diff --git a/apps/web/src/components/nav-user.tsx b/apps/web/src/components/nav-user.tsx
index 1583e5b..f277b78 100644
--- a/apps/web/src/components/nav-user.tsx
+++ b/apps/web/src/components/nav-user.tsx
@@ -38,7 +38,7 @@ import {
   clearToken,
   getClaims,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 
@@ -130,7 +130,7 @@ export function NavUser() {
     clearToken()
     resetPortalHandoff()
     if (authOn) {
-      redirectToPortalLogin()
+      redirectToPortalLogout()
       return
     }
     window.location.href = '/login'
diff --git a/apps/web/src/lib/auth.ts b/apps/web/src/lib/auth.ts
index 04e687a..466cf9c 100644
--- a/apps/web/src/lib/auth.ts
+++ b/apps/web/src/lib/auth.ts
@@ -146,6 +146,14 @@ export function redirectToPortalLogin(returnTo?: string): boolean {
   return true
 }
 
+/** End portal SSO session (refresh cookie + portal token). Do not pass return_to. */
+export function redirectToPortalLogout(): void {
+  clearToken()
+  resetPortalHandoff()
+  const url = `${authPortalUrl()}/logout`
+  window.location.assign(url)
+}
+
 export function parseHashToken(hash: string): {
   accessToken: string | null
   expiresAt: string | null
diff --git a/apps/web/src/routes/_auth/settings/appearance.tsx b/apps/web/src/routes/_auth/settings/appearance.tsx
index 207f667..5d6092c 100644
--- a/apps/web/src/routes/_auth/settings/appearance.tsx
+++ b/apps/web/src/routes/_auth/settings/appearance.tsx
@@ -7,7 +7,7 @@ import { api } from '@/lib/api-client'
 import {
   clearToken,
   isAuthEnabled,
-  redirectToPortalLogin,
+  redirectToPortalLogout,
   resetPortalHandoff,
 } from '@/lib/auth'
 import { SettingRow } from '@/components/setting-row'
@@ -60,7 +60,7 @@ function AppearanceSettingsPage() {
     clearToken()
     resetPortalHandoff()
     if (isAuthEnabled()) {
-      redirectToPortalLogin()
+      redirectToPortalLogout()
       return
     }
     void navigate({ to: '/login' })