diff --git a/android/app/src/main/java/com/fabledsword/minstrel/api/NetworkModule.kt b/android/app/src/main/java/com/fabledsword/minstrel/api/NetworkModule.kt
index 9f68df80..040b203b 100644
--- a/android/app/src/main/java/com/fabledsword/minstrel/api/NetworkModule.kt
+++ b/android/app/src/main/java/com/fabledsword/minstrel/api/NetworkModule.kt
@@ -48,11 +48,20 @@ object NetworkModule {
         logging: HttpLoggingInterceptor,
     ): OkHttpClient =
         OkHttpClient.Builder()
-            // BaseUrlInterceptor first — it rewrites scheme/host/port
-            // to match the live AuthStore.baseUrl on every request.
-            // Auth then sees the final URL.
-            .addInterceptor(baseUrl)
+            // AuthCookieInterceptor MUST run before BaseUrlInterceptor.
+            // Both scope on `host == PLACEHOLDER_HOST` to distinguish
+            // Minstrel-server requests from external image fetches
+            // (drift #568 / #569). If BaseUrlInterceptor runs first it
+            // rewrites the host to the real server before auth sees the
+            // request, auth's placeholder check fails, and the session
+            // cookie is neither attached on outgoing requests nor
+            // captured from Set-Cookie on login — fresh installs get
+            // stuck at the Welcome screen. Auth first means it sees
+            // placeholder.invalid, attaches/captures correctly, then
+            // BaseUrlInterceptor retargets to the live AuthStore host
+            // for transport.
             .addInterceptor(auth)
+            .addInterceptor(baseUrl)
             .addInterceptor(logging)
             .connectTimeout(CONNECT_TIMEOUT_SECONDS, TimeUnit.SECONDS)
             .readTimeout(READ_TIMEOUT_SECONDS, TimeUnit.SECONDS)