diff --git a/frontend/packages/agent/src/app.js b/frontend/packages/agent/src/app.js
index a6aa8c47..7889083f 100644
--- a/frontend/packages/agent/src/app.js
+++ b/frontend/packages/agent/src/app.js
@@ -360,7 +360,12 @@ window.marked = marked;
         type: 'password',
         placeholder: 'paste OAuth code here (hidden)',
         required: '',
-        autocomplete: 'off',
+        // `one-time-code` is the semantic value for OAuth codes (per
+        // WHATWG / argus #592 review): browsers may silently ignore
+        // `autocomplete="off"` on `type="password"` inputs, but
+        // `one-time-code` is honoured + suppresses the "save password
+        // for this site?" prompt that would otherwise fire on submit.
+        autocomplete: 'one-time-code',
         spellcheck: 'false',
       });
       const reveal = el('button', {