diff --git a/public/components/settings.html b/public/components/settings.html
index 6cb7343..f88883d 100644
--- a/public/components/settings.html
+++ b/public/components/settings.html
@@ -85,8 +85,8 @@
             <p style="font-size:11px;color:var(--g400);margin:8px 0 0;"><i class="fas fa-info-circle"></i> <strong>Trade-off:</strong> Immediate transcription vs. privacy. For maximum privacy, use Browser Whisper (offline batch mode) or Server transcription with HIPAA-eligible provider.</p>
           </div>
 
-          <!-- Change Password (hidden for SSO-only users) -->
-          <div class="settings-section card" id="change-password-section">
+          <!-- Change Password — hidden by default; unhidden only for users with a real password -->
+          <div class="settings-section card" id="change-password-section" style="display:none;">
             <h3><i class="fas fa-key"></i> Change Password</h3>
             <div class="form-group" style="max-width:340px;">
               <label>Current Password</label>
@@ -104,8 +104,8 @@
             <span id="pw-change-status" style="font-size:13px;margin-left:8px;"></span>
           </div>
 
-          <!-- 2FA (hidden for SSO-only users — their IdP handles MFA) -->
-          <div class="settings-section card" id="2fa-section">
+          <!-- 2FA — hidden by default; unhidden only for users with a real password (SSO users use their IdP's MFA) -->
+          <div class="settings-section card" id="2fa-section" style="display:none;">
             <h3><i class="fas fa-shield-halved"></i> Two-Factor Authentication</h3>
             <p id="2fa-status">Status: Loading...</p>
             <button id="btn-setup-2fa" class="btn-sm btn-primary">Enable 2FA</button>
diff --git a/public/js/auth.js b/public/js/auth.js
index 7d21d30..49099db 100644
--- a/public/js/auth.js
+++ b/public/js/auth.js
@@ -733,19 +733,16 @@ document.addEventListener('DOMContentLoaded', function() {
     .then(function(r) { return r.json(); })
     .then(function(data) {
       if (!data || !data.user) return;
-      // Hide password-change + 2FA sections entirely for SSO-only users.
-      // Their auth is owned by the IdP — changing a random-blob "password"
-      // or adding TOTP here has no effect on how they sign in.
+      // Sections are display:none by default in the HTML. Only reveal them
+      // if the server confirms this user has a real password hash
+      // (canLocalAuth === true). SSO-auto-created users never see these UIs.
       var pwSection = document.getElementById('change-password-section');
       var twofaSection = document.getElementById('2fa-section');
-      if (data.user.canLocalAuth === false) {
-        if (pwSection) pwSection.style.display = 'none';
-        if (twofaSection) twofaSection.style.display = 'none';
-        return; // Nothing more to load for SSO-only users
-      } else {
-        if (pwSection) pwSection.style.display = '';
-        if (twofaSection) twofaSection.style.display = '';
+      if (data.user.canLocalAuth !== true) {
+        return; // Stay hidden — nothing more to load for SSO-only users
       }
+      if (pwSection) pwSection.style.display = '';
+      if (twofaSection) twofaSection.style.display = '';
       var status = document.getElementById('2fa-status');
       var setupBtn = document.getElementById('btn-setup-2fa');
       var disableBtn = document.getElementById('btn-disable-2fa');