diff --git a/app/client/modules/auth/routes/login.tsx b/app/client/modules/auth/routes/login.tsx
index 62a52efb..555ce544 100644
--- a/app/client/modules/auth/routes/login.tsx
+++ b/app/client/modules/auth/routes/login.tsx
@@ -133,7 +133,7 @@ export default function LoginPage() {
 			<AuthLayout title="Two-Factor Authentication" description="Enter the 6-digit code from your authenticator app">
 				<div className="space-y-6">
 					<div className="space-y-4 flex flex-col items-center">
-						<Label htmlFor="totp-code text-center">Authentication code</Label>
+						<Label htmlFor="totp-code">Authentication code</Label>
 						<div>
 							<InputOTP
 								maxLength={6}
diff --git a/app/client/modules/settings/routes/settings.tsx b/app/client/modules/settings/routes/settings.tsx
index e0a1638c..4bcecd6d 100644
--- a/app/client/modules/settings/routes/settings.tsx
+++ b/app/client/modules/settings/routes/settings.tsx
@@ -113,9 +113,9 @@ export default function Settings({ loaderData }: Route.ComponentProps) {
 						void handleLogout();
 					}, 1500);
 				},
-				onError: (error) => {
+				onError: ({ error }) => {
 					toast.error("Failed to change password", {
-						description: error.error.message,
+						description: error.message,
 					});
 				},
 				onRequest: () => {
diff --git a/app/lib/auth.ts b/app/lib/auth.ts
index 35939000..20631681 100644
--- a/app/lib/auth.ts
+++ b/app/lib/auth.ts
@@ -46,7 +46,15 @@ const createBetterAuth = (secret: string) =>
 		session: {
 			modelName: "sessionsTable",
 		},
-		plugins: [username(), twoFactor()],
+		plugins: [
+			username(),
+			twoFactor({
+				backupCodeOptions: {
+					storeBackupCodes: "encrypted",
+					amount: 5,
+				},
+			}),
+		],
 		advanced: {
 			disableOriginCheck: true,
 		},