diff --git a/packages/cli/src/components/sequoia-subscribe.js b/packages/cli/src/components/sequoia-subscribe.js
index fccaef6..3d32c04 100644
--- a/packages/cli/src/components/sequoia-subscribe.js
+++ b/packages/cli/src/components/sequoia-subscribe.js
@@ -258,14 +258,21 @@ class SequoiaSubscribe extends BaseElement {
 				method: "POST",
 				headers: { "Content-Type": "application/json" },
 				credentials: "include",
+				referrerPolicy: "no-referrer-when-downgrade",
 				body: JSON.stringify({ publicationUri }),
 			});
 
 			const data = await response.json();
 
 			if (response.status === 401 && data.authenticated === false) {
-				// Redirect to the hosted subscribe page to complete OAuth
-				window.location.href = data.subscribeUrl;
+				// Redirect to the hosted subscribe page to complete OAuth,
+				// passing the current page URL (without credentials) as returnTo.
+				const subscribeUrl = new URL(data.subscribeUrl);
+				const pageUrl = new URL(window.location.href);
+				pageUrl.username = "";
+				pageUrl.password = "";
+				subscribeUrl.searchParams.set("returnTo", pageUrl.toString());
+				window.location.href = subscribeUrl.toString();
 				return;
 			}