diff --git a/app/actions/seedCredentials.ts b/app/actions/seedCredentials.ts
index e38b2dd3..8cbc8f56 100644
--- a/app/actions/seedCredentials.ts
+++ b/app/actions/seedCredentials.ts
@@ -99,6 +99,39 @@ export async function saveSeedCredentialAction(input: {
   };
 }
 
+/**
+ * Hand a verification code to a sign-in that is paused waiting for one.
+ *
+ * The browser session is still open on the other side of this, holding the
+ * challenge page; the runner polls this row and types whatever lands here
+ * into the live form. Nothing is stored — the waiter clears the column the
+ * moment it reads it.
+ */
+export async function submitSeedVerificationCodeAction(input: {
+  projectId: string;
+  host: string;
+  code: string;
+}): Promise<{ ok: true } | Err> {
+  const access = await requireOrg(input.projectId);
+  if (!access.ok) return access;
+
+  const code = input.code.trim();
+  if (!code) return { ok: false, error: "Enter the code the site sent you." };
+  if (!/^[A-Za-z0-9-]{4,12}$/.test(code)) {
+    return { ok: false, error: "That doesn\u2019t look like a verification code." };
+  }
+
+  const { error } = await serviceClient()
+    .from("outreach_seed_credentials")
+    .update({ verification_code: code })
+    .eq("organization_id", access.organizationId)
+    .eq("host", normalizeHost(input.host));
+  if (error) return { ok: false, error: error.message };
+
+  revalidatePath(`/projects/${input.projectId}/leads`);
+  return { ok: true };
+}
+
 export async function deleteSeedCredentialAction(input: {
   projectId: string;
   host: string;
diff --git a/components/leads/seed-logins.tsx b/components/leads/seed-logins.tsx
index 21d207ce..34a07602 100644
--- a/components/leads/seed-logins.tsx
+++ b/components/leads/seed-logins.tsx
@@ -5,6 +5,7 @@ import { useRouter } from "next/navigation";
 import {
   deleteSeedCredentialAction,
   saveSeedCredentialAction,
+  submitSeedVerificationCodeAction,
 } from "@/app/actions/seedCredentials";
 import type { StoredSeedCredential } from "@/lib/outreach/seedCredentials";
 
@@ -34,6 +35,7 @@ export function SeedLogins({
   const [password, setPassword] = useState("");
   const [note, setNote] = useState<string | null>(null);
   const [error, setError] = useState<string | null>(null);
+  const [codes, setCodes] = useState<Record<string, string>>({});
 
   const save = (targetHost?: string) =>
     start(async () => {
@@ -57,6 +59,24 @@ export function SeedLogins({
       router.refresh();
     });
 
+  const sendCode = (h: string) =>
+    start(async () => {
+      setError(null);
+      setNote(null);
+      const res = await submitSeedVerificationCodeAction({
+        projectId,
+        host: h,
+        code: codes[h] ?? "",
+      });
+      if (!res.ok) {
+        setError(res.error);
+        return;
+      }
+      setCodes((prev) => ({ ...prev, [h]: "" }));
+      setNote("Code sent to the waiting sign-in.");
+      router.refresh();
+    });
+
   const remove = (h: string) =>
     start(async () => {
       setError(null);
@@ -187,6 +207,37 @@ export function SeedLogins({
                   <p className="mt-1 text-xs text-[var(--color-danger,#f87171)]">{c.lastError}</p>
                 )}
               </div>
+              {c.verificationPrompt && (
+                <div className="w-full rounded border border-[var(--color-warn,#facc15)] p-3">
+                  <p className="text-sm">
+                    <strong>Waiting for a verification code.</strong> {c.verificationPrompt}
+                  </p>
+                  <div className="mt-2 flex flex-wrap items-end gap-2">
+                    <input
+                      className="input w-40"
+                      inputMode="numeric"
+                      autoComplete="one-time-code"
+                      placeholder="123456"
+                      value={codes[c.host] ?? ""}
+                      onChange={(e) =>
+                        setCodes((prev) => ({ ...prev, [c.host]: e.target.value }))
+                      }
+                    />
+                    <button
+                      onClick={() => sendCode(c.host)}
+                      disabled={pending || !(codes[c.host] ?? "").trim()}
+                      className="btn btn-primary text-sm"
+                    >
+                      {pending ? "Sending…" : "Submit code"}
+                    </button>
+                  </div>
+                  <p className="mt-1 text-xs text-[var(--color-muted)]">
+                    The sign-in is held open while you fetch it. It gives up after a few
+                    minutes so the browser is not pinned.
+                  </p>
+                </div>
+              )}
+
               <button
                 onClick={() => remove(c.host)}
                 disabled={pending}
diff --git a/lib/outreach/discover.ts b/lib/outreach/discover.ts
index 48189e2a..26392518 100644
--- a/lib/outreach/discover.ts
+++ b/lib/outreach/discover.ts
@@ -21,7 +21,8 @@ import { searchSerp, hasValueSerpKey } from "@/lib/alerts/valueserp";
 import { isThirdPartyHost } from "@/lib/leadCampaign";
 import { businessSearch } from "./freeSearch";
 import { normalizeHost } from "./cold";
-import { loadSeedCredential, recordSeedCredentialResult, seedHost } from "./seedCredentials";
+import { loadSeedCredential, makeSeedCodeWaiter, recordSeedCredentialResult, seedHost } from "./seedCredentials";
+import type { CodeWaiter } from "@/lib/sp/verificationChallenge";
 import { looksLikeLoginWall } from "./loginWall";
 import type { SeedCredentials } from "./seedLogin";
 
@@ -219,6 +220,7 @@ async function loadSeedHtml(
   url: string,
   allowRender: boolean,
   credentials?: SeedCredentials | null,
+  codeWaiter?: CodeWaiter | null,
 ): Promise<{ html: string; rendered: boolean } | { error: string; loginRequired?: boolean }> {
   const direct = await fetchHtml(url);
   // A login wall is settled unless we hold a credential — without one,
@@ -234,7 +236,7 @@ async function loadSeedHtml(
   }
 
   const { renderPage } = await import("./render");
-  const rendered = await renderPage(url, { credentials });
+  const rendered = await renderPage(url, { credentials, codeWaiter });
   if (rendered.ok) return { html: rendered.html, rendered: true };
   if (rendered.loginRequired) return { error: rendered.error, loginRequired: true };
 
@@ -260,6 +262,8 @@ export async function discoverFromSeed(input: {
   maxDetailPages?: number;
   /** Sign-in for a gated directory, when one is stored for this host. */
   credentials?: SeedCredentials | null;
+  /** Lets a user answer a verification code raised during that sign-in. */
+  codeWaiter?: CodeWaiter | null;
   /**
    * Only take the second hop when the first found fewer than this many
    * businesses. Keeps ordinary directories at one cheap page load.
@@ -276,7 +280,7 @@ export async function discoverFromSeed(input: {
   const allowRender = input.render !== false;
   const notes: string[] = [];
 
-  const seed = await loadSeedHtml(input.seedUrl, allowRender, input.credentials);
+  const seed = await loadSeedHtml(input.seedUrl, allowRender, input.credentials, input.codeWaiter);
   if ("error" in seed) {
     return {
       prospects: [],
@@ -308,7 +312,7 @@ export async function discoverFromSeed(input: {
     }
     for (const detailUrl of detailPages) {
       if (merged.size >= limit) break;
-      const detail = await loadSeedHtml(detailUrl, allowRender, input.credentials);
+      const detail = await loadSeedHtml(detailUrl, allowRender, input.credentials, input.codeWaiter);
       if ("error" in detail) continue;
       for (const p of extractOutboundProspects({
         html: detail.html,
@@ -441,7 +445,14 @@ export async function discoverProspects(input: {
     const credentials = input.organizationId
       ? await loadSeedCredential(input.organizationId, seedHost(seedUrl))
       : null;
-    const res = await discoverFromSeed({ seedUrl, limit, depth: 2, credentials });
+    const res = await discoverFromSeed({
+      seedUrl,
+      limit,
+      depth: 2,
+      credentials,
+      // Only offer the code path when a credential exists to sign in with.
+      codeWaiter: credentials ? makeSeedCodeWaiter(credentials.id) : null,
+    });
     if (res.error) errors.push(res.error);
     // Only "waiting on the user" when we have nothing to try. A stored
     // credential that failed is a different problem and reads as an error.
diff --git a/lib/outreach/render.ts b/lib/outreach/render.ts
index 80bf4609..3565cdb3 100644
--- a/lib/outreach/render.ts
+++ b/lib/outreach/render.ts
@@ -27,6 +27,7 @@ import type { Browser, BrowserContext } from "playwright";
 import { isPrivateAddress } from "./mailboxDiscovery";
 import { looksLikeLoginWall } from "./loginWall";
 import type { SeedCredentials } from "./seedLogin";
+import type { CodeWaiter } from "@/lib/sp/verificationChallenge";
 import dns from "node:dns/promises";
 import net from "node:net";
 
@@ -123,6 +124,8 @@ export async function renderPage(
   opts?: {
     /** Sign in and retry if the page turns out to be gated. */
     credentials?: SeedCredentials | null;
+    /** Lets a user answer a verification code during that sign-in. */
+    codeWaiter?: CodeWaiter | null;
   },
 ): Promise<RenderResult> {
   let parsed: URL;
@@ -194,7 +197,7 @@ export async function renderPage(
       // there — so the form is in front of us. Signing in on this same
       // context keeps the session cookies for the retry.
       const { submitLoginForm } = await import("./seedLogin");
-      const login = await submitLoginForm(page, opts.credentials);
+      const login = await submitLoginForm(page, opts.credentials, opts.codeWaiter ?? undefined);
       if (!login.ok) {
         return {
           ok: false,
diff --git a/lib/outreach/seedCredentials.ts b/lib/outreach/seedCredentials.ts
index a8377d53..97bf9fa1 100644
--- a/lib/outreach/seedCredentials.ts
+++ b/lib/outreach/seedCredentials.ts
@@ -13,6 +13,7 @@ import { serviceClient } from "@/lib/supabase/service";
 import { decryptSecret } from "@/lib/sp/vault";
 import { normalizeHost } from "./cold";
 import type { SeedCredentials } from "./seedLogin";
+import type { CodeWaiter } from "@/lib/sp/verificationChallenge";
 
 export type StoredSeedCredential = {
   id: string;
@@ -21,6 +22,8 @@ export type StoredSeedCredential = {
   loginUrl: string | null;
   verifiedAt: string | null;
   lastError: string | null;
+  /** Non-null means a sign-in is paused, waiting for the user to enter a code. */
+  verificationPrompt: string | null;
 };
 
 /** Host key for a seed URL. Credentials are matched on this. */
@@ -41,11 +44,11 @@ export function seedHost(url: string): string {
 export async function loadSeedCredential(
   organizationId: string,
   host: string,
-): Promise<SeedCredentials | null> {
+): Promise<(SeedCredentials & { id: string }) | null> {
   if (!organizationId || !host) return null;
   const { data } = await serviceClient()
     .from("outreach_seed_credentials")
-    .select("username, enc_password, login_url")
+    .select("id, username, enc_password, login_url")
     .eq("organization_id", organizationId)
     .eq("host", normalizeHost(host))
     .maybeSingle();
@@ -53,9 +56,10 @@ export async function loadSeedCredential(
 
   const row = data as Record<string, string | null>;
   const enc = row.enc_password;
-  if (!enc || !row.username) return null;
+  if (!enc || !row.username || !row.id) return null;
   try {
     return {
+      id: row.id,
       username: row.username,
       password: decryptSecret(enc),
       loginUrl: row.login_url ?? undefined,
@@ -65,13 +69,66 @@ export async function loadSeedCredential(
   }
 }
 
+
+/**
+ * A CodeWaiter bound to one stored credential.
+ *
+ * Same contract as the social-posting one (lib/sp/verificationChallenge.ts):
+ * publish what the site is asking, then poll until the user answers. The code
+ * is cleared the moment it is read so it cannot be replayed, and a timeout
+ * hands the browser slot back rather than holding it open indefinitely.
+ */
+export function makeSeedCodeWaiter(
+  credentialId: string,
+  opts: { timeoutMs?: number; pollMs?: number } = {},
+): CodeWaiter {
+  const timeoutMs = opts.timeoutMs ?? 3 * 60 * 1000;
+  const pollMs = opts.pollMs ?? 3_000;
+
+  return async function waitForCode(prompt: string): Promise<string> {
+    const sb = serviceClient();
+    await sb
+      .from("outreach_seed_credentials")
+      .update({
+        verification_prompt: prompt,
+        verification_requested_at: new Date().toISOString(),
+        verification_code: null,
+      })
+      .eq("id", credentialId);
+
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      await new Promise((r) => setTimeout(r, pollMs));
+      const { data } = await sb
+        .from("outreach_seed_credentials")
+        .select("verification_code")
+        .eq("id", credentialId)
+        .maybeSingle();
+      const code = ((data?.verification_code as string | null) ?? "").trim();
+      if (code) {
+        await sb
+          .from("outreach_seed_credentials")
+          .update({ verification_code: null, verification_prompt: null })
+          .eq("id", credentialId);
+        return code;
+      }
+    }
+
+    await sb
+      .from("outreach_seed_credentials")
+      .update({ verification_prompt: null })
+      .eq("id", credentialId);
+    throw new Error("timed out waiting for the verification code");
+  };
+}
+
 /** Every stored credential for an org, without the secrets. */
 export async function listSeedCredentials(
   organizationId: string,
 ): Promise<StoredSeedCredential[]> {
   const { data } = await serviceClient()
     .from("outreach_seed_credentials")
-    .select("id, host, username, login_url, verified_at, last_error")
+    .select("id, host, username, login_url, verified_at, last_error, verification_prompt")
     .eq("organization_id", organizationId)
     .order("host");
   return ((data as Record<string, string | null>[] | null) ?? []).map((r) => ({
@@ -81,6 +138,7 @@ export async function listSeedCredentials(
     loginUrl: r.login_url,
     verifiedAt: r.verified_at,
     lastError: r.last_error,
+    verificationPrompt: r.verification_prompt,
   }));
 }
 
diff --git a/lib/outreach/seedLogin.ts b/lib/outreach/seedLogin.ts
index 07716317..6cb8744d 100644
--- a/lib/outreach/seedLogin.ts
+++ b/lib/outreach/seedLogin.ts
@@ -13,6 +13,16 @@
 // which a form fill can satisfy. Detection stays useful there; this doesn't.
 
 import type { Page } from "playwright";
+import { handleCodeChallenge, type CodeWaiter } from "@/lib/sp/verificationChallenge";
+
+/** Hostname of a URL, for the prompt shown to the user. */
+function hostOf(url: string): string {
+  try {
+    return new URL(url).hostname;
+  } catch {
+    return "this site";
+  }
+}
 
 export type SeedCredentials = {
   username: string;
@@ -63,6 +73,13 @@ const BAD_CREDENTIALS_RE =
 export async function submitLoginForm(
   page: Page,
   creds: SeedCredentials,
+  /**
+   * Supplied when there is a user around to answer a verification code. The
+   * server cannot answer one itself — and shouldn't be able to, since the
+   * whole point of the code is that it reaches the account's owner — but the
+   * owner can, so the session is held open and the prompt surfaced to them.
+   */
+  waitForCode?: CodeWaiter,
 ): Promise<LoginOutcome> {
   // The password field is the anchor: if there isn't one, this isn't a login
   // form and guessing at the rest would only produce noise.
@@ -123,15 +140,37 @@ export async function submitLoginForm(
     .waitForLoadState("networkidle", { timeout: SETTLE_MS })
     .catch(() => page.waitForTimeout(2_500));
 
-  const body = await page.content().catch(() => "");
+  let body = await page.content().catch(() => "");
+
+  // A verification code is answerable, just not by us. With a waiter the
+  // prompt goes to the user, their code is typed into this same live session,
+  // and the sign-in carries on.
+  if (waitForCode) {
+    try {
+      const handled = await handleCodeChallenge(
+        page,
+        waitForCode,
+        `Signing in to ${hostOf(page.url())} needs a verification code. Check the inbox or phone for that account and enter the code here.`,
+      );
+      if (handled) body = await page.content().catch(() => "");
+    } catch (error) {
+      return {
+        ok: false,
+        error:
+          error instanceof Error && /timed out/i.test(error.message)
+            ? "the site asked for a verification code and none was entered in time"
+            : "the verification code was not accepted",
+      };
+    }
+  }
 
-  // A second factor is a hard stop, and worth naming precisely: the
-  // credentials may be perfectly correct and still unusable from a server.
+  // Still asking for something extra, with nobody able to answer it.
   if (EXTRA_STEP_RE.test(body)) {
     return {
       ok: false,
-      error:
-        "the site asked for a second step (a verification code, or a challenge) that can't be answered from a server",
+      error: waitForCode
+        ? "the site asked for a step beyond a verification code (a device approval or a captcha) that can't be answered this way"
+        : "the site asked for a verification code, and no one was available to enter it",
     };
   }
 
diff --git a/supabase/migrations/20260728040000_seed_credential_verification.sql b/supabase/migrations/20260728040000_seed_credential_verification.sql
new file mode 100644
index 00000000..6e3b5577
--- /dev/null
+++ b/supabase/migrations/20260728040000_seed_credential_verification.sql
@@ -0,0 +1,26 @@
+-- Human-in-the-loop verification codes for seed logins.
+--
+-- A gated directory will interrupt a sign-in with "enter the six-digit code we
+-- just sent you". The server cannot answer that, and should not be able to —
+-- the point of the code is that it reaches the account's owner. But the owner
+-- is right there, so the browser session stays open, the prompt is surfaced in
+-- the UI, and the code they type gets entered into the live page.
+--
+-- Mirrors the columns sp_post already uses for exactly this
+-- (lib/sp/verificationChallenge.ts), so the same generic detector and handler
+-- drive both.
+
+alter table public.outreach_seed_credentials
+  -- What the site is asking, verbatim enough for the user to know which
+  -- inbox or device to check.
+  add column if not exists verification_prompt text,
+  -- The code the user submits. Cleared the moment it is consumed, so it
+  -- cannot be replayed.
+  add column if not exists verification_code text,
+  add column if not exists verification_requested_at timestamptz;
+
+comment on column public.outreach_seed_credentials.verification_code is
+  'One-time code entered by the user during a live sign-in. Cleared immediately after use; never a stored secret.';
+
+comment on column public.outreach_seed_credentials.verification_prompt is
+  'What the site asked for, shown in the UI. Non-null means a sign-in is paused waiting on the user.';