diff --git a/.changeset/device-redirect-context.md b/.changeset/device-redirect-context.md
new file mode 100644
index 000000000..1c3f34406
--- /dev/null
+++ b/.changeset/device-redirect-context.md
@@ -0,0 +1,5 @@
+---
+"@object-ui/console": patch
+---
+
+DeviceAuthPage preserves the full query string (runtime_name / runtime_version device context) through the login redirect — previously only user_code survived, so a signed-out approver never saw what device they were authorizing.
diff --git a/apps/console/src/pages/auth/DeviceAuthPage.tsx b/apps/console/src/pages/auth/DeviceAuthPage.tsx
index 7851fa59f..d3e752848 100644
--- a/apps/console/src/pages/auth/DeviceAuthPage.tsx
+++ b/apps/console/src/pages/auth/DeviceAuthPage.tsx
@@ -8,7 +8,7 @@
  */
 
 import { useState } from 'react';
-import { Navigate, useNavigate, useSearchParams } from 'react-router-dom';
+import { Navigate, useLocation, useNavigate, useSearchParams } from 'react-router-dom';
 import { CheckCircle2, GalleryVerticalEnd } from 'lucide-react';
 import { toast } from 'sonner';
 import { useAuth } from '@object-ui/auth';
@@ -42,6 +42,7 @@ function PageShell({ children }: { children: React.ReactNode }) {
 
 export function DeviceAuthPage() {
   const { t } = useObjectTranslation();
+  const location = useLocation();
   const [params] = useSearchParams();
   const code = params.get('user_code') ?? params.get('code') ?? '';
   // Device context appended by the requesting runtime's bind/start (ADR
@@ -92,11 +93,12 @@ export function DeviceAuthPage() {
   }
 
   if (!user) {
+    // Preserve the FULL query string through the login round-trip — it
+    // carries the device context (runtime_name / runtime_version) the
+    // approval card displays, not just the user code.
     return (
       <Navigate
-        to={`/login?redirect=${encodeURIComponent(
-          `/auth/device?user_code=${encodeURIComponent(code)}`,
-        )}`}
+        to={`/login?redirect=${encodeURIComponent(`/auth/device${location.search}`)}`}
         replace
       />
     );