diff --git a/src/gui/src/UI/Dashboard/TabSecurity.js b/src/gui/src/UI/Dashboard/TabSecurity.js
index 8acd7358d..c45f365f9 100644
--- a/src/gui/src/UI/Dashboard/TabSecurity.js
+++ b/src/gui/src/UI/Dashboard/TabSecurity.js
@@ -155,6 +155,11 @@ const TabSecurity = {
                 return;
             }
 
+            // Keep the in-memory flag in sync so a later re-render reflects the
+            // real 2FA state. The disable dialog already clears window.user.otp;
+            // the enable path never set it, so the two directions disagreed.
+            if ( window.user ) window.user.otp = enabling;
+
             const $card = $el_window.find('.dashboard-section-security .dashboard-settings-card-2fa');
             if ( enabling ) {
                 $el_window.find('.dashboard-section-security .user-otp-state').text(i18n('two_factor_enabled'));