diff --git a/app/client/modules/auth/routes/login.tsx b/app/client/modules/auth/routes/login.tsx
index 90dd6637..9bcfa57a 100644
--- a/app/client/modules/auth/routes/login.tsx
+++ b/app/client/modules/auth/routes/login.tsx
@@ -108,9 +108,9 @@ export default function LoginPage() {
 		verify2fa.mutate({
 			body: {
 				pendingSessionId,
-				code: twoFactorCode.trim(),
+				code: twoFactorCode,
 			},
-		} as Parameters<typeof verify2fa.mutate>[0]);
+		});
 	};
 
 	// Show 2FA verification form
diff --git a/app/client/modules/settings/routes/settings.tsx b/app/client/modules/settings/routes/settings.tsx
index 182c7139..b9588934 100644
--- a/app/client/modules/settings/routes/settings.tsx
+++ b/app/client/modules/settings/routes/settings.tsx
@@ -127,10 +127,14 @@ export default function Settings({ loaderData }: Route.ComponentProps) {
 				setEnable2faStep("verify");
 			} else {
 				toast.error("Failed to setup 2FA", { description: data.message });
+				setEnable2faDialogOpen(false);
+				resetEnable2faDialog();
 			}
 		},
 		onError: (error) => {
 			toast.error("Failed to setup 2FA", { description: error.message });
+			setEnable2faDialogOpen(false);
+			resetEnable2faDialog();
 		},
 	});
 
diff --git a/app/server/jobs/cleanup-sessions.ts b/app/server/jobs/cleanup-sessions.ts
index 09ec34c9..52ef838b 100644
--- a/app/server/jobs/cleanup-sessions.ts
+++ b/app/server/jobs/cleanup-sessions.ts
@@ -4,6 +4,7 @@ import { authService } from "../modules/auth/auth.service";
 export class CleanupSessionsJob extends Job {
 	async run() {
 		authService.cleanupExpiredSessions();
+		authService.cleanupExpiredPending2faSessions();
 
 		return { done: true, timestamp: new Date() };
 	}
diff --git a/app/server/modules/auth/auth.dto.ts b/app/server/modules/auth/auth.dto.ts
index 0cddc70d..03f7d4e4 100644
--- a/app/server/modules/auth/auth.dto.ts
+++ b/app/server/modules/auth/auth.dto.ts
@@ -179,7 +179,7 @@ export type GetTwoFactorStatusDto = typeof twoFactorStatusResponseSchema.infer;
 // Verify 2FA DTO
 export const verify2faBodySchema = type({
 	pendingSessionId: "string>0",
-	code: "string==6",
+	code: /^\d{6}$/,
 });
 
 const verify2faResponseSchema = type({
@@ -248,7 +248,7 @@ export type Setup2faDto = typeof setup2faResponseSchema.infer;
 // 2FA Enable DTO (verify code and enable)
 export const enable2faBodySchema = type({
 	password: "string>0",
-	code: "string==6",
+	code: /^\d{6}$/,
 	secret: "string>0",
 });
 
@@ -284,7 +284,7 @@ export type Enable2faDto = typeof enable2faResponseSchema.infer;
 // 2FA Disable DTO (require password and TOTP code)
 export const disable2faBodySchema = type({
 	password: "string>0",
-	code: "string==6",
+	code: /^\d{6}$/,
 });
 
 const disable2faResponseSchema = type({