diff --git a/CHANGELOG.md b/CHANGELOG.md
index c8ed1a099..2ff2fea66 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,14 @@ All notable changes to this project are documented here. Format follows
 - `make smoke` and `make seed` now run through the locked project `uv`
   environment, so local OIDC and synthetic-data workflows resolve the same
   pinned dependencies as CI.
+- `frontend/src/App.tsx` failed `tsc -b` on this branch: a dead import
+  (`rememberOidcReturnUrl`, `returnUrlFromLocation` -- unused since a prior
+  refactor) and an unguarded `AdminPanel` render passing the OIDC
+  `accessToken` (typed `string | undefined`) into a prop that requires
+  `string`. Every PR branched from here inherited both failures
+  regardless of its own diff. Fixed by dropping the dead import and
+  gating the render on `accessToken` being present, matching every other
+  `accessToken`-dependent effect in the file.
 
 ## [2.12.6] - 2026-08-20
 
diff --git a/frontend/src/App.tsx b/frontend/src/App.tsx
index 6fba0dd41..a34df38f5 100644
--- a/frontend/src/App.tsx
+++ b/frontend/src/App.tsx
@@ -101,7 +101,6 @@ import {
   tf,
   useLocale,
 } from "./i18n";
-import { rememberOidcReturnUrl, returnUrlFromLocation } from "./oidcReturnUrl";
 import "./App.css";
 
 function orchestratorUnavailableMessage(err: unknown, action: string): string {
@@ -4620,7 +4619,7 @@ export default function App({ showLabPanels = false }: { showLabPanels?: boolean
               <small>Enterprise SSO Authentication</small>
             </div>
           </div>
-          {destination === "admin" ? <AdminPanel currentBrandName={brandName} onBrandNameChange={setBrandName} accessToken={accessToken} /> : null}
+          {destination === "admin" && accessToken ? <AdminPanel currentBrandName={brandName} onBrandNameChange={setBrandName} accessToken={accessToken} /> : null}
       </main>
         <footer className="app-footer" role="contentinfo">
           <div className="app-footer-title">