diff --git a/backend/app/api/admin.py b/backend/app/api/admin.py
index cefc181..fd3c5ce 100644
--- a/backend/app/api/admin.py
+++ b/backend/app/api/admin.py
@@ -97,11 +97,19 @@ async def images_bulk_delete():
             )
         )
 
-    if dry_run:
-        return jsonify(projected)
-
     sha8 = _bulk_image_confirm_token(image_ids)
     expected = f"delete-images-{sha8}"
+
+    if dry_run:
+        # Hand the canonical Tier-C confirm token back with the
+        # projection so the frontend doesn't have to recompute SHA-256
+        # client-side via crypto.subtle (Secure-Context-gated,
+        # undefined on plain-HTTP origins per the homelab posture).
+        # Operator-flagged 2026-05-27.
+        projected["confirm_token"] = expected
+        return jsonify(projected)
+
+
     if supplied_confirm != expected:
         return _bad(
             "confirm_mismatch",
diff --git a/frontend/src/components/cleanup/MinDimensionCard.vue b/frontend/src/components/cleanup/MinDimensionCard.vue
index b1a1e9b..140d549 100644
--- a/frontend/src/components/cleanup/MinDimensionCard.vue
+++ b/frontend/src/components/cleanup/MinDimensionCard.vue
@@ -52,8 +52,8 @@
       v-model="showModal"
       action="delete"
       kind="min-dim"
-      :run-id="tokenSuffix"
       tier="C"
+      :expected-token-override="preview?.confirm_token || ''"
       :projected-counts="projectedCounts"
       :description="`Width < ${minW} OR height < ${minH}`"
       @confirm="onConfirmedDelete"
@@ -62,11 +62,19 @@
 </template>
 
 <script setup>
-import { computed, onMounted, ref } from 'vue'
+import { onMounted, ref } from 'vue'
 
 import DestructiveConfirmModal from '../modal/DestructiveConfirmModal.vue'
 import { useCleanupStore } from '../../stores/cleanup.js'
 
+// Backend's preview response hands the full Tier-C confirm token back
+// as `confirm_token` (e.g. `delete-min-dim-1a2b3c4d`); passed straight
+// to the modal via `expected-token-override`. We previously
+// reconstructed via Web Crypto's SHA-256, but `crypto.subtle` is
+// Secure-Context-gated and undefined on plain-HTTP origins, so the
+// Delete button silently swallowed the TypeError. Operator-flagged
+// 2026-05-27.
+
 const store = useCleanupStore()
 const minW = ref(0)
 const minH = ref(0)
@@ -75,21 +83,6 @@ const busy = ref(false)
 const showModal = ref(false)
 const projectedCounts = ref({})
 
-// The backend hands the full Tier-C confirm token back with the
-// preview response (e.g. `delete-min-dim-1a2b3c4d`). We previously
-// reconstructed it client-side via Web Crypto's SHA-256, but
-// `crypto.subtle` is undefined on plain-HTTP origins (homelab posture)
-// and the Delete-button click handler was silently swallowing the
-// TypeError. Letting the backend own the token is also the single
-// source of truth — frontend just splits off the 8-char suffix to
-// feed DestructiveConfirmModal's `runId` slot (the modal templates
-// the prefix `delete-min-dim-` itself from action+kind).
-const tokenSuffix = computed(() => {
-  const full = preview.value?.confirm_token ?? ''
-  // `delete-min-dim-1a2b3c4d` → `1a2b3c4d`
-  return full.startsWith('delete-min-dim-') ? full.slice('delete-min-dim-'.length) : ''
-})
-
 onMounted(async () => {
   await store.loadDefaults()
   minW.value = store.defaults.min_width
diff --git a/frontend/src/components/gallery/BulkEditorPanel.vue b/frontend/src/components/gallery/BulkEditorPanel.vue
index eef210f..2f8e11e 100644
--- a/frontend/src/components/gallery/BulkEditorPanel.vue
+++ b/frontend/src/components/gallery/BulkEditorPanel.vue
@@ -74,7 +74,7 @@
       v-model="deleteModalOpen"
       action="delete"
       kind="images-selection"
-      :run-id="bulkToken"
+      :expected-token-override="bulkProjected?.confirm_token || ''"
       tier="C"
       :projected-counts="bulkProjectedCounts"
       :description="bulkDescription"
@@ -130,7 +130,6 @@ watch(() => sel.order.length, () => {
 const deleting = ref(false)
 const deleteModalOpen = ref(false)
 const bulkProjected = ref(null)
-const bulkToken = ref('')
 
 const bulkProjectedCounts = computed(() => bulkProjected.value
   ? {
@@ -147,24 +146,22 @@ const bulkDescription = computed(
     : '',
 )
 
-async function _computeSha8(ids) {
-  const canon = [...ids].sort((a, b) => a - b).join(',')
-  const buf = new TextEncoder().encode(canon)
-  const hashBuf = await crypto.subtle.digest('SHA-256', buf)
-  const bytes = new Uint8Array(hashBuf)
-  let hex = ''
-  for (let i = 0; i < 4; i++) {
-    hex += bytes[i].toString(16).padStart(2, '0')
-  }
-  return hex
-}
+// The dry-run response hands the canonical Tier-C confirm token back
+// as `confirm_token` (e.g. `delete-images-1a2b3c4d`), passed straight
+// to the modal via `expected-token-override`. We used to compute the
+// hash client-side via `crypto.subtle.digest`, but (1) that's
+// Secure-Context-gated and undefined on plain-HTTP origins
+// (homelab posture), so the click silently threw TypeError and the
+// modal never opened, and (2) the modal's `kind="images-selection"`
+// produced `delete-images-selection-<sha8>` while the backend
+// expected `delete-images-<sha8>` — so it never would have worked
+// even on HTTPS. Operator-flagged 2026-05-27.
 
 async function onDeleteClick() {
   if (!sel.order.length) return
   deleting.value = true
   try {
     bulkProjected.value = await adminStore.projectBulkImageDelete(sel.order)
-    bulkToken.value = await _computeSha8(sel.order)
     deleteModalOpen.value = true
   } finally {
     deleting.value = false
diff --git a/frontend/src/components/modal/DestructiveConfirmModal.vue b/frontend/src/components/modal/DestructiveConfirmModal.vue
index 1d70e45..9556370 100644
--- a/frontend/src/components/modal/DestructiveConfirmModal.vue
+++ b/frontend/src/components/modal/DestructiveConfirmModal.vue
@@ -58,17 +58,27 @@ import { computed, ref, watch } from 'vue'
 const props = defineProps({
   modelValue: { type: Boolean, required: true },
   action: { type: String, required: true },          // 'restore' | 'delete'
-  kind: { type: String, required: true },            // 'db' | 'images' | 'artist' | 'tag' | 'images-selection'
+  kind: { type: String, required: true },            // 'db' | 'images' | 'artist' | 'tag' | 'images-selection' | 'audit' | 'min-dim'
   runId: { type: [Number, String], default: '' },    // numeric id or sha8 string
   description: { type: String, default: '' },
   tier: { type: String, default: 'C' },              // 'B' | 'C'
   projectedCounts: { type: Object, default: null },
+  // Override the `${action}-${kind}-${runId}` token formula. Use when
+  // the backend computes the canonical confirm token (e.g. bulk-delete
+  // and min-dim cleanup both return `confirm_token` from their dry-run
+  // endpoints) and the UI's kind/runId would otherwise produce a
+  // mismatched string. Operator-flagged 2026-05-27 after the
+  // BulkEditor's kind="images-selection" produced
+  // `delete-images-selection-<sha8>` while the backend expected
+  // `delete-images-<sha8>`.
+  expectedTokenOverride: { type: String, default: '' },
 })
 const emit = defineEmits(['update:modelValue', 'confirm'])
 
 const typed = ref('')
 const expectedToken = computed(
-  () => `${props.action}-${props.kind}-${props.runId}`,
+  () => props.expectedTokenOverride
+    || `${props.action}-${props.kind}-${props.runId}`,
 )
 const titleVerb = computed(
   () => props.action === 'restore' ? 'Restore' : 'Delete',
diff --git a/tests/test_api_admin.py b/tests/test_api_admin.py
index 88df653..f1ed79c 100644
--- a/tests/test_api_admin.py
+++ b/tests/test_api_admin.py
@@ -140,6 +140,11 @@ async def test_bulk_delete_dry_run_returns_counts(client, db, tmp_path):
     assert body["images_found"] == 2
     assert body["bytes_on_disk"] == 30
     assert body["missing_ids"] == [9_999_999]
+    # Dry-run hands the canonical Tier-C confirm token back so the
+    # frontend doesn't recompute SHA-256 client-side (crypto.subtle
+    # is Secure-Context-gated; FC runs over plain HTTP).
+    assert body["confirm_token"].startswith("delete-images-")
+    assert len(body["confirm_token"]) == len("delete-images-") + 8
 
 
 @pytest.mark.asyncio