diff --git a/extensions/dist/gnexus-creds-extension-chrome-0.2.0.zip b/extensions/dist/gnexus-creds-extension-chrome-0.2.0.zip
deleted file mode 100644
index 6ab913a..0000000
--- a/extensions/dist/gnexus-creds-extension-chrome-0.2.0.zip
+++ /dev/null
Binary files differ
diff --git a/extensions/dist/gnexus-creds-extension-chrome-0.2.1.zip b/extensions/dist/gnexus-creds-extension-chrome-0.2.1.zip
new file mode 100644
index 0000000..5977341
--- /dev/null
+++ b/extensions/dist/gnexus-creds-extension-chrome-0.2.1.zip
Binary files differ
diff --git a/extensions/dist/gnexus-creds-extension-firefox-0.2.0.zip b/extensions/dist/gnexus-creds-extension-firefox-0.2.0.zip
deleted file mode 100644
index f26c317..0000000
--- a/extensions/dist/gnexus-creds-extension-firefox-0.2.0.zip
+++ /dev/null
Binary files differ
diff --git a/extensions/dist/gnexus-creds-extension-firefox-0.2.1.zip b/extensions/dist/gnexus-creds-extension-firefox-0.2.1.zip
new file mode 100644
index 0000000..014e607
--- /dev/null
+++ b/extensions/dist/gnexus-creds-extension-firefox-0.2.1.zip
Binary files differ
diff --git a/extensions/extension/Makefile b/extensions/extension/Makefile
index 9defc32..1494343 100644
--- a/extensions/extension/Makefile
+++ b/extensions/extension/Makefile
@@ -1,5 +1,5 @@
 NAME := gnexus-creds-extension
-VERSION := 0.2.0
+VERSION := 0.2.1
 # Per-file prerequisites: a directory prerequisite (plain "src") never goes
 # stale when only a file inside it is edited.
 SRC := manifest.json $(shell find src icons lib -type f)
diff --git a/extensions/extension/manifest.json b/extensions/extension/manifest.json
index c2271a5..cac27a8 100644
--- a/extensions/extension/manifest.json
+++ b/extensions/extension/manifest.json
@@ -1,7 +1,7 @@
 {
   "manifest_version": 3,
   "name": "gnexus-creds",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Browser extension for gnexus-creds secret manager.",
   "permissions": ["storage", "activeTab", "alarms"],
   "host_permissions": ["https://*/*", "http://*/*"],
diff --git a/extensions/extension/src/content.js b/extensions/extension/src/content.js
index 84a1361..757c5ef 100644
--- a/extensions/extension/src/content.js
+++ b/extensions/extension/src/content.js
@@ -273,9 +273,18 @@
   return secretsForDomain.some((s) => (s.source || "").includes(domain) || (s.title || "").includes(domain));
 }
 
+let lastNotified = { at: 0, signature: "" };
+
 function notifyPendingSave(username, password) {
   const domain = location.hostname;
   if (isAlreadySaved(domain, username)) return;
+  // The same login can be caught by both the submit event and the button-click
+  // fallback below (or an inline submit() that bypasses the event) — send a
+  // duplicate only if the credentials changed
+  const signature = `${username}\u0000${password}`;
+  const now = Date.now();
+  if (lastNotified.signature === signature && now - lastNotified.at < 1500) return;
+  lastNotified = { at: now, signature };
   const title = `${domain} — ${username || "account"}`;
   chrome.runtime.sendMessage(
     {
@@ -305,13 +314,26 @@
 // --- Intercept form submit ---
 
 function attachSubmitInterceptor(form, usernameInput, passwordInput) {
+  // Capture credentials the same way regardless of what triggered the login
+  function captureFromTrigger() {
+    const username = usernameInput?.value?.trim() || "";
+    const password = passwordInput?.value?.trim() || "";
+    if (!password) return;
+    notifyPendingSave(username, password);
+  }
+
   if (form) {
-    form.addEventListener("submit", () => {
-      const username = usernameInput?.value?.trim() || "";
-      const password = passwordInput?.value?.trim() || "";
-      if (!password) return;
-      notifyPendingSave(username, password);
-    }, true);
+    form.addEventListener("submit", captureFromTrigger, true);
+    // Some sites (DLE's `<button onclick="submit();">`) submit
+    // programmatically via form.submit(), which fires no submit event —
+    // the navigation just happens. Catch it at the click instead.
+    const btn = form.querySelector('button[type="submit"], input[type="submit"], button:not([type])');
+    if (btn) btn.addEventListener("click", captureFromTrigger);
+    // Same for Enter submits where an inline handler calls submit() and
+    // swallows the event
+    passwordInput?.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") captureFromTrigger();
+    });
   } else {
     // No <form> tag: intercept Enter key on password input
     // and clicks on nearby submit-like buttons
diff --git a/extensions/manifest.json b/extensions/manifest.json
index a690752..556a228 100644
--- a/extensions/manifest.json
+++ b/extensions/manifest.json
@@ -1,19 +1,19 @@
 {
-  "version": "0.2.0",
+  "version": "0.2.1",
   "released_at": "2026-10-02T00:00:00Z",
   "notes": "Design-resource pack: CSS, detection tables and UI config refresh from the server without re-releasing the extension.",
   "builds": [
     {
       "browser": "chrome",
-      "filename": "gnexus-creds-extension-chrome-0.2.0.zip",
-      "sha256": "4ca98f66b6e6b99a448346f7f7ff91d58955ec21a2339ab73af8dfcc9a918120",
-      "size": 5060821
+      "filename": "gnexus-creds-extension-chrome-0.2.1.zip",
+      "sha256": "a516b258b7f6ee4221355ddf976fffeefb76506b61b318a49fbf48a273ef7d2a",
+      "size": 5061252
     },
     {
       "browser": "firefox",
-      "filename": "gnexus-creds-extension-firefox-0.2.0.zip",
-      "sha256": "3b30cb0eb4df092561fc00b88f3e306c0969dc0795a14520d71e3c89299c4ebf",
-      "size": 5059931
+      "filename": "gnexus-creds-extension-firefox-0.2.1.zip",
+      "sha256": "30ee6dfff83693324f770196d990af76c781f1d9da8cfcbb8ee88ae82aa9384c",
+      "size": 5060362
     }
   ]
 }
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 92b57f7..544daa1 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -15,6 +15,7 @@
   GnIconButton,
   GnIdentity,
   GnInput,
+  GnLoader,
   GnMetricCard,
   GnModal,
   GnNavigationShell,
@@ -309,8 +310,9 @@
   window.location.reload();
 }
 
-// the sign-in gate is rendered instead of the shell after a 401 on load
-const showLogin = ref(false);
+// 'checking' keeps a splash on screen until /me answers, so the empty shell
+// never flashes before the sign-in gate appears; shell renders on success
+const authState = ref("checking");
 
 function loginNow() {
   // explicit user click starts OAuth — no silent SSO bounce on load
@@ -1120,9 +1122,10 @@
     await loadSecrets();
     await syncTabFromRoute(true);
     window.addEventListener("popstate", onPopState);
+    authState.value = "ready";
   } catch (err) {
     if (err?.status === 401) {
-      showLogin.value = true;
+      authState.value = "denied";
     } else {
       window.location.href = "/auth/login";
     }
@@ -1194,7 +1197,13 @@
 
 <template>
   <GnToastProvider ref="toastProvider">
-    <div v-if="showLogin" class="login-screen">
+    <div v-if="authState === 'checking'" class="login-screen" aria-hidden="true">
+      <article class="card login-screen-card">
+        <img src="/logo.svg" alt="" class="login-screen-logo" />
+        <GnLoader circle class="login-screen-loader" />
+      </article>
+    </div>
+    <div v-else-if="authState === 'denied'" class="login-screen">
       <article class="card login-screen-card">
         <img src="/logo.svg" alt="" class="login-screen-logo" />
         <h1 class="login-screen-title">{{ t("login.title") }}</h1>
@@ -1205,7 +1214,7 @@
       </article>
     </div>
     <GnNavigationShell
-      v-else
+      v-else-if="authState === 'ready'"
       brand="GNEXUS CREDS"
       logo-src="/logo.svg"
       title="GNEXUS CREDS"
diff --git a/frontend/src/styles.css b/frontend/src/styles.css
index 1c4de8b..3ada83a 100644
--- a/frontend/src/styles.css
+++ b/frontend/src/styles.css
@@ -247,6 +247,12 @@
   margin-bottom: 22px;
 }
 
+/* splash while /me is unresolved: logo + spinner, nothing else */
+.login-screen-loader {
+  margin: 0 auto;
+  justify-content: center;
+}
+
 /* language pick on the Settings page: a form control, not a toolbar action */
 .create-actions .language-select {
   flex: 0 1 320px;