diff --git a/src/channels/web/static/app.js b/src/channels/web/static/app.js
index c977989d46b..9401c9f1837 100644
--- a/src/channels/web/static/app.js
+++ b/src/channels/web/static/app.js
@@ -1886,6 +1886,7 @@ async function handleAuthRequired(data) {
     return;
   }
   if (data.extension_name && getConfigureOverlay(data.extension_name)) {
+    setAuthFlowPending(true, data.instructions);
     return;
   }
   const existingCard = data.extension_name ? getAuthCard(data.extension_name) : getAuthCard();
diff --git a/src/extensions/manager.rs b/src/extensions/manager.rs
index 35bd966f7e2..5b69f361b7b 100644
--- a/src/extensions/manager.rs
+++ b/src/extensions/manager.rs
@@ -11519,6 +11519,12 @@ mod tests {
 
     #[test]
     fn test_telegram_token_colon_preserved_in_validation_url() {
+        // ScopedEnvVar holds ENV_MUTEX for the test's lifetime, preventing
+        // a concurrent test from setting IRONCLAW_TEST_TELEGRAM_API_BASE_URL.
+        // Setting to "" is equivalent to unset — telegram_api_base_url()
+        // filters empty values. ScopedEnvVar restores the previous value on drop.
+        let _env = ScopedEnvVar::set(TELEGRAM_TEST_API_BASE_ENV, "");
+
         // Regression: Telegram tokens (format: numeric_id:alphanumeric_string) must NOT
         // have their colon URL-encoded to %3A, as this breaks the validation endpoint.
         // Previously: form_urlencoded::byte_serialize encoded the token, causing 404s.