diff --git a/public/js/auth.js b/public/js/auth.js
index c3d1ab3..a218169 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -745,16 +745,15 @@ document.addEventListener('DOMContentLoaded', function() {
       }
       // Keep cache in sync
       window.CURRENT_USER = data.user;
-      // Sections are display:none by default in the HTML. Reveal them only
-      // for users with a real password hash (canLocalAuth === true).
-      // SSO-only users never see password change, 2FA, or session
-      // management — session revoke can't stick against an active IdP
-      // session, so showing it would be misleading.
+      // Sections are display:none by default. Show them unless the server
+      // explicitly marks this user as SSO-only (canLocalAuth === false).
+      // Missing/undefined flag defaults to showing — safer than hiding a
+      // legit local user's sections due to a transient fetch hiccup.
       var pwSection = document.getElementById('change-password-section');
       var twofaSection = document.getElementById('2fa-section');
       var sessionsSection = document.getElementById('sessions-section');
-      if (data.user.canLocalAuth !== true) {
-        return;
+      if (data.user.canLocalAuth === false) {
+        return; // SSO-only — keep sections hidden
       }
       if (pwSection) pwSection.style.display = '';
       if (twofaSection) twofaSection.style.display = '';