diff --git a/deploy/t03-admission.json b/deploy/t03-admission.json
index c62302f..0ae98f0 100644
--- a/deploy/t03-admission.json
+++ b/deploy/t03-admission.json
@@ -1,5 +1,5 @@
 {
-  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:d08bdced387a3f24bac0c735d91ad4e2d0ed50cd96e58431343a60eee6421d82",
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ef6fdd61209863654be3adba070661645a2714e86cb4b7f4e847540291b55f07",
   "policy": {
     "origin": "http://flex-auth-informed-decision-t03.flex-auth.svc.cluster.local:8080",
     "package": "informed-decision.t03-review",
diff --git a/docs/evidence/2026-09-16-fresh-login-compatibility-rollback.json b/docs/evidence/2026-09-16-fresh-login-compatibility-rollback.json
new file mode 100644
index 0000000..50c3527
--- /dev/null
+++ b/docs/evidence/2026-09-16-fresh-login-compatibility-rollback.json
@@ -0,0 +1,9 @@
+{
+  "task": "SECRETS-WP-0010-T03",
+  "supersedes": "2026-09-16-review-fresh-authentication.json",
+  "finding": "Authelia 4.38 rejects prompt=login even after fresh login: at 23:48:28 auth_time 23:48:27 precedes request 23:48:27.926758234. Upstream issue 2596 implements support in 4.39. Prior forced-login change introduced a production regression.",
+  "source": "https://github.com/authelia/authelia/issues/2596",
+  "action": "Restore prior working image with memo-input fix. Remove incompatible prompt/max_age from review login. Do not relax MFA age policy.",
+  "image": "forgejo.coulomb.social/coulomb/informed-decision@sha256:ef6fdd61209863654be3adba070661645a2714e86cb4b7f4e847540291b55f07",
+  "remaining": "Automated fresh sign-in requires a separately validated Authelia upgrade including changed ID-token claims behavior. Native human review retry remains necessary."
+}
diff --git a/informed_decision/oidc.py b/informed_decision/oidc.py
index 201535b..6a97be5 100644
--- a/informed_decision/oidc.py
+++ b/informed_decision/oidc.py
@@ -78,8 +78,8 @@ class KeyCapeLogin:
         return self.issuer + "/authorize?" + urlencode({
             "response_type": "code", "client_id": CLIENT_ID, "redirect_uri": CALLBACK,
             "scope": " ".join(REQUIRED_SCOPES), "state": state, "nonce": nonce,
-            # Review policy requires recent MFA; a reused SSO session may be older.
-            "prompt": "login", "max_age": "0",
+            # Authelia 4.38 cannot complete prompt=login/max_age=0.
+            # Review policy still enforces the signed MFA authentication age.
             "code_challenge": challenge, "code_challenge_method": "S256",
         }), browser
 
diff --git a/tests/test_browser_auth.py b/tests/test_browser_auth.py
index 345d572..494db81 100644
--- a/tests/test_browser_auth.py
+++ b/tests/test_browser_auth.py
@@ -101,8 +101,8 @@ def test_pkce_nonce_scope_and_imported_human_session(login):
     assert session.access_token not in repr(session)
     assert login[1].params["scope"] == "openid approval:read approval:approve"
     assert login[1].params["code_challenge_method"] == "S256"
-    assert login[1].params["prompt"] == "login"
-    assert login[1].params["max_age"] == "0"
+    assert "prompt" not in login[1].params
+    assert "max_age" not in login[1].params
     assert login[1].params["nonce"] != login[1].params["state"]