diff --git a/app/Providers/Filament/TenantPanelProvider.php b/app/Providers/Filament/TenantPanelProvider.php
index 3dea405..2b0eb54 100644
--- a/app/Providers/Filament/TenantPanelProvider.php
+++ b/app/Providers/Filament/TenantPanelProvider.php
@@ -46,6 +46,14 @@ class TenantPanelProvider extends PanelProvider
                 \App\Filament\Tenant\Widgets\StatsOverview::class,
             ])
             ->middleware([
+                // CRITICAL: tenant resolution must run BEFORE Filament's
+                // Authenticate middleware (which is inserted by authMiddleware
+                // between ShareErrorsFromSession and AuthenticateSession).
+                // Otherwise User::find() during auth check has no tenant
+                // context → TenantScope returns 0 rows → user appears
+                // unauthenticated → endless redirect to /app/login.
+                ResolveTenant::class,
+                CheckTenantStatus::class,
                 EncryptCookies::class,
                 AddQueuedCookiesToResponse::class,
                 StartSession::class,
@@ -55,9 +63,6 @@ class TenantPanelProvider extends PanelProvider
                 SubstituteBindings::class,
                 DisableBladeIconComponents::class,
                 DispatchServingFilamentEvent::class,
-                // ResolveTenant + CheckTenantStatus are now registered globally
-                // in bootstrap/app.php (web middleware group) so they run on
-                // Livewire endpoints too. No need to duplicate them here.
             ])
             ->authMiddleware([
                 Authenticate::class,