diff --git a/apps/web/src/App.tsx b/apps/web/src/App.tsx
index 9c45e83..1989903 100644
--- a/apps/web/src/App.tsx
+++ b/apps/web/src/App.tsx
@@ -1321,10 +1321,7 @@ export function App() {
       const configuration = await loadOIDCRuntimeConfiguration(true);
       const identityEnabled = configuration.enabled && configuration.oidcLogin;
       setOIDCEnabled(identityEnabled);
-      if (
-        loginEntryAction(identityEnabled) === 'oidc' &&
-        configuration.contextTypes.length === 1
-      ) {
+      if (loginEntryAction(configuration) === 'oidc') {
         setOIDCCallbackError(null);
         await startOIDCLogin(undefined, configuration);
         return;
diff --git a/apps/web/src/lib/oidc.test.ts b/apps/web/src/lib/oidc.test.ts
index 6fbb243..4272716 100644
--- a/apps/web/src/lib/oidc.test.ts
+++ b/apps/web/src/lib/oidc.test.ts
@@ -127,15 +127,25 @@ describe('OIDC BFF navigation', () => {
 });
 
 describe('login entry routing', () => {
-  it('uses the authentication center when OIDC login is enabled', async () => {
+  it('uses the authentication center directly when both login contexts are available', async () => {
     const { loginEntryAction } = await import('./oidc');
 
-    expect(loginEntryAction(true)).toBe('oidc');
+    expect(loginEntryAction({
+      enabled: true,
+      oidcLogin: true,
+      contextTypes: ['platform', 'tenant'],
+      status: 'active',
+    })).toBe('oidc');
   });
 
   it('keeps the existing workspace login when OIDC login is disabled', async () => {
     const { loginEntryAction } = await import('./oidc');
 
-    expect(loginEntryAction(false)).toBe('workspace');
+    expect(loginEntryAction({
+      enabled: false,
+      oidcLogin: false,
+      contextTypes: [],
+      status: 'disabled',
+    })).toBe('workspace');
   });
 });
diff --git a/apps/web/src/lib/oidc.ts b/apps/web/src/lib/oidc.ts
index 4d6704f..d33551d 100644
--- a/apps/web/src/lib/oidc.ts
+++ b/apps/web/src/lib/oidc.ts
@@ -53,8 +53,10 @@ export function oidcBrowserSessionEnabled() {
   return oidcLoginEnabled();
 }
 
-export function loginEntryAction(oidcEnabled: boolean): 'oidc' | 'workspace' {
-  return oidcEnabled ? 'oidc' : 'workspace';
+export function loginEntryAction(
+  configuration: OIDCRuntimeConfiguration,
+): 'oidc' | 'workspace' {
+  return configuration.enabled && configuration.oidcLogin ? 'oidc' : 'workspace';
 }
 
 export async function loadOIDCRuntimeConfiguration(force = false): Promise<OIDCRuntimeConfiguration> {