diff --git a/frontend/js/auth.js b/frontend/js/auth.js
index 621254d..c5756aa 100644
--- a/frontend/js/auth.js
+++ b/frontend/js/auth.js
@@ -4,7 +4,6 @@ import { safeCreateIcons } from './utils.js';
 import { showToast, closeHeaderMenu } from './ui.js';
 import { t, getLocale, setLocale } from './i18n.js';
 import { showWelcome } from './viewer.js';
-import { loadVaults, loadTags } from './sidebar.js';
 
 // ── Global logout handler for header dropdown onclick ────────────────────
 // Defined at module top level so it's always available, even if
@@ -317,10 +316,15 @@ function initLoginForm() {
 
       // Load app data after successful login
       try {
+        // Dynamic imports to avoid circular dependency with sidebar.js
+        const { loadVaults, loadTags } = await import('./sidebar.js');
         await Promise.all([loadVaults(), loadTags()]);
         // Start SSE sync now that auth cookie is set (dynamic import to avoid circular dep)
         const { IndexUpdateManager } = await import('./sync.js');
         IndexUpdateManager.connect();
+        // Sync offline file index now that we're authenticated
+        const { syncFileIndexFromServer } = await import('./offline.js');
+        syncFileIndexFromServer();
         // Show dashboard
         showWelcome();
       } catch (err) {
diff --git a/frontend/js/sync.js b/frontend/js/sync.js
index 2f3db21..f0e6bc9 100644
--- a/frontend/js/sync.js
+++ b/frontend/js/sync.js
@@ -2,7 +2,7 @@
 import { state } from './state.js';
 import { t } from './i18n.js';
 import { showToast } from './ui.js';
-import { api } from './auth.js';
+import { api, AuthManager } from './auth.js';
 import { loadVaults, loadTags, refreshTagsForContext, refreshSidebarTreePreservingState } from './sidebar.js';
 import { loadRecentFiles, initAboutModal } from './config.js';
 import { openFile } from './viewer.js';
@@ -591,8 +591,17 @@ export function init() {
   initOffline();
   initThemes();
   initAboutModal();
-  // Sync file index after a short delay (let vaults load first)
-  setTimeout(() => syncFileIndexFromServer(), 3000);
+  // Sync file index after a short delay (let vaults load first).
+  // Gate on auth at execution time (not scheduling time) so that
+  // initAuth() has a chance to complete and set _authEnabled / token.
+  // The login handler triggers syncFileIndexFromServer explicitly on
+  // fresh login, so we only do it here for already-authenticated or
+  // auth-disabled sessions.
+  setTimeout(() => {
+    if (!AuthManager._authEnabled || AuthManager.getToken()) {
+      syncFileIndexFromServer();
+    }
+  }, 3000);
   initDashboardTabs();
 
   // Listen for Forge editor rename events