diff --git a/apps/web/components/ensure-workspace.tsx b/apps/web/components/ensure-workspace.tsx
index 73218af2..62da5295 100644
--- a/apps/web/components/ensure-workspace.tsx
+++ b/apps/web/components/ensure-workspace.tsx
@@ -20,12 +20,17 @@ export function EnsureWorkspace({ children }: { children: React.ReactNode }) {
 	const pathname = usePathname()
 	const router = useRouter()
 	const searchParams = useSearchParams()
-	const { session, organizations, isRestoring } = useAuth()
+	const { session, organizations, isRestoring, isSessionPending } = useAuth()
 
 	const isPublicAppPage =
 		pathname === "/" &&
 		["integrations", "mcp"].includes(searchParams.get("view") ?? "")
-	const isGuestPublicAppPage = isPublicAppPage && !session
+	// Only treat this as a guest page once the session state is actually known.
+	// While the session is still pending we can't tell guest from logged-in, so
+	// rendering the public page optimistically here causes a logged-in user to
+	// see public content → loading shell → authenticated content (a double flash).
+	const isGuestPublicAppPage =
+		isPublicAppPage && !session && !isSessionPending
 	const isOnboarding = pathname.startsWith("/onboarding")
 
 	useEffect(() => {