diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index 7b2592a..d191429 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -244,13 +244,11 @@ function AppRoutes() {
         {/*
           `/` is the front door, and the front door is Piggy.
           --------------------------------------------------
-          Signing in does not navigate: the auth gate simply starts rendering
-          these routes at whatever address the browser is already on, which for
-          anyone arriving fresh is `/`. So "land on Piggy after sign-in" and
-          "`/` is Piggy" are the same sentence, and this is the only line that
-          decides it. A post-sign-in `navigate()` was rejected: it fires on one
-          path through the gate and not on a hard refresh, so the product would
-          open somewhere different depending on how you got there.
+          Signing in does not navigate from the form: the auth gate starts
+          rendering these routes at the browser's current address. `/` goes to
+          Piggy directly, while `/login` has its own authenticated-only redirect
+          below so a person who used the explicit sign-in URL does not land on
+          the catch-all Not found page.
 
           It is a redirect rather than Piggy mounted at the index, because the
           workspace needs ONE address. Two paths rendering it would leave the
@@ -273,6 +271,7 @@ function AppRoutes() {
           into them still resolve directly, with no pass through here.
         */}
         <Route index element={<Navigate to="/piggy" replace />} />
+        <Route path="login" element={<Navigate to="/" replace />} />
         <Route path="overview" element={<RoutePage><Overview /></RoutePage>} />
         <Route path="margin" element={<RoutePage><Margin /></RoutePage>} />
         <Route path="growth" element={<RoutePage><Growth /></RoutePage>} />