diff --git a/src/lms/ui/Auth.cpp b/src/lms/ui/Auth.cpp
index 5e4734de..e6836c1b 100644
--- a/src/lms/ui/Auth.cpp
+++ b/src/lms/ui/Auth.cpp
@@ -31,8 +31,11 @@
 #include <Wt/WPushButton.h>
 #include <Wt/WRandom.h>
 
+#include <vector>
+
 #include "core/Service.hpp"
 #include "database/Session.hpp"
+#include "database/objects/MediaLibrary.hpp"
 #include "database/objects/User.hpp"
 #include "services/auth/IAuthTokenService.hpp"
 #include "services/auth/IPasswordService.hpp"
@@ -298,11 +301,25 @@ namespace lms::ui
                     const db::UserType type{ db::User::getCount(LmsApp->getDbSession()) == 0 ? db::UserType::ADMIN : db::UserType::REGULAR };
                     user = LmsApp->getDbSession().create<db::User>(loginName);
                     user.modify()->setType(type);
+                    // OIDC users cannot select libraries during account creation. Match
+                    // the defaults used by the administrator's create-user form and
+                    // grant access to every library that currently exists.
+                    std::vector<db::ObjectPtr<db::MediaLibrary>> mediaLibraries;
+                    db::MediaLibrary::find(LmsApp->getDbSession(), [&](const db::MediaLibrary::pointer& library) {
+                        mediaLibraries.emplace_back(library);
+                    });
+                    user.modify()->setMediaLibraries(mediaLibraries);
                     if (!identity.name().empty())
                         user.modify()->setDisplayName(identity.name().toUTF8());
                 }
                 user.modify()->setLastLogin(Wt::WDateTime::currentDateTime());
             }
+
+            // Do not keep the authenticated user tied to the temporary Wt session
+            // that initiated the OIDC round trip. The callback may have returned to
+            // an internal path with OAuth query parameters; hand the next, canonical
+            // request an LMS auth cookie instead.
+            createAuthToken(user->getId(), Wt::WDateTime::currentDateTime().addDays(56));
             userLoggedIn.emit(user->getId());
         });
 
diff --git a/src/lms/ui/LmsApplication.cpp b/src/lms/ui/LmsApplication.cpp
index 09439a70..c65e9e53 100644
--- a/src/lms/ui/LmsApplication.cpp
+++ b/src/lms/ui/LmsApplication.cpp
@@ -276,6 +276,9 @@ namespace lms::ui
             userId = processAuthToken(environment());
             break;
         case AuthenticationBackend::OIDC:
+            // A successful OIDC callback creates an LMS auth token and starts a
+            // clean request at the application root. Consume that token here.
+            userId = processAuthToken(environment());
             break;
         }
 
@@ -285,8 +288,10 @@ namespace lms::ui
         {
             assert(_oidcService);
             OIDCAuth* auth{ root()->addNew<OIDCAuth>(*_oidcService, _oidcLoginNameClaim) };
-            auth->userLoggedIn.connect(this, [this](db::UserId authenticatedUserId) {
-                onUserLoggedIn(authenticatedUserId, true /* strongAuth */);
+            auth->userLoggedIn.connect(this, [this]([[maybe_unused]] db::UserId authenticatedUserId) {
+                // Restart at the application root so a stale internal path or OIDC
+                // callback query string can never leak into the authenticated UI.
+                goHomeAndQuit();
             });
         }
         else