diff --git a/templates/auth/login.html b/templates/auth/login.html
index 87176dc..5e9ca5a 100644
--- a/templates/auth/login.html
+++ b/templates/auth/login.html
@@ -11,6 +11,7 @@
   {% endif %}
 
   <form method="post" action="{{ url_for('auth.start_login') }}" class="space-y-4">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     <div>
       <label for="email" class="block text-sm font-medium mb-1">Email address</label>
       <input
diff --git a/templates/federation/choose_username.html b/templates/federation/choose_username.html
index 61c89c7..b4543c3 100644
--- a/templates/federation/choose_username.html
+++ b/templates/federation/choose_username.html
@@ -15,6 +15,7 @@
   {% endif %}
 
   <form method="post" class="space-y-4">
+    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     <div>
       <label for="username" class="block text-sm font-medium mb-1">Username</label>
       <div class="flex items-center">