@@ -0,0 +1,25 @@
+import { describe, expect, it, vi } from 'vitest'
+
+vi.mock('electron', () => import('@/test/electron-mock'))
+
+import { settingsRoute } from '@/main/app-routes'
+
+describe('settingsRoute', () => {
+  it('opens the settings of the organization the user was last in', () => {
+    expect(settingsRoute('/o/org-1/search?q=x')).toBe('/o/org-1/settings/general')
+  })
+
+  it('keeps the desktop settings of the workspace the user was last in', () => {
+    expect(settingsRoute('/workspace/ws-1/home')).toBe('/workspace/ws-1/settings/desktop')
+  })
+
+  it.each([
+    ['the workspace picker', '/workspace'],
+    ['the app entry', '/home'],
+    ['no saved route', undefined],
+    ['a route that only starts like an organization', '/oauth/o/org-1'],
+    ['an unsafe route', '//evil.example/o/org-1'],
+  ])('resolves settings through the web app from %s', (_label, lastRoute) => {
+    expect(settingsRoute(lastRoute)).toBe('/workspace?redirect=settings')
+  })
+})
@@ -16,6 +16,12 @@ import { isSafeInternalPath } from '@/main/config'
  */
 export const APP_ENTRY_ROUTE = '/home'
 
+/**
+ * Settings for a viewer whose last route names no workspace or organization. The web
+ * app resolves it to their most recent workspace, or to their organization's settings.
+ */
+const SETTINGS_ENTRY_ROUTE = '/workspace?redirect=settings'
+
 /** Workspace id from the last visited route, or null when it carries none. */
 function workspaceIdFromRoute(lastRoute: string | undefined): string | null {
   if (isSafeInternalPath(lastRoute)) {
@@ -27,6 +33,16 @@ function workspaceIdFromRoute(lastRoute: string | undefined): string | null {
   return null
 }
 
+function organizationIdFromRoute(lastRoute: string | undefined): string | null {
+  if (isSafeInternalPath(lastRoute)) {
+    const match = /^\/o\/([^/?#]+)/.exec(lastRoute)
+    if (match) {
+      return match[1]
+    }
+  }
+  return null
+}
+
 /**
  * Route for "New Chat": the home (chat) surface of the workspace the user was
  * last in, falling back to the app entry when the last route carries no
@@ -38,10 +54,14 @@ export function newChatRoute(lastRoute: string | undefined): string {
 }
 
 /**
- * Route for "Settings…": the Sim app's settings surface for the workspace the
- * user was last in, falling back to the app entry.
+ * Route for "Settings…": the settings of the workspace or organization the user
+ * was last in. Never the app entry, which lands on a page without settings.
  */
 export function settingsRoute(lastRoute: string | undefined): string {
   const workspaceId = workspaceIdFromRoute(lastRoute)
-  return workspaceId ? `/workspace/${workspaceId}/settings/desktop` : APP_ENTRY_ROUTE
+  if (workspaceId) {
+    return `/workspace/${workspaceId}/settings/desktop`
+  }
+  const organizationId = organizationIdFromRoute(lastRoute)
+  return organizationId ? `/o/${organizationId}/settings/general` : SETTINGS_ENTRY_ROUTE
 }
@@ -1,9 +1,11 @@
 import { get as httpGet } from 'node:http'
+import type { BrowserWindow } from 'electron'
 import { describe, expect, it, vi } from 'vitest'
 
 vi.mock('electron', () => import('@/test/electron-mock'))
 
 import {
+  createAuthFlow,
   createHandoffManager,
   type HandoffCallback,
   type HandoffCallbacks,
@@ -161,6 +163,31 @@ describe('createHandoffManager', () => {
   })
 })
 
+describe('login handoff landing', () => {
+  it('lands on the app entry after redeeming the login token', async () => {
+    const win = {
+      isDestroyed: () => false,
+      loadURL: vi.fn(async () => {}),
+      show: vi.fn(),
+      focus: vi.fn(),
+      webContents: {
+        getURL: () => 'https://sim.ai/login',
+        executeJavaScript: vi.fn(async () => 200),
+      },
+    }
+    const flow = createAuthFlow({
+      handoff: { consume: () => true } as unknown as ReturnType<typeof createHandoffManager>,
+      origin: () => 'https://sim.ai',
+      events: makeEvents(),
+      ensureMainWindow: async () => win as unknown as BrowserWindow,
+    })
+
+    await flow.handleCallback({ token: VALID_TOKEN, state: _VALID_STATE })
+
+    expect(win.loadURL).toHaveBeenCalledExactlyOnceWith('https://sim.ai/home')
+  })
+})
+
 describe('connect handoff account pinning', () => {
   it('keeps a source request correlated across the browser and native completion', async () => {
     const deps = makeDeps()
 
@@ -6,6 +6,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { generateShortId } from '@sim/utils/id'
 import type { BrowserWindow } from 'electron'
 import { app } from 'electron'
+import { APP_ENTRY_ROUTE } from '@/main/app-routes'
 import { showShellDialog } from '@/main/dialogs'
 import type { EventRecorder } from '@/main/observability'
 
@@ -451,7 +452,7 @@ export interface AuthFlow {
 
 /**
  * Orchestrates the login handoff: opening the system browser, consuming the
- * loopback callback, redeeming the token, and navigating to the workspace. A
+ * loopback callback, redeeming the token, and navigating to the app entry. A
  * failed or expired callback never leaves a partial session — the window lands
  * back on /login.
  */
@@ -521,7 +522,7 @@ export function createAuthFlow(deps: AuthFlowDeps): AuthFlow {
       }
       deps.events.record('handoff_redeem_ok')
       try {
-        await win.loadURL(`${origin}/workspace`)
+        await win.loadURL(`${origin}${APP_ENTRY_ROUTE}`)
       } catch {}
       win.show()
       win.focus()
 
@@ -16,8 +16,9 @@ import {
 } from '@sim/testing/mocks/workspaces-policy.mock'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCreateWorkspace } = vi.hoisted(() => ({
+const { mockCreateWorkspace, mockResolveRolledOutOrganizationId } = vi.hoisted(() => ({
   mockCreateWorkspace: vi.fn(),
+  mockResolveRolledOutOrganizationId: vi.fn(),
 }))
 
 vi.mock('@/lib/auth/session-response', () => ({
@@ -32,6 +33,10 @@ vi.mock('@/lib/workspaces/list', () => ({
   listWorkspacesForViewer: vi.fn(),
 }))
 
+vi.mock('@/lib/navigation/resolve-app-entry', () => ({
+  resolveRolledOutOrganizationId: mockResolveRolledOutOrganizationId,
+}))
+
 vi.mock('@/lib/posthog/server', () => posthogServerMock)
 
 vi.mock('@sim/audit', () => auditMock)
@@ -99,3 +104,43 @@ describe('POST /api/workspaces capability refusal', () => {
     await expect(response.json()).resolves.toEqual({ error: 'Unauthorized' })
   })
 })
+
+describe('GET /api/workspaces blocked viewer forwarding', () => {
+  const blockedList = {
+    workspaces: [],
+    lastActiveWorkspaceId: null,
+    pinnedWorkspaceIds: [],
+    creationPolicy: { canCreate: false },
+  }
+  const routeContext = { params: Promise.resolve({}) }
+  const listRequest = () =>
+    createMockRequest('GET', undefined, {}, 'http://localhost/api/workspaces')
+
+  beforeEach(() => {
+    mockGetSession.mockResolvedValue({
+      user: { id: 'user-1', name: 'A', email: 'a@example.com' },
+    })
+    vi.mocked(listWorkspacesForViewer).mockResolvedValue(
+      blockedList as unknown as Awaited<ReturnType<typeof listWorkspacesForViewer>>
+    )
+  })
+
+  it('names the organization that can serve a viewer with nothing to pick', async () => {
+    mockResolveRolledOutOrganizationId.mockResolvedValue('org-1')
+    const response = await GET(listRequest(), routeContext)
+    expect((await response.json()).forwardOrganizationId).toBe('org-1')
+  })
+
+  it('leaves the blocked picker in place when no organization can serve them', async () => {
+    mockResolveRolledOutOrganizationId.mockResolvedValue(null)
+    const response = await GET(listRequest(), routeContext)
+    expect(await response.json()).not.toHaveProperty('forwardOrganizationId')
+  })
+
+  it('still returns the list when the organization lookup fails', async () => {
+    mockResolveRolledOutOrganizationId.mockRejectedValue(new Error('down'))
+    const response = await GET(listRequest(), routeContext)
+    expect(response.status).toBe(200)
+    expect(await response.json()).not.toHaveProperty('forwardOrganizationId')
+  })
+})
@@ -2,7 +2,7 @@ import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
 import { db } from '@sim/db'
 import { type WorkspaceMode, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { getPostgresErrorCode } from '@sim/utils/errors'
+import { getErrorMessage, getPostgresErrorCode } from '@sim/utils/errors'
 import { and, eq, isNull } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { listWorkspacesQuerySchema } from '@/lib/api/contracts'
@@ -11,6 +11,7 @@ import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { getActiveOrganizationId } from '@/lib/auth/session-response'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { resolveRolledOutOrganizationId } from '@/lib/navigation/resolve-app-entry'
 import { capabilityRefusalResponse } from '@/lib/permission-groups/capability-response'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { createWorkspace } from '@/lib/workspaces/create'
@@ -24,6 +25,20 @@ import {
 
 const logger = createLogger('Workspaces')
 
+/** A failed lookup leaves the viewer on the blocked picker rather than failing the list. */
+async function resolveForwardOrganizationId(session: {
+  user: { id: string }
+}): Promise<string | undefined> {
+  try {
+    return (await resolveRolledOutOrganizationId(session)) ?? undefined
+  } catch (error) {
+    logger.warn('Could not resolve an organization to forward a blocked viewer to', {
+      error: getErrorMessage(error),
+    })
+    return undefined
+  }
+}
+
 // Get all workspaces for the current user
 export const GET = withRouteHandler(async (request: Request) => {
   const session = await getSession()
@@ -58,6 +73,7 @@ export const GET = withRouteHandler(async (request: Request) => {
         lastActiveWorkspaceId,
         pinnedWorkspaceIds,
         creationPolicy,
+        forwardOrganizationId: await resolveForwardOrganizationId(session),
       })
     }
 
 
@@ -0,0 +1,78 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { act } from 'react'
+import { authClientMock, authClientMockFns } from '@sim/testing/mocks/auth-client.mock'
+import { nextNavigationMock, nextNavigationMockFns } from '@sim/testing/mocks/next-navigation.mock'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockUseWorkspacesWithMetadata } = vi.hoisted(() => ({
+  mockUseWorkspacesWithMetadata: vi.fn(),
+}))
+
+vi.mock('next/navigation', () => nextNavigationMock)
+vi.mock('@/lib/auth/client', () => authClientMock)
+vi.mock('@/hooks/queries/workspace', () => ({
+  useWorkspacesWithMetadata: mockUseWorkspacesWithMetadata,
+}))
+
+import WorkspacePage from '@/app/workspace/page'
+
+const mockReplace = nextNavigationMockFns.router.replace
+
+describe('WorkspacePage for a viewer with nothing to pick', () => {
+  let container: HTMLDivElement
+  let root: Root
+
+  function visit(search: string, list: { forwardOrganizationId?: string }) {
+    window.history.pushState({}, '', `/workspace${search}`)
+    mockUseWorkspacesWithMetadata.mockReturnValue({
+      data: {
+        workspaces: [],
+        lastActiveWorkspaceId: null,
+        pinnedWorkspaceIds: [],
+        creationPolicy: { canCreate: false, workspaceMode: 'organization' },
+        ...list,
+      },
+      isLoading: false,
+      error: null,
+    })
+    act(() => root.render(<WorkspacePage />))
+  }
+
+  beforeEach(() => {
+    vi.stubGlobal('IS_REACT_ACT_ENVIRONMENT', true)
+    mockReplace.mockClear()
+    authClientMockFns.mockUseSession.mockReturnValue({
+      data: { user: { id: 'viewer' } },
+      isPending: false,
+      error: null,
+    })
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+  })
+
+  afterEach(() => {
+    act(() => root.unmount())
+    container.remove()
+  })
+
+  it('forwards to the organization without showing the blocked card', () => {
+    visit('', { forwardOrganizationId: 'org-1' })
+    expect(mockReplace).toHaveBeenCalledExactlyOnceWith('/o/org-1/home')
+    expect(container.querySelector('h1')).toBeNull()
+  })
+
+  it('carries a settings request to the organization settings', () => {
+    visit('?redirect=settings', { forwardOrganizationId: 'org-1' })
+    expect(mockReplace).toHaveBeenCalledExactlyOnceWith('/o/org-1/settings/general')
+  })
+
+  it('stays on the blocked card when no organization can serve them', () => {
+    visit('', {})
+    expect(mockReplace).not.toHaveBeenCalled()
+    expect(container.querySelector('h1')).not.toBeNull()
+  })
+})
@@ -16,6 +16,7 @@ import {
   isUpgradeReason,
   UPGRADE_REASON_PARAM,
 } from '@/lib/billing/upgrade-reasons'
+import { organizationRoutes } from '@/lib/navigation/paths'
 import { ApplicationLoading } from '@/app/_shell/application-loading'
 import { DesktopTitleBarLane } from '@/app/_shell/desktop-title-bar'
 import { useWorkspacesWithMetadata } from '@/hooks/queries/workspace'
@@ -133,9 +134,17 @@ export default function WorkspacePage() {
           ? `/workspace/${id}/settings/general`
           : `/workspace/${id}`
 
-    const { workspaces, lastActiveWorkspaceId, creationPolicy } = data
+    const { workspaces, lastActiveWorkspaceId, creationPolicy, forwardOrganizationId } = data
 
     if (workspaces.length === 0) {
+      if (forwardOrganizationId) {
+        hasRedirectedRef.current = true
+        const routes = organizationRoutes(forwardOrganizationId)
+        router.replace(
+          redirectTarget === 'settings' ? routes.settingsSection('general') : routes.home
+        )
+        return
+      }
       /**
        * Blocked state is derived in render and deliberately does NOT set
        * hasRedirectedRef: a later refetch that shows granted access resumes
@@ -174,6 +183,7 @@ export default function WorkspacePage() {
     isAuthenticated &&
     data &&
     data.workspaces.length === 0 &&
+    !data.forwardOrganizationId &&
     data.creationPolicy &&
     !data.creationPolicy.canCreate
       ? data.creationPolicy
 
@@ -160,6 +160,11 @@ export const listWorkspacesContract = defineRouteContract({
        */
       pinnedWorkspaceIds: z.array(z.string()).default([]),
       creationPolicy: workspaceCreationPolicySchema.nullable(),
+      /**
+       * Set when the viewer has no workspace, cannot create one, and belongs to an
+       * organization whose surface can serve them instead of a blocked picker.
+       */
+      forwardOrganizationId: z.string().optional(),
     }),
   },
 })