diff --git a/src/proxy.ts b/src/proxy.ts
index 413f16815c..7f3cd981f3 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -131,9 +131,9 @@ export async function proxy(request) {
       if (settings.requireLogin === false) {
         return response;
       }
-      // Skip auth if no password has been set yet (fresh install with no env override)
-      // This prevents an unresolvable loop where requireLogin=true but no password exists
-      if (!settings.password && !process.env.INITIAL_PASSWORD) {
+      // Skip auth ONLY for fresh installs (before onboarding) where no password exists yet.
+      // Once setupComplete is true, always require auth — prevents bypass if password row is lost (#151)
+      if (!settings.setupComplete && !settings.password && !process.env.INITIAL_PASSWORD) {
         return response;
       }
     } catch (err) {
diff --git a/src/shared/utils/apiAuth.ts b/src/shared/utils/apiAuth.ts
index b9e8770192..55ab0b091d 100644
--- a/src/shared/utils/apiAuth.ts
+++ b/src/shared/utils/apiAuth.ts
@@ -134,8 +134,10 @@ export async function isAuthRequired(): Promise<boolean> {
   try {
     const settings = await getSettings();
     if (settings.requireLogin === false) return false;
-    // If no password set and no env override, don't require auth (fresh install)
-    if (!settings.password && !process.env.INITIAL_PASSWORD) return false;
+    // Only skip auth for fresh installs (not yet onboarded) with no password.
+    // Once setupComplete is true, always require auth — prevents bypass if password row is lost (#151)
+    if (!settings.setupComplete && !settings.password && !process.env.INITIAL_PASSWORD)
+      return false;
     return true;
   } catch {
     // On error, require auth (secure by default)