diff --git a/client/web/src/components/login-toggle.tsx b/client/web/src/components/login-toggle.tsx
index 011aa2f8b..a1dbd3c95 100644
--- a/client/web/src/components/login-toggle.tsx
+++ b/client/web/src/components/login-toggle.tsx
@@ -126,7 +126,14 @@ function LoginPopoverContent({
 
   const handleSignInClick = useCallback(() => {
     if (auth.viewerIdentity) {
-      newSession()
+      if (window.self !== window.top) {
+        // if we're inside an iframe, start session in new window
+        let url = new URL(window.location.href)
+        url.searchParams.set("check", "now")
+        window.open(url, "_blank")
+      } else {
+        newSession()
+      }
     } else {
       // Must be connected over Tailscale to log in.
       // Send user to Tailscale IP and start check mode