diff --git a/lib/crates/fabro-cli/tests/it/support/auth_harness.rs b/lib/crates/fabro-cli/tests/it/support/auth_harness.rs
index 0dddaa93a..4a51758df 100644
--- a/lib/crates/fabro-cli/tests/it/support/auth_harness.rs
+++ b/lib/crates/fabro-cli/tests/it/support/auth_harness.rs
@@ -92,7 +92,7 @@ impl RealAuthHarness {
         let github_base = github_base_url(&twin.base_url);
         let router = build_router_with_options(
             state,
-            auth_mode,
+            &auth_mode,
             Arc::new(IpAllowlistConfig::default()),
             RouterOptions {
                 web_enabled:                 true,
diff --git a/lib/crates/fabro-server/src/auth/cli_flow.rs b/lib/crates/fabro-server/src/auth/cli_flow.rs
index 0865ff03d..e5507cb0f 100644
--- a/lib/crates/fabro-server/src/auth/cli_flow.rs
+++ b/lib/crates/fabro-server/src/auth/cli_flow.rs
@@ -754,7 +754,9 @@ fn session_cookie_secure(state: &AppState) -> bool {
 }
 
 fn eligible_session(session: Option<&SessionCookie>) -> Option<&SessionCookie> {
-    session.filter(|session| session.identity.is_some())
+    session.filter(|session| {
+        session.identity.is_some() && session.auth_method == RunAuthMethod::Github
+    })
 }
 
 fn valid_state_token(state: &str) -> bool {