diff --git a/frontend/src/lib/e2ee.ts b/frontend/src/lib/e2ee.ts
index 763858a..f0d5c0f 100644
--- a/frontend/src/lib/e2ee.ts
+++ b/frontend/src/lib/e2ee.ts
@@ -46,12 +46,6 @@ export function isUnlocked(): boolean {
   return !!privKey;
 }
 
-export function lock(): void {
-  privKey = null;
-  convKeys.clear();
-  emitUnlock();
-}
-
 // --- IndexedDB (per-device persistence of the unlocked private key) ---
 const DB_NAME = "siftlode-e2ee";
 const STORE = "privkeys";
@@ -127,7 +121,11 @@ export async function setup(userId: number, passphrase: string): Promise<KeySetu
   const wrapKey = await wrapKeyFrom(passphrase, salt);
   const pkcs8 = await subtle.exportKey("pkcs8", kp.privateKey);
   const wrapped = await subtle.encrypt({ name: "AES-GCM", iv: bsrc(wrapIv) }, wrapKey, bsrc(pkcs8));
-  const keyCheck = await subtle.encrypt({ name: "AES-GCM", iv: bsrc(wrapIv) }, wrapKey, bsrc(enc.encode("ok")));
+  // key_check is retained for the upload schema but MUST use its own nonce: reusing wrapIv under
+  // wrapKey would be GCM nonce-reuse (leaks keystream + enables GHASH forgery). It is no longer a
+  // verification oracle either — unlock() authenticates the passphrase via the wrapped-key GCM tag.
+  const checkIv = crypto.getRandomValues(new Uint8Array(12));
+  const keyCheck = await subtle.encrypt({ name: "AES-GCM", iv: bsrc(checkIv) }, wrapKey, bsrc(enc.encode("ok")));
   const spki = await subtle.exportKey("spki", kp.publicKey);
 
   privKey = await importPrivate(pkcs8);
@@ -149,8 +147,8 @@ export async function unlock(userId: number, passphrase: string, bundle: MyKeyBu
     throw new Error("incomplete key bundle");
   }
   const wrapKey = await wrapKeyFrom(passphrase, ub64(bundle.salt));
-  // Wrong passphrase → AES-GCM auth tag fails here.
-  await subtle.decrypt({ name: "AES-GCM", iv: bsrc(ub64(bundle.wrap_iv)) }, wrapKey, bsrc(ub64(bundle.key_check)));
+  // Wrong passphrase → the AES-GCM auth tag fails on this decrypt. (No separate key_check oracle:
+  // that was redundant with this tag and formerly shared wrapIv — see setup().)
   const pkcs8 = await subtle.decrypt(
     { name: "AES-GCM", iv: bsrc(ub64(bundle.wrap_iv)) },
     wrapKey,