diff --git a/backend/app/auth/users.py b/backend/app/auth/users.py
index 9795836..0797460 100644
--- a/backend/app/auth/users.py
+++ b/backend/app/auth/users.py
@@ -146,8 +146,10 @@ class UserStore:
         return self.users.update(self._norm(username), must_setup=False)
 
     # ── auth ───────────────────────────────────────────────────────────
-    def verify(self, username: str, password: str) -> dict[str, Any]:
-        user = self.get_user_or_none(username)
+    def verify(self, ident: str, password: str) -> dict[str, Any]:
+        # Resolve by EITHER username OR email (the login form doesn't distinguish,
+        # and users naturally type their email after setup). Fall back to username.
+        user = self.get_user_or_none(ident) or self.by_email(ident)
         if not user or not user.get("active", True):
             raise AuthError("invalid credentials")
         if not check_password_hash(user["password_hash"], password):