diff --git a/web_server.py b/web_server.py
index 1dfd3ad0..7e2cd7e0 100644
--- a/web_server.py
+++ b/web_server.py
@@ -5539,7 +5539,6 @@ def auth_spotify():
 
                 <script>
                     window.addEventListener('message', function(event) {{
-                        if (event.origin !== window.location.origin) return;
                         if (!event.data || event.data.type !== 'spotify-auth-complete') return;
                         setTimeout(() => window.close(), 300);
                     }});
@@ -5734,7 +5733,7 @@ def _spotify_auth_success_page(detail_text: str) -> str:
       (function() {{
         try {{
           if (window.opener && !window.opener.closed) {{
-            window.opener.postMessage({{ type: 'spotify-auth-complete' }}, window.location.origin);
+            window.opener.postMessage({{ type: 'spotify-auth-complete' }}, '*');
           }}
         }} catch (error) {{
           console.warn('Unable to notify opener about Spotify auth completion', error);
diff --git a/webui/static/settings.js b/webui/static/settings.js
index dce37adc..4f4f0327 100644
--- a/webui/static/settings.js
+++ b/webui/static/settings.js
@@ -3079,7 +3079,7 @@ async function authenticateSpotify() {
         // Save settings first to ensure client_id/client_secret are persisted
         await saveSettings();
         showToast('Spotify authentication started', 'success');
-        window.open('/auth/spotify', '_blank');
+        window._spotifyAuthWindow = window.open('/auth/spotify', '_blank');
     } catch (error) {
         console.error('Error authenticating Spotify:', error);
         showToast('Failed to start Spotify authentication', 'error', 'gs-connecting');
diff --git a/webui/static/shared-helpers.js b/webui/static/shared-helpers.js
index 928588fe..92e5246b 100644
--- a/webui/static/shared-helpers.js
+++ b/webui/static/shared-helpers.js
@@ -3108,16 +3108,18 @@ async function _forceServiceStatusRefresh() {
 }
 
 let _spotifyAuthCompletionListenerInstalled = false;
+window._spotifyAuthWindow = window._spotifyAuthWindow || null;
 
 function initializeSpotifyAuthCompletionListener() {
     if (_spotifyAuthCompletionListenerInstalled) return;
     _spotifyAuthCompletionListenerInstalled = true;
 
     window.addEventListener('message', async event => {
-        if (event.origin !== window.location.origin) return;
         if (!event.data || event.data.type !== 'spotify-auth-complete') return;
+        if (window._spotifyAuthWindow && event.source && event.source !== window._spotifyAuthWindow) return;
 
         try {
+            window._spotifyAuthWindow = null;
             await _forceServiceStatusRefresh();
         } catch (error) {
             console.warn('Could not refresh Spotify status after auth completion:', error);