diff --git a/public/index.php b/public/index.php
index 3c9c66d..ad135ad 100644
--- a/public/index.php
+++ b/public/index.php
@@ -1925,6 +1925,7 @@ if (str_starts_with($route, '/api/')) {
                         </div>
                         <div class="border-t border-t-border pt-4">
                         <div class="font-pixel text-[9px] uppercase tracking-wider text-t-dim mb-3"><i class="ph ph-lock text-xs"></i> change password</div>
+                        <form id="settings-pw-form" onsubmit="return false;">
                         <div>
                             <label class="font-pixel text-[9px] text-t-dim uppercase block mb-1">current password</label>
                             <input id="settings-pw-current" type="password" autocomplete="off" data-1p-ignore data-lpignore="true" class="w-full bg-t-bg border border-t-border text-t-bright px-3 py-2 text-xs focus:border-t-accent focus:outline-none font-mono">
@@ -1938,9 +1939,10 @@ if (str_starts_with($route, '/api/')) {
                             <input id="settings-pw-confirm" type="password" autocomplete="new-password" class="w-full bg-t-bg border border-t-border text-t-bright px-3 py-2 text-xs focus:border-t-accent focus:outline-none font-mono">
                         </div>
                         <div class="flex items-center gap-3">
-                            <button id="settings-pw-save" class="flex items-center gap-1.5 px-3 py-1.5 text-xs border border-t-accent text-t-accent hover:bg-t-accent/10 transition-colors"><i class="ph ph-floppy-disk text-sm"></i><span class="font-pixel text-[10px]">Change password</span></button>
+                            <button id="settings-pw-save" type="button" class="flex items-center gap-1.5 px-3 py-1.5 text-xs border border-t-accent text-t-accent hover:bg-t-accent/10 transition-colors"><i class="ph ph-floppy-disk text-sm"></i><span class="font-pixel text-[10px]">Change password</span></button>
                             <span id="settings-pw-status" class="font-pixel text-[9px] text-t-dim"></span>
                         </div>
+                        </form>
                         </div>
                     </div>
                 </div>
diff --git a/public/plugins/collab-buckets/collab-buckets.js b/public/plugins/collab-buckets/collab-buckets.js
index 8713873..283533a 100644
--- a/public/plugins/collab-buckets/collab-buckets.js
+++ b/public/plugins/collab-buckets/collab-buckets.js
@@ -908,10 +908,18 @@ async function init() {
     startPolling();
 }
 
+// Defer init until the CSRF token is live — `checkAuth()` sets it async on
+// boot, and firing POST /api/collab-buckets/poll before that racing lookup
+// resolves returns 403. If the token is already in the util state when we
+// load (e.g. fast reload, cached session), kick off init straight away.
+function bootWhenCsrfReady() {
+    if (hyprcrd?.util?.csrf?.()) { init(); return; }
+    hyprcrd?.hooks?.on?.('csrf.ready', () => init());
+}
 if (document.readyState === 'loading') {
-    document.addEventListener('DOMContentLoaded', init, { once: true });
+    document.addEventListener('DOMContentLoaded', bootWhenCsrfReady, { once: true });
 } else {
-    init();
+    bootWhenCsrfReady();
 }
 
 hyprcrd.registerPlugin?.({