diff --git a/packages/ui/src/apps/renderMobileApp.tsx b/packages/ui/src/apps/renderMobileApp.tsx
index 3c2beeaf..e20e187b 100644
--- a/packages/ui/src/apps/renderMobileApp.tsx
+++ b/packages/ui/src/apps/renderMobileApp.tsx
@@ -17,6 +17,7 @@ import { initializeAppearancePreferences, syncDesktopSettings } from '@/lib/pers
 import { startModelPrefsAutoSave } from '@/lib/modelPrefsAutoSave';
 import { startTypographyWatcher } from '@/lib/typographyWatcher';
 import { preloadMarkdownRenderer } from '@/components/chat/markdownRendererLoader';
+import { SessionAuthGate } from '@/components/auth/SessionAuthGate';
 import { MobileApp } from './MobileApp';
 
 const initializeSharedPreferences = () => {
@@ -72,13 +73,21 @@ export function renderMobileApp(apis: RuntimeAPIs) {
     ? { ...apis, notifications: { notifyAgentCompletion: async () => false, canNotify: () => false } }
     : apis;
 
+  // Auth gating differs by shell: the native Capacitor app authenticates via
+  // its own instance-connect flow (MobileConnectionWelcome asks for the
+  // password per instance), while the plain mobile BROWSER against a
+  // --ui-password server must get the classic SessionAuthGate unlock page —
+  // dropping it (v1.13.9) left browsers on a dead "unable to reach server"
+  // screen with no way to enter the password.
+  const app = <MobileApp apis={resolvedApis} />;
+
   createRoot(rootElement).render(
     <StrictMode>
       <I18nProvider>
         <ThemeSystemProvider>
           <ThemeProvider>
             <DiffWorkerProvider>
-              <MobileApp apis={resolvedApis} />
+              {isNativeShell ? app : <SessionAuthGate>{app}</SessionAuthGate>}
             </DiffWorkerProvider>
           </ThemeProvider>
         </ThemeSystemProvider>