SessionCard';
@@ -130,100 +131,107 @@ export default async function SessionsPage({
 
   return (
     <div className="flex h-full min-h-0 min-w-0 w-full flex-col bg-card">
-      <div className="border-b-4 border-b-card bg-background p-4">
-        <SessionsFilters
-          userId={user ?? null}
-          timePeriod={timePeriod}
-          scope={scope}
-          status={status ?? 'all'}
-          view={view}
-          query={q ?? ''}
-          repository={params.repository ?? null}
-          pullRequest={params.pullRequest ?? null}
-          source={params.source ?? 'all'}
-          sourceOptions={sources}
-          model={params.model ?? null}
-          archive={archive}
-        />
-      </div>
-      <main
-        className={`min-h-0 flex-1 overflow-y-auto bg-background ${view === 'board' ? 'md:flex md:flex-col md:overflow-hidden' : ''}`}
+      <SessionSelection
+        key={JSON.stringify(params)}
+        sessionIds={result.sessions
+          .filter((session) => session.canManage)
+          .map((session) => session.id)}
+        toolbar={
+          <SessionsFilters
+            userId={user ?? null}
+            timePeriod={timePeriod}
+            scope={scope}
+            status={status ?? 'all'}
+            view={view}
+            query={q ?? ''}
+            repository={params.repository ?? null}
+            pullRequest={params.pullRequest ?? null}
+            source={params.source ?? 'all'}
+            sourceOptions={sources}
+            model={params.model ?? null}
+            archive={archive}
+          />
+        }
       >
-        {result.sessions.length === 0 ? (
-          <Empty>
-            <EmptyHeader>
-              {hasAppliedFilters ? (
-                <>
-                  <EmptyDescription>
-                    No sessions match your filters.
-                  </EmptyDescription>
-                  <EmptyDescription>
-                    <Link
-                      href={clearFiltersHref}
-                      className="font-semibold hover:underline"
+        <main
+          className={`min-h-0 flex-1 overflow-y-auto bg-background ${view === 'board' ? 'md:flex md:flex-col md:overflow-hidden' : ''}`}
+        >
+          {result.sessions.length === 0 ? (
+            <Empty>
+              <EmptyHeader>
+                {hasAppliedFilters ? (
+                  <>
+                    <EmptyDescription>
+                      No sessions match your filters.
+                    </EmptyDescription>
+                    <EmptyDescription>
+                      <Link
+                        href={clearFiltersHref}
+                        className="font-semibold hover:underline"
+                      >
+                        Clear filters
+                      </Link>{' '}
+                      to show all sessions.
+                    </EmptyDescription>
+                  </>
+                ) : (
+                  <EmptyDescription>No sessions found.</EmptyDescription>
+                )}
+              </EmptyHeader>
+            </Empty>
+          ) : view === 'board' ? (
+            <SessionBoard>
+              {boardColumns.map(({ column, sessions: columnSessions }) => (
+                <SessionBoardColumn
+                  key={column}
+                  column={column}
+                  label={getSessionStatusLabel(column)}
+                  count={columnSessions.length}
+                  statusFilter={status}
+                >
+                  {columnSessions.map((session) => (
+                    <SessionBoardCard
+                      key={session.id}
+                      sessionId={session.id}
+                      column={column}
+                      canManage={session.canManage ?? false}
+                      title={session.title}
                     >
-                      Clear filters
-                    </Link>{' '}
-                    to show all sessions.
-                  </EmptyDescription>
-                </>
-              ) : (
-                <EmptyDescription>No sessions found.</EmptyDescription>
-              )}
-            </EmptyHeader>
-          </Empty>
-        ) : view === 'board' ? (
-          <SessionBoard>
-            {boardColumns.map(({ column, sessions: columnSessions }) => (
-              <SessionBoardColumn
-                key={column}
-                column={column}
-                label={getSessionStatusLabel(column)}
-                count={columnSessions.length}
-                statusFilter={status}
+                      <SessionCard
+                        session={session}
+                        viewerUserId={authorizedUser.userId}
+                        query={q}
+                        hideAttentionBadges
+                      />
+                    </SessionBoardCard>
+                  ))}
+                </SessionBoardColumn>
+              ))}
+            </SessionBoard>
+          ) : (
+            <div className="divide-y divide-card">
+              {result.sessions.map((session) => (
+                <SessionCard
+                  key={session.id}
+                  session={session}
+                  viewerUserId={authorizedUser.userId}
+                  query={q}
+                />
+              ))}
+            </div>
+          )}
+          {result.nextCursor ? (
+            <div className="flex justify-center p-4">
+              <Link
+                href={`/sessions?${olderParams.toString()}`}
+                className="text-sm underline-offset-4 hover:underline"
               >
-                {columnSessions.map((session) => (
-                  <SessionBoardCard
-                    key={session.id}
-                    sessionId={session.id}
-                    column={column}
-                    canManage={session.canManage ?? false}
-                    title={session.title}
-                  >
-                    <SessionCard
-                      session={session}
-                      viewerUserId={authorizedUser.userId}
-                      query={q}
-                      hideAttentionBadges
-                    />
-                  </SessionBoardCard>
-                ))}
-              </SessionBoardColumn>
-            ))}
-          </SessionBoard>
-        ) : (
-          <div className="divide-y divide-card">
-            {result.sessions.map((session) => (
-              <SessionCard
-                key={session.id}
-                session={session}
-                viewerUserId={authorizedUser.userId}
-                query={q}
-              />
-            ))}
-          </div>
-        )}
-        {result.nextCursor ? (
-          <div className="flex justify-center p-4">
-            <Link
-              href={`/sessions?${olderParams.toString()}`}
-              className="text-sm underline-offset-4 hover:underline"
-            >
-              Show older sessions
-            </Link>
-          </div>
-        ) : null}
-      </main>
+                Show older sessions
+              </Link>
+            </div>
+          ) : null}
+        </main>
+      </SessionSelection>
     </div>
   );
 }
diff --git a/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.client.test.tsx b/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.client.test.tsx
index 5ebcce9a5a..f557c5c153 100644
--- a/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.client.test.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.client.test.tsx
@@ -47,8 +47,7 @@ vi.mock('sonner', () => ({
 vi.mock('@/lib/auth-client', () => ({
   authClient: {
     signIn: {
-      oauth2: signInOauth2Mock,
-      social: signInSocialMock,
+      social: signInOauth2Mock,
     },
   },
 }));
@@ -1064,7 +1063,7 @@ describe('StepAuthEnvVars', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'microsoft-entra-id',
+        provider: 'microsoft-entra-id',
         callbackURL: '/setup',
         disableRedirect: true,
       });
@@ -1108,7 +1107,7 @@ describe('StepAuthEnvVars', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'slack',
+        provider: 'slack',
         callbackURL: '/api/slack/install-after-auth?redirect=%2Fsetup',
         disableRedirect: true,
       });
@@ -1149,7 +1148,7 @@ describe('StepAuthEnvVars', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'microsoft-entra-id',
+        provider: 'microsoft-entra-id',
         callbackURL: '/setup',
         disableRedirect: true,
       });
diff --git a/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx b/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx
index fde3f72cb8..e8dec6a84c 100644
--- a/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx
+++ b/apps/web/src/app/(onboarding)/setup/StepAuthEnvVars.tsx
@@ -24,17 +24,11 @@ import {
 
 const BOOTSTRAP_SIGN_IN_CALLBACK_PATH = '/setup';
 
-function getOAuth2ProviderId(
+// Microsoft sign-in is registered under the Entra provider id.
+function toSocialProviderId(
   providerId: SetupAuthStatus['preselectedProvider'],
-): string | null {
-  switch (providerId) {
-    case 'slack':
-      return providerId;
-    case 'microsoft':
-      return 'microsoft-entra-id';
-    default:
-      return null;
-  }
+): string {
+  return providerId === 'microsoft' ? 'microsoft-entra-id' : providerId;
 }
 
 export function StepAuthEnvVars({
@@ -117,18 +111,11 @@ export function StepAuthEnvVars({
             selectedProvider.id,
             BOOTSTRAP_SIGN_IN_CALLBACK_PATH,
           );
-          const oauth2ProviderId = getOAuth2ProviderId(selectedProvider.id);
-          const result = oauth2ProviderId
-            ? await authClient.signIn.oauth2({
-                providerId: oauth2ProviderId,
-                callbackURL,
-                disableRedirect: true,
-              })
-            : await authClient.signIn.social({
-                provider: selectedProvider.id,
-                callbackURL,
-                disableRedirect: true,
-              });
+          const result = await authClient.signIn.social({
+            provider: toSocialProviderId(selectedProvider.id),
+            callbackURL,
+            disableRedirect: true,
+          });
 
           if (result.error) {
             toast.error(result.error.message || 'Unable to sign in.');
diff --git a/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.client.test.tsx b/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.client.test.tsx
index cf08f7d6df..437a3039d4 100644
--- a/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.client.test.tsx
+++ b/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.client.test.tsx
@@ -296,4 +296,22 @@ describe('SessionActions', () => {
     });
     expect(mocks.refresh).toHaveBeenCalled();
   });
+
+  it.each([true, false])(
+    'refreshes deletion in place only for overview actions (listRow=%s)',
+    (listRow) => {
+      render(<SessionActions sessionId="session-1" listRow={listRow} />);
+      fireEvent.click(screen.getByText('Delete session'));
+      fireEvent.click(
+        screen.getAllByRole('button', { name: 'Delete session' }).at(-1)!,
+      );
+      expect(mocks.remove).toHaveBeenCalledWith({ sessionId: 'session-1' });
+      expect(mocks.refresh).toHaveBeenCalledOnce();
+      if (listRow) expect(mocks.push).not.toHaveBeenCalled();
+      else expect(mocks.push).toHaveBeenCalledWith('/');
+      expect(
+        screen.queryByRole('heading', { name: 'Delete this session?' }),
+      ).not.toBeInTheDocument();
+    },
+  );
 });
diff --git a/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.tsx b/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.tsx
index 3ece4c6ab7..be1fc529bd 100644
--- a/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.tsx
+++ b/apps/web/src/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction.tsx
@@ -93,7 +93,8 @@ export function SessionActions({
       onSuccess: (result) => {
         if (result.deleted) {
           toast.success('Session deleted.');
-          router.push('/');
+          setOpen(false);
+          if (!listRow) router.push('/');
           router.refresh();
           return;
         }
diff --git a/apps/web/src/app/(unauthenticated)/auth-form.client.test.tsx b/apps/web/src/app/(unauthenticated)/auth-form.client.test.tsx
index 9bf0c0e3c5..914bdc170a 100644
--- a/apps/web/src/app/(unauthenticated)/auth-form.client.test.tsx
+++ b/apps/web/src/app/(unauthenticated)/auth-form.client.test.tsx
@@ -19,7 +19,7 @@ vi.mock('next/navigation', () => ({
 vi.mock('@/lib/auth-client', () => ({
   authClient: {
     signIn: {
-      oauth2: signInOauth2Mock,
+      social: signInOauth2Mock,
     },
   },
 }));
@@ -51,7 +51,7 @@ describe('AuthForm', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'slack',
+        provider: 'slack',
         callbackURL:
           '/api/slack/install-after-auth?redirect=%2Ftasks%3Fview%3Dmine',
       });
@@ -69,7 +69,7 @@ describe('AuthForm', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'microsoft-entra-id',
+        provider: 'microsoft-entra-id',
         callbackURL: '/setup',
       });
     });
@@ -86,7 +86,7 @@ describe('AuthForm', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'microsoft-entra-id',
+        provider: 'microsoft-entra-id',
         callbackURL: '/setup',
       });
     });
@@ -103,7 +103,7 @@ describe('AuthForm', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'microsoft-entra-id',
+        provider: 'microsoft-entra-id',
         callbackURL: '/setup',
       });
     });
@@ -120,7 +120,7 @@ describe('AuthForm', () => {
 
     await waitFor(() => {
       expect(signInOauth2Mock).toHaveBeenCalledWith({
-        providerId: 'microsoft-entra-id',
+        provider: 'microsoft-entra-id',
         callbackURL: '/settings',
       });
     });
diff --git a/apps/web/src/app/(unauthenticated)/auth-form.tsx b/apps/web/src/app/(unauthenticated)/auth-form.tsx
index 157f327041..f31efbd129 100644
--- a/apps/web/src/app/(unauthenticated)/auth-form.tsx
+++ b/apps/web/src/app/(unauthenticated)/auth-form.tsx
@@ -109,8 +109,8 @@ export function AuthForm({
 
     try {
       const callbackURL = getAuthProviderCallbackUrl(provider, redirectUrl);
-      const result = await authClient.signIn.oauth2({
-        providerId: provider === 'slack' ? provider : 'microsoft-entra-id',
+      const result = await authClient.signIn.social({
+        provider: provider === 'slack' ? provider : 'microsoft-entra-id',
         callbackURL,
       });
 
diff --git a/apps/web/src/app/api/teams/auth/__tests__/route.test.ts b/apps/web/src/app/api/teams/auth/__tests__/route.test.ts
index 6f27970de5..8bf00b0082 100644
--- a/apps/web/src/app/api/teams/auth/__tests__/route.test.ts
+++ b/apps/web/src/app/api/teams/auth/__tests__/route.test.ts
@@ -80,12 +80,12 @@ describe('GET /api/teams/auth', () => {
 
     const authRequest = handleAuthRequestMock.mock.calls[0]?.[0] as Request;
     await expect(authRequest.clone().json()).resolves.toMatchObject({
-      providerId: 'microsoft-entra-id',
+      provider: 'microsoft-entra-id',
       callbackURL: '/api/teams/auth?state=token-1',
       errorCallbackURL: '/api/teams/auth?state=token-1',
     });
     expect(authRequest.url).toBe(
-      'http://localhost:13000/api/auth/sign-in/oauth2',
+      'http://localhost:13000/api/auth/sign-in/social',
     );
     // Better Auth rejects POSTs without an Origin (MISSING_OR_NULL_ORIGIN).
     expect(authRequest.headers.get('origin')).toBe('http://localhost:13000');
@@ -135,11 +135,11 @@ describe('GET /api/teams/auth', () => {
     );
 
     const authRequest = handleAuthRequestMock.mock.calls[0]?.[0] as Request;
-    expect(authRequest.url).toBe('http://localhost:13000/api/auth/oauth2/link');
+    expect(authRequest.url).toBe('http://localhost:13000/api/auth/link-social');
     expect(authRequest.headers.get('cookie')).toBe('session=abc');
     expect(authRequest.headers.get('origin')).toBe('http://localhost:13000');
     await expect(authRequest.clone().json()).resolves.toMatchObject({
-      providerId: 'microsoft-entra-id',
+      provider: 'microsoft-entra-id',
       callbackURL: '/api/teams/auth?state=token-3&linked=1',
       errorCallbackURL: '/api/teams/auth?state=token-3&linked=1',
     });
diff --git a/apps/web/src/app/api/teams/auth/route.ts b/apps/web/src/app/api/teams/auth/route.ts
index ad573aa229..6a7a210fa4 100644
--- a/apps/web/src/app/api/teams/auth/route.ts
+++ b/apps/web/src/app/api/teams/auth/route.ts
@@ -98,14 +98,14 @@ async function startMicrosoftOAuth({
   const authResponse = await handleAuthRequest(
     new Request(
       new URL(
-        type === 'link' ? '/api/auth/oauth2/link' : '/api/auth/sign-in/oauth2',
+        type === 'link' ? '/api/auth/link-social' : '/api/auth/sign-in/social',
         callbackHost,
       ),
       {
         method: 'POST',
         headers,
         body: JSON.stringify({
-          providerId: MICROSOFT_ENTRA_PROVIDER_ID,
+          provider: MICROSOFT_ENTRA_PROVIDER_ID,
           callbackURL: returnPath,
           errorCallbackURL: returnPath,
         }),
diff --git a/apps/web/src/components/sessions/SessionSelection.tsx b/apps/web/src/components/sessions/SessionSelection.tsx
new file mode 100644
index 0000000000..8401ad72d8
--- /dev/null
+++ b/apps/web/src/components/sessions/SessionSelection.tsx
@@ -0,0 +1,296 @@
+'use client';
+
+import {
+  createContext,
+  useContext,
+  useEffect,
+  useState,
+  type ReactNode,
+} from 'react';
+import Link from 'next/link';
+import { useRouter } from 'next/navigation';
+import { useMutation } from '@tanstack/react-query';
+import { toast } from 'sonner';
+
+import { useTRPC } from '@/trpc/client';
+import { cn } from '@/lib/utils';
+import {
+  Button,
+  Checkbox,
+  Dialog,
+  DialogContent,
+  DialogDescription,
+  DialogFooter,
+  DialogHeader,
+  DialogTitle,
+  ListChecks,
+  Trash2,
+  X,
+} from '@/components/system';
+import { SESSION_DELETION_DESCRIPTION } from '@/app/(sandbox)/sessions/[sessionId]/SessionDeleteAction';
+
+type Selection = {
+  active: boolean;
+  pending: boolean;
+  selected: Set<string>;
+  toggle: (id: string) => void;
+};
+
+const SessionSelectionContext = createContext<Selection | null>(null);
+
+export function useSessionSelectionActive() {
+  return useContext(SessionSelectionContext)?.active ?? false;
+}
+
+export function SessionSelection({
+  sessionIds,
+  toolbar,
+  children,
+}: {
+  sessionIds: string[];
+  toolbar: ReactNode;
+  children: ReactNode;
+}) {
+  const router = useRouter();
+  const trpc = useTRPC();
+  const deleteSession = useMutation(trpc.sessions.delete.mutationOptions());
+  const [active, setActive] = useState(false);
+  const [selectedIds, setSelectedIds] = useState(new Set<string>());
+  const [confirming, setConfirming] = useState(false);
+  const [pending, setPending] = useState(false);
+  // Refreshes can remove sessions or management permissions without changing URL.
+  const selected = new Set(sessionIds.filter((id) => selectedIds.has(id)));
+  useEffect(() => {
+    setSelectedIds((previous) => {
+      const next = new Set(sessionIds.filter((id) => previous.has(id)));
+      return next.size === previous.size ? previous : next;
+    });
+  }, [sessionIds]);
+
+  const exit = () => {
+    setActive(false);
+    setSelectedIds(new Set());
+    setConfirming(false);
+  };
+  const toggle = (id: string) => {
+    if (pending || !sessionIds.includes(id)) return;
+    setSelectedIds((previous) => {
+      const next = new Set(previous);
+      if (next.has(id)) next.delete(id);
+      else next.add(id);
+      return next;
+    });
+  };
+  const removeSelected = async () => {
+    if (pending || selected.size === 0) return;
+    setPending(true);
+    const deleted = new Set<string>();
+    // Reuse each session's authorization, stop, artifact, and memory safeguards.
+    // Keep failures selected so a partial deletion can be retried safely.
+    for (const sessionId of selected) {
+      try {
+        const result = await deleteSession.mutateAsync({ sessionId });
+        if (result.deleted) deleted.add(sessionId);
+      } catch {
+        // Continue processing the other selected sessions.
+      }
+    }
+    const failedCount = selected.size - deleted.size;
+    if (deleted.size > 0) {
+      toast.success(
+        `Deleted ${deleted.size} session${deleted.size === 1 ? '' : 's'}.`,
+      );
+    }
+    if (failedCount > 0) {
+      toast.error(
+        `${failedCount} session${failedCount === 1 ? '' : 's'} could not be deleted. Try again shortly.`,
+      );
+      setSelectedIds(new Set([...selected].filter((id) => !deleted.has(id))));
+    } else {
+      exit();
+    }
+    setConfirming(false);
+    setPending(false);
+    router.refresh();
+  };
+
+  return (
+    <SessionSelectionContext.Provider
+      value={{ active, pending, selected, toggle }}
+    >
+      <div className="flex flex-wrap items-center gap-3 border-b-4 border-b-card bg-background p-4">
+        <div className="min-w-0 flex-1">{toolbar}</div>
+        {active ? (
+          <div
+            className="flex items-center gap-2"
+            role="group"
+            aria-label="Session selection"
+          >
+            <label className="flex items-center gap-2 text-sm">
+              <Checkbox
+                aria-label="Select all sessions on this page"
+                checked={
+                  selected.size === 0
+                    ? false
+                    : selected.size === sessionIds.length
+                      ? true
+                      : 'indeterminate'
+                }
+                disabled={pending || sessionIds.length === 0}
+                onCheckedChange={(checked) =>
+                  setSelectedIds(
+                    checked === true ? new Set(sessionIds) : new Set(),
+                  )
+                }
+              />
+              All
+            </label>
+            <Button
+              variant="destructive"
+              size="sm"
+              disabled={pending || selected.size === 0}
+              onClick={() => setConfirming(true)}
+            >
+              <Trash2 /> Delete ({selected.size})
+            </Button>
+            <Button
+              variant="ghost"
+              size="icon"
+              aria-label="Exit selection mode"
+              disabled={pending}
+              onClick={exit}
+            >
+              <X />
+            </Button>
+          </div>
+        ) : (
+          <Button
+            variant="ghost"
+            size="icon"
+            aria-label="Select sessions"
+            title="Select sessions"
+            disabled={sessionIds.length === 0}
+            onClick={() => setActive(true)}
+          >
+            <ListChecks />
+          </Button>
+        )}
+      </div>
+      {children}
+      <Dialog
+        open={confirming}
+        onOpenChange={(open) => {
+          if (!pending) setConfirming(open);
+        }}
+      >
+        <DialogContent>
+          <DialogHeader>
+            <DialogTitle>
+              Delete {selected.size} session{selected.size === 1 ? '' : 's'}?
+            </DialogTitle>
+            <DialogDescription>
+              {SESSION_DELETION_DESCRIPTION}
+            </DialogDescription>
+          </DialogHeader>
+          <DialogFooter>
+            <Button
+              variant="outline"
+              disabled={pending}
+              onClick={() => setConfirming(false)}
+            >
+              Cancel
+            </Button>
+            <Button
+              variant="destructive"
+              disabled={pending || selected.size === 0}
+              onClick={() => void removeSelected()}
+            >
+              {pending ? 'Deleting...' : `Delete (${selected.size})`}
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
+    </SessionSelectionContext.Provider>
+  );
+}
+
+export function SessionSelectionRow({
+  sessionId,
+  className,
+  children,
+}: {
+  sessionId: string;
+  className: string;
+  children: ReactNode;
+}) {
+  const selection = useContext(SessionSelectionContext);
+  return (
+    <div
+      className={cn(
+        className,
+        selection?.selected.has(sessionId) && 'bg-accent-foreground/10',
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+export function SessionSelectionLink({
+  sessionId,
+  title,
+  canManage,
+  href,
+  className,
+  children,
+}: {
+  sessionId: string;
+  title: string;
+  canManage: boolean;
+  href: string;
+  className: string;
+  children: ReactNode;
+}) {
+  const selection = useContext(SessionSelectionContext);
+  if (selection?.active) {
+    return (
+      <button
+        type="button"
+        className={className}
+        aria-label={`Select session: ${title}`}
+        aria-pressed={selection.selected.has(sessionId)}
+        disabled={!canManage || selection.pending}
+        onClick={() => selection.toggle(sessionId)}
+      />
+    );
+  }
+  return (
+    <Link href={href} className={className}>
+      {children}
+    </Link>
+  );
+}
+
+export function SessionSelectionControl({
+  sessionId,
+  title,
+  canManage,
+  children,
+}: {
+  sessionId: string;
+  title: string;
+  canManage: boolean;
+  children: ReactNode;
+}) {
+  const selection = useContext(SessionSelectionContext);
+  if (!selection?.active) return children;
+  return (
+    <Checkbox
+      className="pointer-events-auto"
+      aria-label={`Select ${title}`}
+      checked={selection.selected.has(sessionId)}
+      disabled={!canManage || selection.pending}
+      onCheckedChange={() => selection.toggle(sessionId)}
+    />
+  );
+}
diff --git a/apps/web/src/hooks/linked-accounts/shared.ts b/apps/web/src/hooks/linked-accounts/shared.ts
index f60664b4ea..3d106868e9 100644
--- a/apps/web/src/hooks/linked-accounts/shared.ts
+++ b/apps/web/src/hooks/linked-accounts/shared.ts
@@ -27,8 +27,8 @@ export function createUseAuthenticateOAuthLinkedAccount({
   return function useAuthenticateOAuthLinkedAccount() {
     return useMutation({
       mutationFn: async (redirectPath: string) => {
-        const result = await authClient.oauth2.link({
-          providerId,
+        const result = await authClient.linkSocial({
+          provider: providerId,
           callbackURL: redirectPath,
           errorCallbackURL: redirectPath,
         });
diff --git a/apps/web/src/lib/auth-client.client.test.ts b/apps/web/src/lib/auth-client.client.test.ts
new file mode 100644
index 0000000000..867004e776
--- /dev/null
+++ b/apps/web/src/lib/auth-client.client.test.ts
@@ -0,0 +1,27 @@
+afterEach(() => vi.unstubAllGlobals());
+
+it('uses the upgraded library social sign-in and explicit linking endpoints', async () => {
+  const fetch = vi.fn(async (_input: RequestInfo | URL, _init?: RequestInit) =>
+    Response.json({
+      url: 'https://provider.example.test/authorize',
+      redirect: false,
+    }),
+  );
+  vi.stubGlobal('fetch', fetch);
+  vi.resetModules();
+  const { authClient } = await import('./auth-client');
+  await authClient.signIn.social({
+    provider: 'microsoft-entra-id',
+    callbackURL: '/sessions',
+    disableRedirect: true,
+  });
+  await authClient.linkSocial({
+    provider: 'gitlab',
+    callbackURL: '/settings/personal',
+  });
+  expect(fetch).toHaveBeenCalledTimes(2);
+  expect(String(fetch.mock.calls[0]?.[0])).toContain(
+    '/api/auth/sign-in/social',
+  );
+  expect(String(fetch.mock.calls[1]?.[0])).toContain('/api/auth/link-social');
+});
diff --git a/apps/web/src/lib/auth-client.ts b/apps/web/src/lib/auth-client.ts
index f29edb5029..281432a160 100644
--- a/apps/web/src/lib/auth-client.ts
+++ b/apps/web/src/lib/auth-client.ts
@@ -1,13 +1,12 @@
 'use client';
 
 import { createAuthClient } from 'better-auth/react';
-import { genericOAuthClient } from 'better-auth/client/plugins';
 
 type BaseAuthClient = ReturnType<typeof createAuthClient>;
 type OAuth2SignInInput = {
   callbackURL?: string;
   disableRedirect?: boolean;
-  providerId: string;
+  provider: string;
 };
 type OAuth2SignInResult = {
   data?: { redirect?: boolean; url?: string } | null;
@@ -16,7 +15,7 @@ type OAuth2SignInResult = {
 type OAuth2LinkInput = {
   callbackURL: string;
   errorCallbackURL?: string;
-  providerId: string;
+  provider: string;
   scopes?: string[];
 };
 type OAuth2LinkResult = {
@@ -58,17 +57,14 @@ type ChangeEmailResult = {
 };
 type RoomoteAuthClient = BaseAuthClient & {
   signIn: BaseAuthClient['signIn'] & {
-    oauth2(input: OAuth2SignInInput): Promise<OAuth2SignInResult>;
-  };
-  oauth2: {
-    link(input: OAuth2LinkInput): Promise<OAuth2LinkResult>;
+    social(input: OAuth2SignInInput): Promise<OAuth2SignInResult>;
   };
+  linkSocial(input: OAuth2LinkInput): Promise<OAuth2LinkResult>;
   unlinkAccount(input: UnlinkAccountInput): Promise<UnlinkAccountResult>;
   resetPassword(input: ResetPasswordInput): Promise<ResetPasswordResult>;
   changePassword(input: ChangePasswordInput): Promise<ChangePasswordResult>;
   changeEmail(input: ChangeEmailInput): Promise<ChangeEmailResult>;
 };
 
-export const authClient: RoomoteAuthClient = createAuthClient({
-  plugins: [genericOAuthClient()],
-}) as RoomoteAuthClient;
+export const authClient: RoomoteAuthClient =
+  createAuthClient() as RoomoteAuthClient;
diff --git a/apps/web/src/lib/server/auth-oauth-compatibility.ts b/apps/web/src/lib/server/auth-oauth-compatibility.ts
new file mode 100644
index 0000000000..45c1c3ca35
--- /dev/null
+++ b/apps/web/src/lib/server/auth-oauth-compatibility.ts
@@ -0,0 +1,204 @@
+import type { BetterAuthPlugin } from 'better-auth';
+import {
+  addOAuthServerContext,
+  createAuthMiddleware,
+  getOAuthState,
+  getSessionFromCtx,
+} from 'better-auth/api';
+import type { OAuthProvider } from 'better-auth/oauth2';
+import { verifyProviderIdToken } from 'better-auth/oauth2';
+import { microsoft } from 'better-auth/social-providers';
+
+export const MICROSOFT_ENTRA_PROVIDER_ID = 'microsoft-entra-id';
+
+// Providers registered with the legacy generic-OAuth callback URL whose
+// profiles may carry placeholder or unverified emails.
+const PROVIDER_IDS = new Set([
+  'slack',
+  MICROSOFT_ENTRA_PROVIDER_ID,
+  'gitlab',
+  'gitea',
+  'bitbucket',
+  'ado',
+]);
+
+type ProviderTokens = Parameters<OAuthProvider['getUserInfo']>[0];
+type ProviderUserInfo = NonNullable<
+  Awaited<ReturnType<OAuthProvider['getUserInfo']>>
+>;
+
+// The built-in Microsoft helper decodes the ID token without verifying it.
+// Verify it first (signature, issuer, audience, expiry, tenant, nonce), then
+// bind the old helper's OIDC userinfo profile (name, preferred_username and
+// optional email_verified) to the verified subject.
+async function verifyMicrosoftProfile(
+  provider: OAuthProvider,
+  tokens: ProviderTokens,
+): Promise<ProviderUserInfo | null> {
+  if (
+    !tokens.idToken ||
+    !(await verifyProviderIdToken(
+      provider,
+      tokens.idToken,
+      tokens.expectedIdTokenNonce,
+    ))
+  )
+    return null;
+  const info = await provider.getUserInfo(tokens);
+  if (!info) return null;
+  const response = await fetch('https://graph.microsoft.com/oidc/userinfo', {
+    headers: { Authorization: `Bearer ${tokens.accessToken}` },
+  });
+  if (!response.ok) return null;
+  const profile = (await response.json()) as {
+    sub?: string;
+    name?: string;
+    given_name?: string;
+    family_name?: string;
+    email?: string;
+    preferred_username?: string;
+    picture?: string;
+    email_verified?: boolean;
+  };
+  if (!('sub' in info.data) || profile.sub !== info.data.sub) return null;
+  return {
+    data: info.data,
+    user: {
+      name:
+        profile.name ??
+        (`${profile.given_name ?? ''} ${profile.family_name ?? ''}`.trim() ||
+          undefined),
+      email: profile.email ?? profile.preferred_username,
+      image: profile.picture,
+      emailVerified: profile.email_verified ?? false,
+    },
+  };
+}
+
+// Explicit linking is the only flow allowed to accept these providers'
+// unverified or placeholder emails. Core's link flow only checks
+// userInfo.emailVerified and never persists it, so marking the profile
+// verified for a server-stamped explicit link lets that link proceed while
+// sign-in keeps core's default policy: an unverified email can neither
+// create a user implicitly linked by email nor attach itself to an existing
+// user, and returning users still sign in by their linked identity.
+async function applyExplicitLinkTrust(
+  providerId: string,
+  info: ProviderUserInfo,
+): Promise<ProviderUserInfo> {
+  const state = await getOAuthState();
+  const marker = state?.serverContext?.roomoteExplicitLink;
+  const explicitLink =
+    !!state?.link &&
+    !!marker &&
+    typeof marker === 'object' &&
+    'providerId' in marker &&
+    marker.providerId === providerId &&
+    'userId' in marker &&
+    marker.userId === state.link.userId;
+  return explicitLink
+    ? { ...info, user: { ...info.user, emailVerified: true } }
+    : info;
+}
+
+export function oauthCompatibilityPlugin(options?: {
+  clientId: string;
+  clientSecret: string;
+  tenantId: string;
+}): BetterAuthPlugin {
+  return {
+    id: 'roomote-oauth-compatibility',
+    init(ctx) {
+      const providers: OAuthProvider[] = [...ctx.socialProviders];
+      if (options) {
+        const provider = microsoft({
+          ...options,
+          disableDefaultScope: true,
+          // offline_access stores an Entra refresh token so delegated
+          // Microsoft Graph tokens (Teams history reads) can be minted later.
+          scope: ['openid', 'profile', 'email', 'offline_access'],
+          disableProfilePhoto: true,
+        });
+        providers.push({
+          ...provider,
+          id: MICROSOFT_ENTRA_PROVIDER_ID,
+          requiresIdTokenNonce: true,
+          // Existing accounts use the app-scoped OIDC subject, not Graph oid.
+          // Keep all upstream signature, issuer, audience and tenant checks.
+          accountSubject: ({ profile }) =>
+            'sub' in profile && typeof profile.sub === 'string'
+              ? profile.sub
+              : '',
+        });
+      }
+      return {
+        context: {
+          socialProviders: providers.map((provider) => ({
+            ...provider,
+            // Keep provider-registered URLs stable, including on dynamically
+            // resolved preview hosts. Core composes the redirect URI for both
+            // authorization and token exchange as baseURL + callbackPath.
+            callbackPath: `/oauth2/callback/${provider.id}`,
+            createAuthorizationURL: async (data) => {
+              const url = await provider.createAuthorizationURL({
+                ...data,
+                // The Slack helper uses the authenticated userinfo endpoint,
+                // and needs a fresh authorization nonce for every request.
+                ...(provider.id === 'slack'
+                  ? { idTokenNonce: data.idTokenNonce ?? crypto.randomUUID() }
+                  : {}),
+              });
+              // The built-in Microsoft helper does not yet forward the core
+              // nonce argument; bind its verified ID token to this flow too.
+              if (
+                provider.id === MICROSOFT_ENTRA_PROVIDER_ID &&
+                data.idTokenNonce
+              ) {
+                url.searchParams.set('nonce', data.idTokenNonce);
+              }
+              return url;
+            },
+            getUserInfo: async (tokens) => {
+              const info =
+                provider.id === MICROSOFT_ENTRA_PROVIDER_ID
+                  ? await verifyMicrosoftProfile(provider, tokens)
+                  : await provider.getUserInfo(tokens);
+              if (!info || !PROVIDER_IDS.has(provider.id)) return info;
+              return applyExplicitLinkTrust(provider.id, info);
+            },
+          })),
+        },
+      };
+    },
+    hooks: {
+      before: [
+        {
+          matcher: (ctx) =>
+            ctx.path === '/link-social' && PROVIDER_IDS.has(ctx.body?.provider),
+          handler: createAuthMiddleware(async (ctx) => {
+            const session = await getSessionFromCtx(ctx);
+            if (session)
+              await addOAuthServerContext({
+                roomoteExplicitLink: {
+                  providerId: ctx.body.provider,
+                  userId: session.user.id,
+                },
+              });
+          }),
+        },
+      ],
+    },
+  };
+}
+
+// Rewrites the registered legacy callback URL onto core's /callback/:id route
+// before dispatch, so state and nonce validation still run in core. Core
+// answers a form POST callback with a 302 to its own /api/auth/callback/:id,
+// so that path is browser-visible and must stay reachable as well.
+export function normalizeLegacyOAuthCallback(request: Request): Request {
+  const url = new URL(request.url);
+  const match = /^\/api\/auth\/oauth2\/callback\/([^/]+)$/.exec(url.pathname);
+  if (!match || !PROVIDER_IDS.has(match[1]!)) return request;
+  url.pathname = `/api/auth/callback/${match[1]}`;
+  return new Request(url, request);
+}
diff --git a/apps/web/src/lib/server/auth-oauth.integration.test.ts b/apps/web/src/lib/server/auth-oauth.integration.test.ts
new file mode 100644
index 0000000000..6fea28b479
--- /dev/null
+++ b/apps/web/src/lib/server/auth-oauth.integration.test.ts
@@ -0,0 +1,483 @@
+import { generateKeyPairSync, sign } from 'node:crypto';
+import { authAccounts, authUsers, db, eq } from '@roomote/db/server';
+
+vi.mock('./bootstrap-runtime-env', () => ({ bootstrapWebRuntimeEnv: vi.fn() }));
+vi.mock('./auth-provider-config', () => ({
+  resolveAuthProviderConfig: vi.fn(),
+}));
+vi.mock('./better-auth-base-url', () => ({
+  getBetterAuthBaseUrlConfig: () => ({
+    allowedHosts: ['auth.example.test', 'preview.example.test'],
+    protocol: 'https',
+  }),
+}));
+vi.mock('./env', () => ({
+  Env: { R_APP_URL: 'https://auth.example.test' },
+  getBetterAuthSecret: () => 'oauth-integration-test-secret-long-enough',
+  isEmailChannelEnabled: () => false,
+}));
+vi.mock('./access-policy', () => ({
+  isNewAuthUserEmailAllowed: async () => true,
+  isSignInAllowedByAccessPolicy: async () => true,
+}));
+vi.mock('./license', () => ({ hasSeatAvailable: async () => true }));
+
+import { resolveAuthProviderConfig } from './auth-provider-config';
+import { handleAuthRequest } from './auth';
+
+const TENANT = '12345678-1234-1234-1234-123456789abc';
+const CONSUMER = '9188040d-6c67-4c5b-b112-36a304b66dad';
+const { privateKey, publicKey } = generateKeyPairSync('rsa', {
+  modulusLength: 2048,
+});
+const jwk = {
+  ...publicKey.export({ format: 'jwk' }),
+  kid: 'fixture',
+  alg: 'RS256',
+  use: 'sig',
+};
+let subject: string;
+let tenantClaim: string;
+let exchanges: URLSearchParams[];
+let userIds: string[];
+let extraClaims: Record<string, unknown>;
+let tokenNonce: string | null;
+let slackEmailVerified: boolean;
+
+function jwt() {
+  const encode = (value: object) =>
+    Buffer.from(JSON.stringify(value)).toString('base64url');
+  const input = `${encode({ alg: 'RS256', kid: 'fixture' })}.${encode({
+    sub: subject,
+    oid: `different-oid-${subject}`,
+    tid: tenantClaim,
+    iss: `https://login.microsoftonline.com/${tenantClaim}/v2.0`,
+    aud: 'fixture-client',
+    iat: Math.floor(Date.now() / 1000),
+    exp: Math.floor(Date.now() / 1000) + 3600,
+    email: `${subject}@example.test`,
+    nonce: tokenNonce,
+    name: 'OAuth Fixture',
+    email_verified: true,
+    ...extraClaims,
+  })}`;
+  return `${input}.${sign('RSA-SHA256', Buffer.from(input), privateKey).toString('base64url')}`;
+}
+
+function cookies(response: Response) {
+  return response.headers
+    .getSetCookie()
+    .map((value) => value.split(';')[0])
+    .join('; ');
+}
+
+async function request(
+  path: string,
+  body?: object,
+  cookie = '',
+  host = 'auth.example.test',
+) {
+  return handleAuthRequest(
+    new Request(`https://${host}/api/auth/${path}`, {
+      method: body ? 'POST' : 'GET',
+      headers: {
+        origin: `https://${host}`,
+        cookie,
+        ...(body ? { 'content-type': 'application/json' } : {}),
+      },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+    }),
+  );
+}
+
+async function start(
+  provider: string,
+  cookie = '',
+  host = 'auth.example.test',
+) {
+  const response = await request(
+    cookie ? 'link-social' : 'sign-in/social',
+    {
+      provider,
+      callbackURL: '/settings/personal',
+      disableRedirect: true,
+    },
+    cookie,
+    host,
+  );
+  expect(response.status).toBe(200);
+  const url = new URL((await response.json()).url);
+  expect(url.searchParams.get('redirect_uri')).toBe(
+    `https://${host}/api/auth/oauth2/callback/${provider}`,
+  );
+  return { response, url };
+}
+
+async function finish(
+  provider: string,
+  started: Awaited<ReturnType<typeof start>>,
+  post = false,
+) {
+  tokenNonce = started.url.searchParams.get('nonce');
+  const callback = new URL(started.url.searchParams.get('redirect_uri')!);
+  const params = new URLSearchParams({
+    code: 'normal-fixture-code',
+    state: started.url.searchParams.get('state')!,
+  });
+  if (!post) callback.search = params.toString();
+  return handleAuthRequest(
+    new Request(callback, {
+      method: post ? 'POST' : 'GET',
+      headers: {
+        cookie: cookies(started.response),
+        ...(post
+          ? { 'content-type': 'application/x-www-form-urlencoded' }
+          : {}),
+      },
+      ...(post ? { body: params.toString() } : {}),
+    }),
+  );
+}
+
+beforeEach(() => {
+  subject = crypto.randomUUID();
+  tenantClaim = TENANT;
+  exchanges = [];
+  userIds = [];
+  extraClaims = {};
+  slackEmailVerified = true;
+  vi.mocked(resolveAuthProviderConfig).mockResolvedValue({
+    signature: crypto.randomUUID(),
+    slackClientId: 'fixture-client',
+    slackClientSecret: 'fixture-secret',
+    microsoftClientId: 'fixture-client',
+    microsoftClientSecret: 'fixture-secret',
+    microsoftTenantId: TENANT,
+    gitlabClientId: 'fixture-client',
+    gitlabClientSecret: 'fixture-secret',
+    gitlabBaseUrl: 'https://gitlab.example.test',
+    giteaClientId: 'fixture-client',
+    giteaClientSecret: 'fixture-secret',
+    giteaBaseUrl: 'https://gitea.example.test',
+    bitbucketClientId: 'fixture-client',
+    bitbucketClientSecret: 'fixture-secret',
+    bitbucketBaseUrl: 'https://bitbucket.org',
+    adoClientId: 'fixture-client',
+    adoClientSecret: 'fixture-secret',
+    adoOrganization: 'fixture',
+    adoTenantId: 'common',
+  } as Awaited<ReturnType<typeof resolveAuthProviderConfig>>);
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async (input: string | URL | Request, init?: RequestInit) => {
+      const url = new URL(
+        input instanceof Request ? input.url : input.toString(),
+      );
+      if (url.pathname.endsWith('/keys')) return Response.json({ keys: [jwk] });
+      if (
+        url.pathname.endsWith('/token') ||
+        url.pathname.endsWith('/access_token') ||
+        url.pathname.endsWith('openid.connect.token')
+      ) {
+        exchanges.push(new URLSearchParams(String(init?.body)));
+        return Response.json({
+          access_token: 'fixture-access',
+          token_type: 'Bearer',
+          expires_in: 3600,
+          ...(url.hostname === 'login.microsoftonline.com'
+            ? { id_token: jwt() }
+            : {}),
+        });
+      }
+      if (url.pathname.endsWith('openid.connect.userInfo')) {
+        return Response.json({
+          sub: subject,
+          email: `${subject}@example.test`,
+          name: 'Slack Fixture',
+          email_verified: slackEmailVerified,
+        });
+      }
+      if (
+        url.hostname === 'graph.microsoft.com' &&
+        url.pathname === '/oidc/userinfo'
+      ) {
+        return Response.json({
+          sub: subject,
+          preferred_username: `${subject}@example.test`,
+          given_name: 'Microsoft',
+          family_name: 'Fixture',
+        });
+      }
+      if (url.pathname === '/api/v4/user') {
+        return Response.json({
+          id: subject,
+          username: 'fixture',
+          email: `${subject}@example.test`,
+          name: 'GitLab Fixture',
+        });
+      }
+      if (url.pathname === '/api/v1/user')
+        return Response.json({
+          id: subject,
+          login: 'fixture',
+          email: `${subject}@example.test`,
+        });
+      if (url.pathname === '/2.0/user')
+        return Response.json({ account_id: subject, display_name: 'Fixture' });
+      if (url.pathname === '/_apis/connectionData')
+        return Response.json({
+          authenticatedUser: {
+            id: subject,
+            uniqueName: `${subject}@example.test`,
+            displayName: 'Fixture',
+          },
+        });
+      if (url.pathname === '/_apis/profile/profiles/me')
+        return Response.json({
+          id: subject,
+          emailAddress: `${subject}@example.test`,
+        });
+      throw new Error(
+        `Unexpected provider request: ${url.origin}${url.pathname}`,
+      );
+    }),
+  );
+});
+
+afterEach(async () => {
+  for (const id of userIds)
+    await db.delete(authUsers).where(eq(authUsers.id, id));
+  vi.unstubAllGlobals();
+});
+
+async function existingUser(providerId: string) {
+  const id = crypto.randomUUID();
+  userIds.push(id);
+  await db.insert(authUsers).values({
+    id,
+    name: 'Returning Fixture',
+    email: `${subject}@example.test`,
+    emailVerified: true,
+  });
+  const accountId = crypto.randomUUID();
+  await db
+    .insert(authAccounts)
+    .values({ id: accountId, userId: id, providerId, accountId: subject });
+  return { id, accountId };
+}
+
+it.each(['slack', 'microsoft-entra-id', 'gitlab', 'gitea', 'bitbucket', 'ado'])(
+  'initiates %s through real core sign-in and preserves registered preview callbacks',
+  async (provider) => {
+    await start(provider, '', 'preview.example.test');
+  },
+);
+
+it('creates a fresh Slack nonce for each authorization request and retains scopes', async () => {
+  const a = await start('slack');
+  const b = await start('slack');
+  expect(a.url.searchParams.get('nonce')).toBeTruthy();
+  expect(b.url.searchParams.get('nonce')).not.toBe(
+    a.url.searchParams.get('nonce'),
+  );
+  expect(a.url.searchParams.get('scope')?.split(' ')).toEqual(
+    expect.arrayContaining(['openid', 'profile', 'email']),
+  );
+});
+
+it.each([false, true])(
+  'completes Slack returning-user callback (POST=%s) without duplicating identity',
+  async (post) => {
+    const user = await existingUser('slack');
+    const started = await start('slack');
+    const response = await finish('slack', started, post);
+    // Core turns form_post into a same-origin GET before completing the flow.
+    const completed =
+      post && response.headers.get('location')?.includes('/callback/')
+        ? await handleAuthRequest(
+            new Request(
+              new URL(
+                response.headers.get('location')!,
+                'https://auth.example.test',
+              ),
+              { headers: { cookie: cookies(started.response) } },
+            ),
+          )
+        : response;
+    expect(completed.status).toBe(302);
+    expect(completed.headers.get('location')).toBe('/settings/personal');
+    const session = await request('get-session', undefined, cookies(completed));
+    expect((await session.json()).user.id).toBe(user.id);
+    expect(
+      (
+        await db.query.authAccounts.findMany({
+          where: eq(authAccounts.userId, user.id),
+        })
+      ).map((a) => a.id),
+    ).toEqual([user.accountId]);
+    expect(exchanges[0]?.get('redirect_uri')).toBe(
+      started.url.searchParams.get('redirect_uri'),
+    );
+  },
+);
+
+it.each([TENANT, 'common', 'organizations', 'consumers'])(
+  'retains Microsoft sub identity and validated sign-in for tenant %s',
+  async (tenant) => {
+    const config = await resolveAuthProviderConfig();
+    vi.mocked(resolveAuthProviderConfig).mockResolvedValue({
+      ...config,
+      signature: crypto.randomUUID(),
+      microsoftTenantId: tenant,
+    });
+    if (tenant === 'consumers') tenantClaim = CONSUMER;
+    const user = await existingUser('microsoft-entra-id');
+    const started = await start('microsoft-entra-id');
+    const response = await finish('microsoft-entra-id', started);
+    expect(response.headers.get('location')).toBe('/settings/personal');
+    const session = await request('get-session', undefined, cookies(response));
+    expect((await session.json()).user.id).toBe(user.id);
+    const accounts = await db.query.authAccounts.findMany({
+      where: eq(authAccounts.userId, user.id),
+    });
+    expect(accounts).toHaveLength(1);
+    expect(accounts[0]).toMatchObject({
+      id: user.accountId,
+      accountId: subject,
+      providerId: 'microsoft-entra-id',
+    });
+    expect(exchanges[0]?.get('redirect_uri')).toBe(
+      started.url.searchParams.get('redirect_uri'),
+    );
+  },
+);
+
+it.each(['slack', 'microsoft-entra-id', 'gitlab', 'gitea', 'bitbucket', 'ado'])(
+  'links %s to an existing real session',
+  async (provider) => {
+    const signup = await request('sign-up/email', {
+      email: `${subject}@example.test`,
+      name: 'Link Fixture',
+      password: 'fixture-password-123!',
+    });
+    expect(signup.status).toBe(200);
+    const id = (await signup.json()).user.id as string;
+    userIds.push(id);
+    const started = await start(provider, cookies(signup));
+    const response = await finish(provider, started);
+    expect(response.headers.get('location')).toBe('/settings/personal');
+    expect(
+      await db.query.authAccounts.findFirst({
+        where: eq(
+          authAccounts.accountId,
+          provider === 'ado' ? `${subject}@example.test` : subject,
+        ),
+      }),
+    ).toMatchObject({ userId: id, providerId: provider });
+  },
+);
+
+it('retains returning generic OAuth sign-in by existing provider identity', async () => {
+  const user = await existingUser('gitlab');
+  const response = await finish('gitlab', await start('gitlab'));
+  expect(response.headers.get('location')).toBe('/settings/personal');
+  expect(
+    (await (await request('get-session', undefined, cookies(response))).json())
+      .user.id,
+  ).toBe(user.id);
+});
+
+it.each(['slack', 'gitlab', 'microsoft-entra-id'])(
+  'keeps unverified %s profiles out of implicit email linking',
+  async (provider) => {
+    slackEmailVerified = false;
+    const signup = await request('sign-up/email', {
+      email: `${subject}@example.test`,
+      name: 'Existing Fixture',
+      password: 'fixture-password-123!',
+    });
+    const userId = (await signup.json()).user.id as string;
+    userIds.push(userId);
+    const response = await finish(provider, await start(provider));
+    expect(response.headers.get('location')).toContain('error=');
+    expect(
+      await db.query.authAccounts.findFirst({
+        where: eq(authAccounts.accountId, subject),
+      }),
+    ).toBeUndefined();
+  },
+);
+
+it('preserves new Microsoft sign-up with userinfo preferred_username and no email verification claim', async () => {
+  const response = await finish(
+    'microsoft-entra-id',
+    await start('microsoft-entra-id'),
+  );
+  expect(response.headers.get('location')).toBe('/settings/personal');
+  const session = await (
+    await request('get-session', undefined, cookies(response))
+  ).json();
+  userIds.push(session.user.id);
+  expect(session.user).toMatchObject({
+    email: `${subject}@example.test`,
+    name: 'Microsoft Fixture',
+    emailVerified: false,
+  });
+});
+
+it.each([
+  { aud: 'different-client' },
+  { iss: 'https://other-issuer.example.test' },
+  { exp: 1 },
+  { nonce: 'different-flow' },
+])(
+  'retains upstream Microsoft ID token validation for invalid fixture claims %j',
+  async (claims) => {
+    extraClaims = claims;
+    await existingUser('microsoft-entra-id');
+    const response = await finish(
+      'microsoft-entra-id',
+      await start('microsoft-entra-id'),
+    );
+    expect(response.headers.get('location')).toContain('error=');
+    expect(
+      await (await request('get-session', undefined, cookies(response))).json(),
+    ).toBeNull();
+  },
+);
+
+it('completes a legacy Microsoft form POST callback', async () => {
+  const user = await existingUser('microsoft-entra-id');
+  const started = await start('microsoft-entra-id');
+  const response = await finish('microsoft-entra-id', started, true);
+  const completed = await handleAuthRequest(
+    new Request(
+      new URL(response.headers.get('location')!, 'https://auth.example.test'),
+      { headers: { cookie: cookies(started.response) } },
+    ),
+  );
+  expect(completed.headers.get('location')).toBe('/settings/personal');
+  expect(
+    (await (await request('get-session', undefined, cookies(completed))).json())
+      .user.id,
+  ).toBe(user.id);
+});
+
+it.each(['organizations', 'consumers'])(
+  'retains Microsoft account-class restrictions for %s',
+  async (tenant) => {
+    const config = await resolveAuthProviderConfig();
+    vi.mocked(resolveAuthProviderConfig).mockResolvedValue({
+      ...config,
+      signature: crypto.randomUUID(),
+      microsoftTenantId: tenant,
+    });
+    tenantClaim = tenant === 'organizations' ? CONSUMER : TENANT;
+    await existingUser('microsoft-entra-id');
+    const response = await finish(
+      'microsoft-entra-id',
+      await start('microsoft-entra-id'),
+    );
+    expect(response.headers.get('location')).toContain('error=');
+  },
+);
diff --git a/apps/web/src/lib/server/auth.ts b/apps/web/src/lib/server/auth.ts
index 9a494fa62a..6aecf9552d 100644
--- a/apps/web/src/lib/server/auth.ts
+++ b/apps/web/src/lib/server/auth.ts
@@ -3,7 +3,7 @@ import { AsyncLocalStorage } from 'node:async_hooks';
 import { betterAuth } from 'better-auth';
 import { APIError } from 'better-auth/api';
 import { nextCookies } from 'better-auth/next-js';
-import { genericOAuth, microsoftEntraId, slack } from 'better-auth/plugins';
+import { genericOAuth, slack } from 'better-auth/plugins';
 import { drizzleAdapter } from '@better-auth/drizzle-adapter';
 import { normalizeAdoLinkedAccountKey } from '@roomote/ado';
 // Subpath import on purpose: the SDK barrel drags the whole server graph
@@ -30,6 +30,11 @@ import { Env, getBetterAuthSecret, isEmailChannelEnabled } from './env';
 import { getBetterAuthBaseUrlConfig } from './better-auth-base-url';
 import { withCanonicalForwardedProto } from './canonical-forwarded-proto';
 import { bootstrapWebRuntimeEnv } from './bootstrap-runtime-env';
+import {
+  MICROSOFT_ENTRA_PROVIDER_ID,
+  normalizeLegacyOAuthCallback,
+  oauthCompatibilityPlugin,
+} from './auth-oauth-compatibility';
 import {
   isNewAuthUserEmailAllowed,
   isSignInAllowedByAccessPolicy,
@@ -202,7 +207,6 @@ type AdoProfile = {
   id?: unknown;
 };
 
-const MICROSOFT_ENTRA_PROVIDER_ID = 'microsoft-entra-id';
 const SLACK_OPENID_SCOPES = ['openid', 'profile', 'email'];
 const DEFAULT_GITLAB_BASE_URL = 'https://gitlab.com';
 const DEFAULT_ADO_BASE_URL = 'https://dev.azure.com';
@@ -779,25 +783,9 @@ async function createAuth(authProviderConfig: ResolvedAuthProviderConfig) {
               clientSecret: slackClientSecret,
               scopes: SLACK_OPENID_SCOPES,
             }),
-            authorizationUrlParams: () => ({
-              nonce: crypto.randomUUID(),
-            }),
           },
         ]
       : []),
-    ...(hasMicrosoftAuth
-      ? [
-          microsoftEntraId({
-            clientId: microsoftClientId,
-            clientSecret: microsoftClientSecret,
-            tenantId: microsoftTenantId,
-            // offline_access stores an Entra refresh token so delegated
-            // Microsoft Graph tokens (Teams history reads) can be minted for
-            // the linked user later.
-            scopes: ['openid', 'profile', 'email', 'offline_access'],
-          }),
-        ]
-      : []),
     ...(gitlabClientId && gitlabClientSecret
       ? [
           {
@@ -1260,6 +1248,15 @@ async function createAuth(authProviderConfig: ResolvedAuthProviderConfig) {
       ...(genericOAuthConfigs.length > 0
         ? [genericOAuth({ config: genericOAuthConfigs })]
         : []),
+      oauthCompatibilityPlugin(
+        hasMicrosoftAuth
+          ? {
+              clientId: microsoftClientId,
+              clientSecret: microsoftClientSecret,
+              tenantId: microsoftTenantId,
+            }
+          : undefined,
+      ),
       nextCookies(),
     ],
   });
@@ -1287,6 +1284,6 @@ export async function handleAuthRequest(request: Request) {
   // otherwise have no access to the request.
   return runWithInviteContext(
     extractInviteTokenFromRequest(normalizedRequest),
-    () => auth.handler(normalizedRequest),
+    () => auth.handler(normalizeLegacyOAuthCallback(normalizedRequest)),
   );
 }
diff --git a/package.json b/package.json
index ec470dc342..0f7783addc 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "roomote",
-  "version": "1.19.5",
+  "version": "1.19.6",
   "license": "FCL-1.0-ALv2",
   "packageManager": "pnpm@10.29.3",
   "engines": {
@@ -109,8 +109,8 @@
       "glob": ">=13.0.3",
       "follow-redirects": "1.16.1",
       "ioredis": "5.10.1",
-      "better-auth>zod": "^4.3.6",
-      "@better-auth/core>zod": "^4.3.6",
+      "better-auth>zod": "^4.5.0",
+      "@better-auth/core>zod": "^4.5.0",
       "js-cookie": "3.0.7",
       "js-yaml": "4.3.2",
       "gray-matter>js-yaml": "3.15.2",
diff --git a/packages/github/src/__tests__/task-run-token.test.ts b/packages/github/src/__tests__/task-run-token.test.ts
index 84088be187..c95edd282e 100644
--- a/packages/github/src/__tests__/task-run-token.test.ts
+++ b/packages/github/src/__tests__/task-run-token.test.ts
@@ -4,7 +4,9 @@ const {
   mockFindFirst,
   mockFindEnvironmentFirst,
   mockFindMappings,
+  mockFindInstallation,
 } = vi.hoisted(() => ({
+  mockFindInstallation: vi.fn(),
   mockCreateGitHubTokenWithMetadata: vi.fn(),
   mockFindMany: vi.fn(),
   mockFindFirst: vi.fn(),
@@ -28,10 +30,16 @@ vi.mock('@roomote/db/server', () => ({
         findFirst: mockFindEnvironmentFirst,
       },
       environmentRepositoryMappings: { findMany: mockFindMappings },
+      githubInstallations: { findFirst: mockFindInstallation },
     },
   },
+  asc: vi.fn((value: unknown) => ({ type: 'asc', value })),
   eq: vi.fn((left: unknown, right: unknown) => ({ type: 'eq', left, right })),
-  githubInstallations: {},
+  githubInstallations: {
+    id: 'githubInstallations.id',
+    createdAt: 'githubInstallations.createdAt',
+    suspendedAt: 'githubInstallations.suspendedAt',
+  },
   githubPendingInstallations: {},
   environments: {
     id: 'environments.id',
@@ -494,6 +502,47 @@ describe('createTaskRunGitHubToken', () => {
     consoleWarnSpy.mockRestore();
   });
 
+  it('anchors an all-repository stamp without an environment on the oldest installation', async () => {
+    const consoleWarnSpy = vi
+      .spyOn(console, 'warn')
+      .mockImplementation(() => undefined);
+    mockFindMany.mockResolvedValue([
+      {
+        fullName: 'owner-a/api',
+        installationId: 'install-a',
+        githubRepoId: 401,
+      },
+      {
+        fullName: 'owner-b/web',
+        installationId: 'install-b',
+        githubRepoId: 402,
+      },
+    ]);
+    mockFindInstallation.mockResolvedValue({ id: 'install-a' });
+
+    await expect(
+      createTaskRunGitHubToken(
+        buildTaskRun({
+          repo: '__all_repositories__',
+          repositoryProviders: {
+            'owner-a/api': 'github',
+            'owner-b/web': 'github',
+          },
+        } as TaskRun['payload']),
+      ),
+    ).resolves.toBe('ghs_test_token');
+    expect(mockCreateGitHubTokenWithMetadata).toHaveBeenCalledWith(
+      {
+        type: 'installationId',
+        installationId: 'install-a',
+        repositoryIds: [401],
+      },
+      undefined,
+      undefined,
+    );
+    consoleWarnSpy.mockRestore();
+  });
+
   it('keeps failing a spanning stamp without an environment when the task repository is not stamped', async () => {
     mockFindMany.mockResolvedValue([
       {
diff --git a/packages/github/src/api.ts b/packages/github/src/api.ts
index 6bcab426a9..798c6b1256 100644
--- a/packages/github/src/api.ts
+++ b/packages/github/src/api.ts
@@ -29,6 +29,7 @@ import {
   environmentRepositoryMappings,
   repositories,
   and,
+  asc,
   eq,
   isNull,
   inArray,
@@ -288,16 +289,36 @@ export async function resolveTaskRunEnvironmentGitHubRepositories(
  * (`payload.repo`). Returns null when that repository is not an active GitHub
  * repository, so callers keep failing closed.
  */
+async function resolveOldestInstallationId(
+  rows: Repository[],
+): Promise<string | null> {
+  const installationIds = [
+    ...new Set(
+      rows
+        .map((row) => row.installationId)
+        .filter((id): id is string => Boolean(id)),
+    ),
+  ];
+  if (installationIds.length === 0) return null;
+  const oldest = await db.query.githubInstallations.findFirst({
+    where: and(
+      inArray(githubInstallations.id, installationIds),
+      isNull(githubInstallations.suspendedAt),
+    ),
+    orderBy: [asc(githubInstallations.createdAt)],
+    columns: { id: true },
+  });
+  return oldest?.id ?? null;
+}
+
 async function resolvePrimaryRepositoryInstallationScope(
   taskRun: TaskRun,
   stampedRepositories: string[],
 ): Promise<CreateGitHubTokenOptions | null> {
   const primaryRepository = taskRun.payload.repo;
-  if (
-    !primaryRepository ||
-    primaryRepository === ALL_REPOSITORIES ||
-    !stampedRepositories.includes(primaryRepository)
-  ) {
+  const allRepositories =
+    !primaryRepository || primaryRepository === ALL_REPOSITORIES;
+  if (!allRepositories && !stampedRepositories.includes(primaryRepository)) {
     return null;
   }
 
@@ -308,9 +329,13 @@ async function resolvePrimaryRepositoryInstallationScope(
       inArray(repositories.fullName, stampedRepositories),
     ),
   });
-  const primaryInstallationId = stampedRows.find(
-    (row) => row.fullName === primaryRepository,
-  )?.installationId;
+  // All-repository runs have no repository of their own: anchor on the
+  // deployment's oldest active installation, the same one unconnected reads
+  // use. Repositories on other installations get their own git credentials.
+  const primaryInstallationId = allRepositories
+    ? await resolveOldestInstallationId(stampedRows)
+    : stampedRows.find((row) => row.fullName === primaryRepository)
+        ?.installationId;
   if (!primaryInstallationId) {
     return null;
   }
@@ -325,7 +350,7 @@ async function resolvePrimaryRepositoryInstallationScope(
     (repository) => !includedRepositories.has(repository),
   );
   console.warn(
-    `[resolveTaskRunGitHubTokenOptions] Stamped GitHub repositories for task run ${taskRun.id} span multiple installations; minting the ${primaryRepository} installation only. Not reachable with this token: ${excludedRepositories.join(', ')}`,
+    `[resolveTaskRunGitHubTokenOptions] Stamped GitHub repositories for task run ${taskRun.id} span multiple installations; minting the ${allRepositories ? 'oldest' : primaryRepository} installation only (other installations get git credentials). Not reachable with this token: ${excludedRepositories.join(', ')}`,
   );
 
   return resolveTokenOptionsForRepositoryNames({
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 1231b98298..b1bea814c7 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -25,8 +25,8 @@ overrides:
   glob: '>=13.0.3'
   follow-redirects: 1.16.1
   ioredis: 5.10.1
-  better-auth>zod: ^4.3.6
-  '@better-auth/core>zod': ^4.3.6
+  better-auth>zod: ^4.5.0
+  '@better-auth/core>zod': ^4.5.0
   js-cookie: 3.0.7
   js-yaml: 4.3.2
   gray-matter>js-yaml: 3.15.2
@@ -274,7 +274,7 @@ importers:
         version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.4)(typescript@5.9.3)(yaml@2.9.0)
       vitest:
         specifier: 4.1.12
-        version: 4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))
+        version: 4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.0)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))
 
   apps/bullmq:
     dependencies:
@@ -359,7 +359,7 @@ importers:
         version: 8.5.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.4)(typescript@5.9.3)(yaml@2.9.0)
       vitest:
         specifier: 4.1.12
-        version: 4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.0)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))
+        version: 4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))
 
   apps/controller:
     dependencies:
@@ -554,8 +554,8 @@ importers:
         specifier: 3.1000.0
         version: 3.1000.0
       '@better-auth/drizzle-adapter':
-        specifier: ^1.6.22
-        version: 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))
+        specifier: ^1.7.12
+        version: 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))
       '@codemirror/lang-yaml':
         specifier: ^6.0.0
         version: 6.1.3
@@ -746,8 +746,8 @@ importers:
         specifier: ^6.2.6
         version: 6.2.6(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
       better-auth:
-        specifier: ^1.6.22
-        version: 1.6.22(@opentelemetry/api@1.9.1)(better-sqlite3@11.10.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))(next@16.4.1(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(pg@8.15.6)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(vitest@4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0)))
+        specifier: ^1.7.12
+        version: 1.7.12(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.9)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))(next@16.4.1(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(pg@8.15.6)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(vitest@4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0)))
       better-sse:
         specifier: ^0.16.1
         version: 0.16.1
@@ -2221,64 +2221,61 @@ packages:
   '@balena/dockerignore@1.0.2':
     resolution: {integrity: sha512-wMue2Sy4GAVTk6Ic4tJVcnfdau+gx2EnG7S+uAEe+TWJFqE4YoWN4/H8MSLj4eYJKxGg26lZwboEniNiNwZQ6Q==}
 
-  '@better-auth/core@1.6.22':
-    resolution: {integrity: sha512-aFH/5nzmR501jAJPKjJfiVg4BrkcjVCqq9WS9JnhTruE/2PIWopv1QGMiRIRqxXaPbHczri7cqRdhep3Lg5PMw==}
+  '@better-auth/core@1.7.12':
+    resolution: {integrity: sha512-SUStBGHJ13KnSO6+7U/1DSlfuOtln4jtOrFZqzQtxZVHZIrAoMjwHNGitlF+s7hvKbuC3Z14xjnqfLLqIqGfxw==}
     peerDependencies:
-      '@better-auth/utils': 0.4.2
-      '@better-fetch/fetch': 1.3.1
-      '@cloudflare/workers-types': '>=4'
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
+      '@better-fetch/fetch': 1.3.2
       '@opentelemetry/api': ^1.9.0
-      better-call: 1.3.7
+      better-call: 1.4.4
       jose: ^6.1.0
       kysely: ^0.28.5 || ^0.29.0
       nanostores: ^1.0.1
     peerDependenciesMeta:
-      '@cloudflare/workers-types':
-        optional: true
       '@opentelemetry/api':
         optional: true
 
-  '@better-auth/drizzle-adapter@1.6.22':
-    resolution: {integrity: sha512-uNa9qH53CfxBmuKP8kbLWxY90oIRwUPn5BcHhO+szK05e2yh6EYwSNNivDSqV3YG5HPfjtPHulklInjq1wtm3w==}
+  '@better-auth/drizzle-adapter@1.7.12':
+    resolution: {integrity: sha512-Qzoyuf05aK01Pc0k3EXv8Xj3XCT2m2dCWc5HoB7x+xX6N3Pm2eQsca+UIArsJcbuNEWWP3L51oIebnBoHJ5DTw==}
     peerDependencies:
-      '@better-auth/core': ^1.6.22
-      '@better-auth/utils': 0.4.2
-      drizzle-orm: ^0.45.2
+      '@better-auth/core': ^1.7.12
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
+      drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0
     peerDependenciesMeta:
       drizzle-orm:
         optional: true
 
-  '@better-auth/kysely-adapter@1.6.22':
-    resolution: {integrity: sha512-4k/07lPRizlQi+B+uOE5CwTfH3w+Lq8ZDX1nDN1+e+glRVKAIfHoLvC9cfAVcCbio3DDrl0RTbwjLwjEhG0LxA==}
+  '@better-auth/kysely-adapter@1.7.12':
+    resolution: {integrity: sha512-1PaFXktLv4n3DmrGbPaCj5SsvcT40NnWw7NLua5/J1+8/A051N5ZzqOwJifXEIQX5k6NdwvmymwDQxKytduEAQ==}
     peerDependencies:
-      '@better-auth/core': ^1.6.22
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': ^1.7.12
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
       kysely: ^0.28.17 || ^0.29.0
     peerDependenciesMeta:
       kysely:
         optional: true
 
-  '@better-auth/memory-adapter@1.6.22':
-    resolution: {integrity: sha512-rbepe/gHhWs0aF4fAu6+l+wNPJxT9XN4U+Hqa1Y/5HhjtT9y5evo3INrSWlkIOymsMaQ0cBPrSL5pm9Z195hcA==}
+  '@better-auth/memory-adapter@1.7.12':
+    resolution: {integrity: sha512-glaDwXzDptnddHqRuu7fj47FAssUcOzLNgdlTGJoEPrspkX69x2vnXwgAzNuApjZI21WLtPH/rQ6CN+DQGybPA==}
     peerDependencies:
-      '@better-auth/core': ^1.6.22
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': ^1.7.12
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
 
-  '@better-auth/mongo-adapter@1.6.22':
-    resolution: {integrity: sha512-OYnfySHlVkIx7y6XNBsCHjKhl6IYGprRkFwifc/TAuPBVjoRKhLKRAXuzMdWTQYFt4FYb6holbhjNUrXxPIWcw==}
+  '@better-auth/mongo-adapter@1.7.12':
+    resolution: {integrity: sha512-HKV4sgYSw/Gdt9AuHlESMkiKL72SWdGweDy1Wsyxoh06BpG7aNu4aSJ7marNpMdKZteyRbxWWqQkA9ediA8qFw==}
     peerDependencies:
-      '@better-auth/core': ^1.6.22
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': ^1.7.12
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
       mongodb: ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
       mongodb:
         optional: true
 
-  '@better-auth/prisma-adapter@1.6.22':
-    resolution: {integrity: sha512-I6lWQwLva732V600u5dLM2kRcQ94pRZOVVfZ87+Ow9RBxMUnV+I+YQ5h2yggdN2tmsmITacZTy1DSZbDxGu0LQ==}
+  '@better-auth/prisma-adapter@1.7.12':
+    resolution: {integrity: sha512-FZRX6ORbwhDmeYE1Tl0IPtUn8v3BlVFgbJxDnm/DCNHxuFRf+0t4HfddUgYeYehHFR8aSDsdYX44fEFWM9877w==}
     peerDependencies:
-      '@better-auth/core': ^1.6.22
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': ^1.7.12
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
       '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
       prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
@@ -2287,18 +2284,18 @@ packages:
       prisma:
         optional: true
 
-  '@better-auth/telemetry@1.6.22':
-    resolution: {integrity: sha512-glq/oEk9qP+zGh9k/WUH5+pwvBCMolNNhaAVBCtYQrkADFee2gP3VoPs1YeO9coNuOmBhc+AYSIHs+fL9DoJnw==}
+  '@better-auth/telemetry@1.7.12':
+    resolution: {integrity: sha512-DaDkKNnI99vKGGbWq9KJg2uYeaOjsK9nIBw9T2m2KG/RkxpvQRjYkZ00++up2bZQkR5pB1nukGbplza3UJG/Xg==}
     peerDependencies:
-      '@better-auth/core': ^1.6.22
-      '@better-auth/utils': 0.4.2
-      '@better-fetch/fetch': 1.3.1
+      '@better-auth/core': ^1.7.12
+      '@better-auth/utils': ^0.4.2 || ^0.5.0
+      '@better-fetch/fetch': 1.3.2
 
-  '@better-auth/utils@0.4.2':
-    resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==}
+  '@better-auth/utils@0.5.0':
+    resolution: {integrity: sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==}
 
-  '@better-fetch/fetch@1.3.1':
-    resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==}
+  '@better-fetch/fetch@1.3.2':
+    resolution: {integrity: sha512-Gs7n99b5tqUC6cQAPbV0uED3IraHB6xQbHLQ/C3l7ZFafHScOx9pQ+DYmP5blbLFShVWLqxNUlI9wi4xU/X+ow==}
 
   '@blaxel/core@0.3.0':
     resolution: {integrity: sha512-QfTpeh+qEe57GiwPfkT9HvBkMILrrq8k8fo2pyjU/nm2y+1tbBVK9reXwgy2Ne8oTPjlDJN/uBJb54nGSm0lmA==}
@@ -7144,17 +7141,16 @@ packages:
   before-after-hook@4.0.0:
     resolution: {integrity: sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==}
 
-  better-auth@1.6.22:
-    resolution: {integrity: sha512-B5s6+lPsDWp8rGLRnvNyr5h9tftG9zLRjNrlkEJdYRhcuhPhJiw9b8o6ibgxEFpSAdUqoDaP5/FLqfu8QsXIVg==}
+  better-auth@1.7.12:
+    resolution: {integrity: sha512-f1fEG0QdTslzbmFA+vOGFFW/XXCWkG4kBxLeH9n1vp1otTH9+ZzV6EJ6797GStWeiYYgS5Vnt9xqE12KwSyAAw==}
     peerDependencies:
       '@lynx-js/react': '*'
       '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
-      '@sveltejs/kit': ^2.0.0
+      '@sveltejs/kit': ^2.0.0 || ^3.0.0
       '@tanstack/react-start': ^1.0.0
       '@tanstack/solid-start': ^1.0.0
-      better-sqlite3: ^12.0.0
-      drizzle-kit: '>=0.31.4'
-      drizzle-orm: ^0.45.2
+      drizzle-kit: '>=0.31.4 || >=1.0.0-beta.1'
+      drizzle-orm: ^0.45.2 || >=1.0.0-rc.1 <2.0.0
       mongodb: ^6.0.0 || ^7.0.0
       mysql2: ^3.0.0
       next: ^14.0.0 || ^15.0.0 || ^16.0.0
@@ -7177,8 +7173,6 @@ packages:
         optional: true
       '@tanstack/solid-start':
         optional: true
-      better-sqlite3:
-        optional: true
       drizzle-kit:
         optional: true
       drizzle-orm:
@@ -7206,8 +7200,8 @@ packages:
       vue:
         optional: true
 
-  better-call@1.3.7:
-    resolution: {integrity: sha512-Al51/hjp2SSp6CRTa3F2ptcx4yQVS1xWKoY6jcVXqNYOap6mHFP2jUBn5EwIL4iIed1/Sq4hlQ+Umm6EflZG+w==}
+  better-call@1.4.4:
+    resolution: {integrity: sha512-Gq4XdGFy4dmUxFEAX2nj0ycFcFbD9ZWh8YROouZoyXeF1M11TpYbplk0pDByTFF8Wz+MYa6W9052c9m7dD+mfw==}
     peerDependencies:
       zod: ^3.25.76
     peerDependenciesMeta:
@@ -11045,8 +11039,8 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
-  rou3@0.7.12:
-    resolution: {integrity: sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==}
+  rou3@0.9.2:
+    resolution: {integrity: sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ==}
 
   roughjs@4.6.6:
     resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==}
@@ -12352,8 +12346,8 @@ packages:
   zod@4.3.6:
     resolution: {integrity: sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==}
 
-  zod@4.4.3:
-    resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
+  zod@4.6.7:
+    resolution: {integrity: sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==}
 
   zustand@5.0.10:
     resolution: {integrity: sha512-U1AiltS1O9hSy3rul+Ub82ut2fqIAefiSuwECWt6jlMVUGejvf+5omLcRBSzqbRagSM3hQZbtzdeRc6QVScXTg==}
@@ -13101,60 +13095,59 @@ snapshots:
 
   '@balena/dockerignore@1.0.2': {}
 
-  '@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)':
+  '@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)':
     dependencies:
-      '@better-auth/utils': 0.4.2
-      '@better-fetch/fetch': 1.3.1
-      '@opentelemetry/semantic-conventions': 1.43.0
+      '@better-auth/utils': 0.5.0
+      '@better-fetch/fetch': 1.3.2
       '@standard-schema/spec': 1.1.0
-      better-call: 1.3.7(zod@4.4.3)
+      better-call: 1.4.4(zod@4.6.7)
       jose: 6.2.4
       kysely: 0.29.4
       nanostores: 1.4.1
-      zod: 4.4.3
+      zod: 4.6.7
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
 
-  '@better-auth/drizzle-adapter@1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))':
+  '@better-auth/drizzle-adapter@1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))':
     dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/utils': 0.5.0
     optionalDependencies:
       drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8)
 
-  '@better-auth/kysely-adapter@1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4)':
+  '@better-auth/kysely-adapter@1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(kysely@0.29.4)':
     dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/utils': 0.5.0
     optionalDependencies:
       kysely: 0.29.4
 
-  '@better-auth/memory-adapter@1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)':
+  '@better-auth/memory-adapter@1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)':
     dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/utils': 0.5.0
 
-  '@better-auth/mongo-adapter@1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)':
+  '@better-auth/mongo-adapter@1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)':
     dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/utils': 0.5.0
 
-  '@better-auth/prisma-adapter@1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)':
+  '@better-auth/prisma-adapter@1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)':
     dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/utils': 0.4.2
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/utils': 0.5.0
 
-  '@better-auth/telemetry@1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)':
+  '@better-auth/telemetry@1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)':
     dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/utils': 0.4.2
-      '@better-fetch/fetch': 1.3.1
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/utils': 0.5.0
+      '@better-fetch/fetch': 1.3.2
 
-  '@better-auth/utils@0.4.2':
+  '@better-auth/utils@0.5.0':
     dependencies:
       '@noble/hashes': 2.2.0
 
-  '@better-fetch/fetch@1.3.1': {}
+  '@better-fetch/fetch@1.3.2': {}
 
   '@blaxel/core@0.3.0(@cfworker/json-schema@4.1.1)(@hey-api/openapi-ts@0.99.0(typescript@5.9.3))(bufferutil@4.1.0)(utf-8-validate@6.0.6)':
     dependencies:
@@ -18137,27 +18130,26 @@ snapshots:
 
   before-after-hook@4.0.0: {}
 
-  better-auth@1.6.22(@opentelemetry/api@1.9.1)(better-sqlite3@11.10.0)(drizzle-kit@0.31.9)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))(next@16.4.1(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(pg@8.15.6)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(vitest@4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))):
-    dependencies:
-      '@better-auth/core': 1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/drizzle-adapter': 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))
-      '@better-auth/kysely-adapter': 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4)
-      '@better-auth/memory-adapter': 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)
-      '@better-auth/mongo-adapter': 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)
-      '@better-auth/prisma-adapter': 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)
-      '@better-auth/telemetry': 1.6.22(@better-auth/core@1.6.22(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)
-      '@better-auth/utils': 0.4.2
-      '@better-fetch/fetch': 1.3.1
+  better-auth@1.7.12(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.9)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))(next@16.4.1(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(react-dom@19.2.4(react@19.2.4))(react@19.2.4))(pg@8.15.6)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)(vitest@4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))):
+    dependencies:
+      '@better-auth/core': 1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/drizzle-adapter': 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8))
+      '@better-auth/kysely-adapter': 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(kysely@0.29.4)
+      '@better-auth/memory-adapter': 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)
+      '@better-auth/mongo-adapter': 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)
+      '@better-auth/prisma-adapter': 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)
+      '@better-auth/telemetry': 1.7.12(@better-auth/core@1.7.12(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)(@opentelemetry/api@1.9.1)(better-call@1.4.4(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.5.0)(@better-fetch/fetch@1.3.2)
+      '@better-auth/utils': 0.5.0
+      '@better-fetch/fetch': 1.3.2
       '@noble/ciphers': 2.2.0
       '@noble/hashes': 2.2.0
-      better-call: 1.3.7(zod@4.4.3)
+      better-call: 1.4.4(zod@4.6.7)
       defu: 6.1.7
       jose: 6.2.4
       kysely: 0.29.4
       nanostores: 1.4.1
-      zod: 4.4.3
+      zod: 4.6.7
     optionalDependencies:
-      better-sqlite3: 11.10.0
       drizzle-kit: 0.31.9
       drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.0)(@libsql/client-wasm@0.15.5)(@opentelemetry/api@1.9.1)(@types/pg@8.16.0)(better-sqlite3@11.10.0)(kysely@0.29.4)(pg@8.15.6)(postgres@3.4.8)
       next: 16.4.1(@babel/core@7.29.7)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(react-dom@19.2.4(react@19.2.4))(react@19.2.4)
@@ -18166,17 +18158,16 @@ snapshots:
       react-dom: 19.2.4(react@19.2.4)
       vitest: 4.1.12(@edge-runtime/vm@3.2.0)(@opentelemetry/api@1.9.1)(@types/node@24.12.4)(jsdom@26.1.0(bufferutil@4.1.0)(utf-8-validate@6.0.6))(vite@7.3.7(@types/node@24.12.4)(jiti@2.7.0)(lightningcss@1.32.0)(terser@5.48.0)(tsx@4.20.4)(yaml@2.9.0))
     transitivePeerDependencies:
-      - '@cloudflare/workers-types'
       - '@opentelemetry/api'
 
-  better-call@1.3.7(zod@4.4.3):
+  better-call@1.4.4(zod@4.6.7):
     dependencies:
-      '@better-auth/utils': 0.4.2
-      '@better-fetch/fetch': 1.3.1
-      rou3: 0.7.12
+      '@better-auth/utils': 0.5.0
+      '@better-fetch/fetch': 1.3.2
+      rou3: 0.9.2
       set-cookie-parser: 3.1.2
     optionalDependencies:
-      zod: 4.4.3
+      zod: 4.6.7
 
   better-path-resolve@1.0.0:
     dependencies:
@@ -22759,7 +22750,7 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.61.1
       fsevents: 2.3.3
 
-  rou3@0.7.12: {}
+  rou3@0.9.2: {}
 
   roughjs@4.6.6:
     dependencies:
@@ -24296,7 +24287,7 @@ snapshots:
 
   zod@4.3.6: {}
 
-  zod@4.4.3: {}
+  zod@4.6.7: {}
 
   zustand@5.0.10(@types/react@19.2.10)(immer@11.1.4)(react@19.2.4)(use-sync-external-store@1.5.0(react@19.2.4)):
     optionalDependencies: