diff --git a/web/public/service-worker.js b/web/public/service-worker.js
new file mode 100644
index 00000000..2f9ee873
--- /dev/null
+++ b/web/public/service-worker.js
@@ -0,0 +1,24 @@
+// Kill switch for the pre-rewrite service worker (formerly at repo root, see git history).
+// That worker cached every same-origin GET (including session/bootstrap API calls) keyed only
+// by frontend PACKAGE_VERSION -- a backend-only change (deploy, migration, cutover) never
+// invalidated it, so browsers that had visited this origin before the rewrite kept getting
+// stale API responses served instead of hitting the new backend, which looked like "login
+// succeeds then immediately bounces back to the login page".
+//
+// This file's only job is to replace that worker in already-registered browsers and remove
+// it entirely: purge its caches, unregister, then reload any open tabs so they load uncontrolled.
+// The rewritten app (web/) does not use a service worker for anything -- do not add fetch
+// caching logic here.
+self.addEventListener('install', () => self.skipWaiting());
+
+self.addEventListener('activate', event => {
+  event.waitUntil((async () => {
+    const keys = await caches.keys();
+    await Promise.all(keys.map(key => caches.delete(key)));
+    await self.registration.unregister();
+    const clientsList = await self.clients.matchAll({ type: 'window' });
+    for (const client of clientsList) {
+      client.navigate(client.url);
+    }
+  })());
+});
diff --git a/web/src/main.tsx b/web/src/main.tsx
index bef5202a..8a8aa7e0 100644
--- a/web/src/main.tsx
+++ b/web/src/main.tsx
@@ -3,6 +3,16 @@ import { createRoot } from 'react-dom/client'
 import './index.css'
 import App from './App.tsx'
 
+// This app has no service worker of its own, but browsers that visited this origin before the
+// redesign/desktop-multicolumn rewrite may still have the old one registered (see
+// public/service-worker.js) -- force an immediate update check rather than waiting for the
+// browser's own lazy schedule, so it gets replaced by the kill switch right away.
+if ('serviceWorker' in navigator) {
+  navigator.serviceWorker.getRegistrations().then(regs => {
+    regs.forEach(reg => reg.update())
+  })
+}
+
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     <App />