diff --git a/src/main.go b/src/main.go
index 9301859..5108244 100644
--- a/src/main.go
+++ b/src/main.go
@@ -123,14 +123,20 @@ func main() {
 	mux.HandleFunc("GET /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("POST /auth/callback", oidcHandler.Callback)
 	mux.HandleFunc("GET /auth/logout", func(w http.ResponseWriter, r *http.Request) {
-		// Clear NextWks session cookie
+		// Check if this is the return from Authelia logout (no NextWks cookie)
+		if _, err := r.Cookie("nextwks_session"); err != nil {
+			// Second visit: show logout confirmation page
+			component := ui.LogoutPage("", cfg.OIDC.RedirectURL)
+			component.Render(r.Context(), w)
+			return
+		}
+		// First visit: clear cookie and redirect to Authelia logout
 		http.SetCookie(w, &http.Cookie{
 			Name: "nextwks_session", Value: "", Path: "/", Domain: cfg.OIDC.Domain,
 			MaxAge: -1, HttpOnly: true, SameSite: http.SameSiteLaxMode,
 		})
-		authLogoutURL := fmt.Sprintf("%s/logout", cfg.OIDC.IssuerURL)
-		component := ui.LogoutPage(authLogoutURL, cfg.OIDC.RedirectURL)
-		component.Render(r.Context(), w)
+		logoutURL := fmt.Sprintf("%s/logout?rd=%s/auth/logout", cfg.OIDC.IssuerURL, cfg.OIDC.RedirectURL)
+		http.Redirect(w, r, logoutURL, http.StatusFound)
 	})
 
 	// --- Workspace launcher (public, but OIDC-protected) ---