diff --git a/web/src/routes/oauth.callback.tsx b/web/src/routes/oauth.callback.tsx
index 218b596..1bdf078 100644
--- a/web/src/routes/oauth.callback.tsx
+++ b/web/src/routes/oauth.callback.tsx
@@ -1,5 +1,5 @@
 import { Loader } from "@mantine/core";
-import { createFileRoute, useNavigate } from "@tanstack/react-router";
+import { createFileRoute } from "@tanstack/react-router";
 import { AlertTriangle } from "lucide-react";
 import { useEffect, useRef, useState } from "react";
 import { completeOAuthLogin } from "../features/auth/auth";
@@ -23,7 +23,6 @@ export const Route = createFileRoute("/oauth/callback")({
 function CallbackPage()
 {
     const search = Route.useSearch();
-    const navigate = useNavigate();
     const [ err, setErr ] = useState<string | null>(null);
 
     // ref guard：completeOAuthLogin 内部会消费 localStorage 中的 PKCE_VERIFIER /
@@ -70,7 +69,12 @@ function CallbackPage()
             return;
         }
         completeOAuthLogin(search.code, search.state).then(
-            () => { if (!cancelled) { navigate({ to: "/" }); } },
+            // 整页跳转（window.location.replace），不是路由软导航。Safari 下,从
+            // Casdoor 回跳后那条客户端导航会复用 OAuth 流程遗留的 HTTP 连接,而这些
+            // 连接在 Safari 里会卡死后续资源(setup.js / 头像)约 2 分钟——手动刷新即
+            // 恢复,印证是连接状态问题。整页重载拿到全新连接,绕开该 bug;auth 已在
+            // sessionStorage,同标签刷新存活。replace 不入历史,避免后退重触已消费的 code。
+            () => { if (!cancelled) { window.location.replace("/"); } },
             (e) => { showErrDeferred(e instanceof Error ? e.message : String(e)); },
         );