diff --git a/src/app/(dashboard)/layout.tsx b/src/app/(dashboard)/layout.tsx
index dc20652..46aafe6 100644
--- a/src/app/(dashboard)/layout.tsx
+++ b/src/app/(dashboard)/layout.tsx
@@ -1,5 +1,6 @@
 import { redirect } from "next/navigation";
 import { getSession } from "@/lib/auth";
+import { db } from "@/lib/db";
 import { Sidebar } from "@/components/layout/sidebar";
 import { TopNav } from "@/components/layout/topnav";
 import { Footer } from "@/components/layout/footer";
@@ -7,10 +8,18 @@ import { Footer } from "@/components/layout/footer";
 export default async function DashboardLayout({ children }: { children: React.ReactNode }) {
   const session = await getSession();
   if (!session) redirect("/login");
+
   // Force a password change before anything else (provisioned accounts ship with
-  // a known default + mustChangePassword=true). The target page is outside this
-  // layout group, so there's no redirect loop.
-  if (session.user.mustChangePassword) redirect("/change-password");
+  // a known default + mustChangePassword=true). Read the flag from the DB, not the
+  // JWT: the cookie is only refreshed on re-login/update(), so trusting it would
+  // keep bouncing the user back here even after they've set a new password. The
+  // target page is outside this layout group, so there's no redirect loop.
+  const account = await db.user.findUnique({
+    where: { id: session.user.id },
+    select: { active: true, mustChangePassword: true },
+  });
+  if (!account || !account.active) redirect("/login");
+  if (account.mustChangePassword) redirect("/change-password");
 
   return (
     <div className="flex h-screen flex-col">
diff --git a/src/lib/changelog.ts b/src/lib/changelog.ts
index 7ca3cad..4ac2d14 100644
--- a/src/lib/changelog.ts
+++ b/src/lib/changelog.ts
@@ -8,6 +8,13 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.16.1",
+    date: "2026-06-16",
+    changes: [
+      "Fixed: after you set a new password, the app could keep asking you to change it again on every visit. It now clears the moment you save your new password.",
+    ],
+  },
   {
     version: "0.16.0",
     date: "2026-06-16",
diff --git a/src/lib/version.ts b/src/lib/version.ts
index 3a3431a..df9620a 100644
--- a/src/lib/version.ts
+++ b/src/lib/version.ts
@@ -1,2 +1,2 @@
 // Bump on every user-visible release. Changelog entries live in `src/lib/changelog.ts`.
-export const APP_VERSION = "0.16.0";
+export const APP_VERSION = "0.16.1";