diff --git a/.changeset/email-link-prepared-signal.md b/.changeset/email-link-prepared-signal.md
new file mode 100644
index 00000000000..a845151cc84
--- /dev/null
+++ b/.changeset/email-link-prepared-signal.md
@@ -0,0 +1,2 @@
+---
+---
diff --git a/packages/mosaic/src/features/user-profile/user-profile-contact.types.ts b/packages/mosaic/src/features/user-profile/user-profile-contact.types.ts
index 1f178b0f450..3b9ed5e9a2a 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-contact.types.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-contact.types.ts
@@ -10,12 +10,13 @@ export type UserProfileEmail = UserProfileContact;
 export type UserProfilePhone = UserProfileContact;
 
 export type UserProfileEmailVerification =
-  | { method: 'code'; sent: Promise<void> }
+  | { method: 'code' }
   | { method: 'link'; verified: Promise<void>; cancel: () => void }
   | { method: 'sso'; connect: () => Promise<void> };
 
 export interface UserProfileEmailVerifier {
-  start: () => UserProfileEmailVerification;
+  prepare: () => Promise<UserProfileEmailVerification>;
+  cancel: () => void;
   verifyCode: (code: string) => Promise<void>;
 }
 
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.controller.test.ts b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.controller.test.ts
index f17f65de695..aa657c5e5f2 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.controller.test.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.controller.test.ts
@@ -9,7 +9,7 @@ import { useUserProfileAddEmailController } from '../user-profile-add-email.cont
 
 const idleReverification = { status: 'idle', visible: false } satisfies ReverificationController;
 
-const sentCode = (): UserProfileEmailVerification => ({ method: 'code', sent: Promise.resolve() });
+const sentCode = (): UserProfileEmailVerification => ({ method: 'code' });
 
 function sentLink(verified: Promise<void>, cancel = vi.fn()) {
   return (): UserProfileEmailVerification => ({ method: 'link', verified, cancel });
@@ -19,7 +19,11 @@ function verifier(
   start: () => UserProfileEmailVerification = sentCode,
   verifyCode: (code: string) => Promise<void> = () => Promise.resolve(),
 ) {
-  return { start: vi.fn(start), verifyCode: vi.fn(verifyCode) } satisfies UserProfileEmailVerifier;
+  return {
+    prepare: vi.fn(async () => start()),
+    cancel: vi.fn(),
+    verifyCode: vi.fn(verifyCode),
+  } satisfies UserProfileEmailVerifier;
 }
 
 const created = () => Promise.resolve(verifier());
@@ -125,7 +129,7 @@ describe('useUserProfileAddEmailController', () => {
     });
     expect(result.current.resendSeconds).toBe(30);
     act(() => result.current.onResend());
-    expect(email.start).toHaveBeenCalledTimes(1);
+    expect(email.prepare).toHaveBeenCalledTimes(1);
     for (let second = 0; second < 30; second++) {
       await act(async () => vi.advanceTimersByTimeAsync(1000));
     }
@@ -138,7 +142,7 @@ describe('useUserProfileAddEmailController', () => {
       result.current.onOpenChange(false);
       await Promise.resolve();
     });
-    expect(email.start).toHaveBeenCalledTimes(2);
+    expect(email.prepare).toHaveBeenCalledTimes(2);
     expect(email.verifyCode).not.toHaveBeenCalled();
     expect(result.current.open).toBe(true);
     expect(result.current.code).toBe('');
@@ -185,7 +189,7 @@ describe('useUserProfileAddEmailController', () => {
     expect(result.current.open).toBe(true);
     await waitFor(() => expect(result.current.step).toBe('verify'));
     expect(onCreate).toHaveBeenCalledExactlyOnceWith('new@example.com');
-    await waitFor(() => expect(email.start).toHaveBeenCalledOnce());
+    await waitFor(() => expect(email.prepare).toHaveBeenCalledOnce());
 
     act(() => result.current.onSubmit('123456'));
     await waitFor(() => expect(result.current.open).toBe(false));
@@ -199,11 +203,11 @@ describe('useUserProfileAddEmailController', () => {
       useUserProfileAddEmailController({ reverification: idleReverification, onCreate }),
     );
 
-    act(() => result.current.onVerifyEmail(other, email));
+    await act(() => result.current.onVerifyEmail(other, email));
     expect(result.current.open).toBe(true);
     expect(result.current.step).toBe('verify');
     expect(result.current.emailAddress).toBe('other@example.com');
-    await waitFor(() => expect(email.start).toHaveBeenCalledOnce());
+    await waitFor(() => expect(email.prepare).toHaveBeenCalledOnce());
 
     act(() => result.current.onSubmit('123456'));
     await waitFor(() => expect(result.current.open).toBe(false));
@@ -218,11 +222,11 @@ describe('useUserProfileAddEmailController', () => {
     );
     expect(result.current.verifyingId).toBeUndefined();
 
-    act(() => result.current.onVerifyEmail(other, email));
+    await act(() => result.current.onVerifyEmail(other, email));
     expect(result.current.verifyingId).toBe('email_2');
     await waitFor(() => expect(result.current.step).toBe('verify'));
 
-    act(() => result.current.onVerifyEmail({ id: 'email_3', value: 'person@acme.co' }, email));
+    await act(() => result.current.onVerifyEmail({ id: 'email_3', value: 'person@acme.co' }, email));
     expect(result.current.verifyingId).toBe('email_2');
     expect(result.current.emailAddress).toBe('other@example.com');
 
@@ -234,23 +238,62 @@ describe('useUserProfileAddEmailController', () => {
     expect(result.current.verifyingId).toBeUndefined();
   });
 
-  it('stays on the code step when sending fails, and lets the user resend at once', async () => {
+  it('creates a different email when the value changes after failed preparation', async () => {
     const email = verifier();
-    email.start.mockImplementationOnce(() => ({
-      method: 'code',
-      sent: Promise.reject(saveError('Too many requests')),
-    }));
+    email.prepare.mockRejectedValueOnce(saveError('Try again'));
+    const onCreate = vi.fn(async () => email);
     const { result } = renderHook(() =>
-      useUserProfileAddEmailController({ reverification: idleReverification, onCreate: created }),
+      useUserProfileAddEmailController({ reverification: idleReverification, onCreate }),
     );
+    act(() => result.current.onOpenChange(true));
+    act(() => result.current.onEmailAddressChange('first@example.com'));
+    await act(() => result.current.onSubmit());
+    await waitFor(() => expect(result.current.errorMessage).toBe('Try again'));
+    act(() => result.current.onEmailAddressChange('second@example.com'));
+    await act(() => result.current.onSubmit());
+    await waitFor(() => expect(result.current.step).toBe('verify'));
+    expect(onCreate.mock.calls).toEqual([['first@example.com'], ['second@example.com']]);
+  });
 
-    act(() => result.current.onVerifyEmail(other, email));
-    await waitFor(() => expect(result.current.errorMessage).toBe('Too many requests'));
+  it('keeps the code input and zero cooldown after failed resend', async () => {
+    vi.useFakeTimers();
+    const email = verifier();
+    const { result } = renderHook(() => useUserProfileAddEmailController({ reverification: idleReverification }));
+    await act(() => result.current.onVerifyEmail(other, email));
+    for (let second = 0; second < 30; second++) {
+      await act(async () => vi.advanceTimersByTimeAsync(1000));
+    }
+    email.prepare.mockRejectedValueOnce(saveError('Send failed'));
+    await act(() => result.current.onResend());
     expect(result.current.step).toBe('verify');
+    expect(result.current.errorMessage).toBe('Send failed');
     expect(result.current.resendSeconds).toBe(0);
+  });
 
-    act(() => result.current.onResend());
-    await waitFor(() => expect(email.start).toHaveBeenCalledTimes(2));
+  it('preserves a failed resend error after the previous link expired', async () => {
+    vi.useFakeTimers();
+    const expired = createDeferredPromise();
+    const email = verifier(sentLink(expired.promise.then(() => undefined)));
+    const { result } = renderHook(() => useUserProfileAddEmailController({ reverification: idleReverification }));
+    await act(() => result.current.onVerifyEmail(other, email));
+    await act(async () => {
+      expired.reject(saveError('Link expired'));
+      await Promise.resolve();
+    });
+    expect(result.current.errorMessage).toBe('Link expired');
+    for (let second = 0; second < 60; second++) {
+      await act(async () => vi.advanceTimersByTimeAsync(1000));
+    }
+    email.prepare.mockRejectedValueOnce(saveError('Too many requests'));
+    await act(() => result.current.onResend());
+    expect(result.current.step).toBe('link');
+    expect(result.current.errorMessage).toBe('Too many requests');
+    expect(result.current.resendSeconds).toBe(0);
+    email.prepare.mockResolvedValueOnce(sentLink(new Promise(() => {}))());
+    await act(() => result.current.onResend());
+    expect(result.current.step).toBe('link');
+    expect(result.current.resendSeconds).toBe(60);
+    expect(result.current.errorMessage).toBeUndefined();
   });
 
   it('shows the error for the field that failed', async () => {
@@ -270,7 +313,7 @@ describe('useUserProfileAddEmailController', () => {
     const verified = createDeferredPromise();
     const { result } = renderHook(() => useUserProfileAddEmailController({ reverification: idleReverification }));
 
-    act(() => result.current.onVerifyEmail(other, verifier(sentLink(verified.promise.then(() => undefined)))));
+    await act(() => result.current.onVerifyEmail(other, verifier(sentLink(verified.promise.then(() => undefined)))));
     expect(result.current.step).toBe('link');
     expect(result.current.resendSeconds).toBe(60);
 
@@ -288,12 +331,12 @@ describe('useUserProfileAddEmailController', () => {
       useUserProfileAddEmailController({ reverification: idleReverification }),
     );
 
-    act(() => result.current.onVerifyEmail(other, email));
+    await act(() => result.current.onVerifyEmail(other, email));
     await waitFor(() => expect(result.current.step).toBe('link'));
     act(() => result.current.onOpenChange(false));
     expect(cancel).toHaveBeenCalledOnce();
 
-    act(() => result.current.onVerifyEmail(other, email));
+    await act(() => result.current.onVerifyEmail(other, email));
     await waitFor(() => expect(result.current.step).toBe('link'));
     unmount();
     expect(cancel).toHaveBeenCalledTimes(2);
@@ -303,7 +346,7 @@ describe('useUserProfileAddEmailController', () => {
     const email = verifier(sentLink(Promise.reject(saveError('Link expired'))));
     const { result } = renderHook(() => useUserProfileAddEmailController({ reverification: idleReverification }));
 
-    act(() => result.current.onVerifyEmail(other, email));
+    await act(() => result.current.onVerifyEmail(other, email));
     await waitFor(() => expect(result.current.errorMessage).toBe('Link expired'));
     expect(result.current.step).toBe('link');
     expect(result.current.open).toBe(true);
@@ -314,7 +357,7 @@ describe('useUserProfileAddEmailController', () => {
     const email = verifier(() => ({ method: 'sso', connect }));
     const { result } = renderHook(() => useUserProfileAddEmailController({ reverification: idleReverification }));
 
-    act(() => result.current.onVerifyEmail({ id: 'email_3', value: 'person@acme.co' }, email));
+    await act(() => result.current.onVerifyEmail({ id: 'email_3', value: 'person@acme.co' }, email));
     expect(result.current.step).toBe('sso');
     expect(result.current.resendSeconds).toBe(0);
 
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.dialog.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.dialog.test.tsx
index edf4f8d4a05..d4c39e6c991 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.dialog.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-add-email.dialog.test.tsx
@@ -213,6 +213,17 @@ describe('UserProfileAddEmailDialog', () => {
     await user.click(screen.getByRole('button', { name: 'Didn’t receive a link? Resend' }));
     expect(props.onResend).toHaveBeenCalledOnce();
 
+    rerender(
+      <MosaicProvider>
+        <UserProfileAddEmailDialog
+          {...props}
+          resendSeconds={0}
+          isResending
+        />
+      </MosaicProvider>,
+    );
+    expect(screen.getByRole('button', { name: 'Sending link…' })).toBeDisabled();
+
     await user.click(screen.getByRole('button', { name: 'Cancel' }));
     expect(props.onOpenChange).toHaveBeenCalledWith(false, expect.anything());
   });
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-actions.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-actions.test.tsx
index 610b4c8b0d4..15b138fe34b 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-actions.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-actions.test.tsx
@@ -13,7 +13,8 @@ import type { ReadyEmailSectionModel } from '../user-profile-email-section.types
 import { UserProfileEmailSectionView } from '../user-profile-email-section.view';
 
 const codeVerifier = {
-  start: () => ({ method: 'code', sent: Promise.resolve() }) as const,
+  prepare: async () => ({ method: 'code' }) as const,
+  cancel: () => {},
   verifyCode: () => Promise.resolve(),
 };
 
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-section.feature.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-section.feature.test.tsx
index 5086ae72501..57d6fda68f5 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-section.feature.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/__tests__/user-profile-email-section.feature.test.tsx
@@ -82,22 +82,73 @@ describe('the user profile email section', () => {
     expect(emailRow()).not.toHaveTextContent('Unverified');
   });
 
-  it('holds the code field until the code has been sent', async () => {
+  it('keeps Continue pending until the code has been sent', async () => {
     const { actor } = await renderSection(signedInWithEmails([]));
     const prepare = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+    try {
+      await actor.click(screen.getByRole('button', { name: 'Add email' }));
+      await actor.type(screen.getByRole('textbox', { name: 'Email' }), 'new@example.com');
+      await actor.click(screen.getByRole('button', { name: 'Continue' }));
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+
+      expect(screen.getByRole('button', { name: 'Continue' })).toHaveAttribute('aria-busy', 'true');
+      expect(screen.getByRole('textbox', { name: 'Email' })).toBeVisible();
+      expect(screen.queryByRole('textbox', { name: 'Verification code' })).not.toBeInTheDocument();
+
+      prepare.release();
+      await enterCode(actor, VERIFICATION_CODE);
+
+      await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument());
+      expect(emailsListed()).toEqual(['new@example.com']);
+    } finally {
+      prepare.release();
+    }
+  });
 
-    await actor.click(screen.getByRole('button', { name: 'Add email' }));
-    await actor.type(screen.getByRole('textbox', { name: 'Email' }), 'new@example.com');
-    await actor.click(screen.getByRole('button', { name: 'Continue' }));
-    await waitFor(() => expect(prepare.requests).toHaveLength(1));
-
-    expect(await screen.findByRole('textbox', { name: 'Verification code' })).toHaveAttribute('aria-disabled', 'true');
-
-    prepare.release();
-    await enterCode(actor, VERIFICATION_CODE);
+  it('keeps existing email Verify pending until code preparation succeeds', async () => {
+    const pending = fapiEmailAddress({ id: 'idn_pending', email_address: 'pending@example.com' });
+    const { actor } = await renderSection(signedInWithEmails([PRIMARY, pending]));
+    const prepare = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+    try {
+      await manageEmail(actor, 'pending@example.com', 'Verify');
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+      expect(screen.getByRole('button', { name: 'Add email' })).toBeDisabled();
+      expect(within(emailRow()).getByText('pending@example.com')).toBeVisible();
+      expect(screen.queryByRole('dialog')).toBeNull();
+      prepare.release();
+      await screen.findByRole('dialog');
+      await waitFor(() => expect(screen.getByRole('textbox', { name: 'Verification code' })).toHaveFocus());
+    } finally {
+      prepare.release();
+    }
+  });
 
-    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument());
-    expect(emailsListed()).toEqual(['new@example.com']);
+  it('retries failed code preparation from the entry form without another email', async () => {
+    const { actor, fapi } = await renderSection(signedInWithEmails([]));
+    const prepare = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+    try {
+      await actor.click(screen.getByRole('button', { name: 'Add email' }));
+      await actor.type(screen.getByRole('textbox', { name: 'Email' }), 'new@example.com');
+      await actor.click(screen.getByRole('button', { name: 'Continue' }));
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+      prepare.fail('action_blocked');
+      await waitFor(() =>
+        expect(screen.getByRole('button', { name: 'Continue' })).not.toHaveAttribute('aria-busy', 'true'),
+      );
+      expect(screen.getByRole('textbox', { name: 'Email' })).toHaveValue('new@example.com');
+      const retry = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+      try {
+        await actor.click(screen.getByRole('button', { name: 'Continue' }));
+        await waitFor(() => expect(retry.requests).toHaveLength(1));
+        expect(fapi.client.sessions[0]?.user.email_addresses).toHaveLength(1);
+        retry.release();
+        expect(await screen.findByRole('textbox', { name: 'Verification code' })).toBeVisible();
+      } finally {
+        retry.release();
+      }
+    } finally {
+      prepare.release();
+    }
   });
 
   it('verifies an address left unverified', async () => {
@@ -325,7 +376,7 @@ describe('email reverification', () => {
     );
   });
 
-  it('waits for a verification factor before opening the dialog', async () => {
+  it('keeps the profile visible until primary-action verification is ready', async () => {
     const second = fapiEmailAddress({ id: 'idn_second', email_address: 'bob@example.com', verification: VERIFIED });
     const { actor } = await renderSection({
       ...signedInWithEmails([PRIMARY, second]),
@@ -334,12 +385,61 @@ describe('email reverification', () => {
     demandReverificationOnce('/v1/me');
     const start = holdRequests('post', '/v1/client/sessions/:id/verify');
 
-    await manageEmail(actor, 'bob@example.com', 'Set as primary');
-    await waitFor(() => expect(start.requests).toHaveLength(1));
-    expect(screen.queryByRole('dialog')).toBeNull();
+    try {
+      await manageEmail(actor, 'bob@example.com', 'Set as primary');
+      await waitFor(() => expect(start.requests).toHaveLength(1));
+      expect(within(emailRow()).getByText('bob@example.com')).toBeVisible();
+      expect(screen.queryByRole('dialog')).toBeNull();
+      start.release();
+      await waitFor(() => expect(screen.getByLabelText('Password')).toHaveFocus());
+    } finally {
+      start.release();
+    }
+  });
 
-    start.release();
-    expect(await screen.findByText('Enter your current password to continue')).toBeVisible();
+  it('shows the section error when the primary action fails after closing the menu', async () => {
+    const second = fapiEmailAddress({ id: 'idn_second', email_address: 'bob@example.com', verification: VERIFIED });
+    const { actor } = await renderSection(signedInWithEmails([PRIMARY, second]));
+    const mutation = holdRequests('post', '/v1/me');
+    const trigger = within(emailRow()).getByRole('button', { name: 'Manage bob@example.com' });
+
+    try {
+      await manageEmail(actor, 'bob@example.com', 'Set as primary');
+      await waitFor(() => expect(mutation.requests).toHaveLength(1));
+      mutation.fail('action_blocked', 'Unable to set primary address.');
+      await waitFor(() =>
+        expect(within(emailRow()).getByRole('alert')).toHaveTextContent("This action couldn't be completed."),
+      );
+      await openMenu(actor, trigger);
+      expect(screen.getByRole('menuitem', { name: 'Set as primary' })).not.toHaveAttribute('aria-disabled');
+    } finally {
+      mutation.release();
+    }
+  });
+
+  it('replaces a failed verify error with a later primary action error', async () => {
+    const pending = fapiEmailAddress({ id: 'idn_pending', email_address: 'pending@example.com' });
+    const second = fapiEmailAddress({ id: 'idn_second', email_address: 'bob@example.com', verification: VERIFIED });
+    const { actor } = await renderSection(signedInWithEmails([PRIMARY, pending, second]));
+    const prepare = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+    const mutation = holdRequests('post', '/v1/me');
+
+    try {
+      await manageEmail(actor, 'pending@example.com', 'Verify');
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+      prepare.fail('too_many_requests', 'Too many requests.');
+      await waitFor(() => expect(within(emailRow()).getByRole('alert')).toHaveTextContent('Too many requests.'));
+
+      await manageEmail(actor, 'bob@example.com', 'Set as primary');
+      await waitFor(() => expect(mutation.requests).toHaveLength(1));
+      mutation.fail('action_blocked', 'Unable to set primary address.');
+      await waitFor(() =>
+        expect(within(emailRow()).getByRole('alert')).toHaveTextContent("This action couldn't be completed."),
+      );
+    } finally {
+      prepare.release();
+      mutation.release();
+    }
   });
 
   it('focuses Close when the dialog opens on a verification that could not start', async () => {
@@ -370,6 +470,53 @@ describe('email reverification', () => {
     await actor.click(screen.getByRole('button', { name: 'Continue' }));
   }
 
+  it('holds password confirmation until email code preparation finishes', async () => {
+    const { actor } = await renderSection(challengedSeed());
+    demandReverificationOnce('/v1/me/email_addresses');
+    const prepare = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+
+    try {
+      await beginAdd(actor);
+      await actor.type(await screen.findByPlaceholderText('Enter your password'), 'hunter2{Enter}');
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+
+      expect(screen.getByLabelText('Password')).toBeVisible();
+      expect(screen.getByRole('button', { name: 'Continue' })).toHaveAttribute('aria-busy', 'true');
+      expect(screen.queryByRole('textbox', { name: 'Email' })).toBeNull();
+      expect(screen.queryByRole('button', { name: 'Close' })).toBeNull();
+      await actor.keyboard('{Escape}{Enter}');
+      expect(screen.getByRole('dialog')).toBeVisible();
+      expect(prepare.requests).toHaveLength(1);
+
+      prepare.release();
+      const input = await screen.findByRole('textbox', { name: 'Verification code' });
+      await waitFor(() => expect(input).not.toHaveAttribute('aria-disabled'));
+      expect(input).toBeVisible();
+    } finally {
+      prepare.release();
+    }
+  });
+
+  it('returns to the email form after preparation fails', async () => {
+    const { actor } = await renderSection(challengedSeed());
+    demandReverificationOnce('/v1/me/email_addresses');
+    const prepare = holdRequests('post', '/v1/me/email_addresses/:id/prepare_verification');
+
+    try {
+      await beginAdd(actor);
+      await actor.type(await screen.findByPlaceholderText('Enter your password'), 'hunter2{Enter}');
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+      expect(screen.getByLabelText('Password')).toBeVisible();
+      prepare.fail('form_param_invalid', 'Could not send code.', 'email_address');
+
+      const input = await screen.findByRole('textbox', { name: 'Email' });
+      await waitFor(() => expect(input).toHaveFocus());
+      await waitFor(() => expect(input).toHaveAccessibleDescription('Could not send code.'));
+    } finally {
+      prepare.release();
+    }
+  });
+
   it('confirms it is the user before an email address is added, then verifies its code', async () => {
     const { actor, fapi } = await renderSection(challengedSeed());
     demandReverificationOnce('/v1/me/email_addresses');
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.controller.ts b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.controller.ts
index 5b48368eb39..fdf483fdaf9 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.controller.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.controller.ts
@@ -1,11 +1,11 @@
-import { useEffect, useMemo } from 'react';
+import { useEffect, useMemo, useRef } from 'react';
 
 import type { DialogHandle } from '../../../components/dialog';
 import { Dialog } from '../../../components/dialog';
 import { useForm } from '../../../components/form';
 import { useErrorText } from '../../../localization';
 import { setup } from '../../../machine/setup';
-import type { ErrorInvokeEvent } from '../../../machine/types';
+import type { DoneInvokeEvent, ErrorInvokeEvent } from '../../../machine/types';
 import { useMachine } from '../../../machine/use-machine';
 import type { FormError } from '../../../utils/errors';
 import { toFormError } from '../../../utils/errors';
@@ -29,7 +29,7 @@ export interface UserProfileAddEmailControllerOptions {
 export interface UserProfileAddEmailController extends UserProfileAddEmailDialogProps {
   handle: DialogHandle<unknown>;
   verifyingId: string | undefined;
-  onVerifyEmail: (email: Pick<UserProfileEmail, 'id' | 'value'>, verifier: UserProfileEmailVerifier) => void;
+  onVerifyEmail: (email: Pick<UserProfileEmail, 'id' | 'value'>, verifier: UserProfileEmailVerifier) => Promise<void>;
 }
 
 interface Context {
@@ -43,7 +43,13 @@ interface Context {
 
 type Event =
   | { type: 'ADD' }
-  | { type: 'START'; id?: string; emailAddress: string; verifier: UserProfileEmailVerifier }
+  | {
+      type: 'READY';
+      id?: string;
+      emailAddress: string;
+      verifier: UserProfileEmailVerifier;
+      verification: UserProfileEmailVerification;
+    }
   | { type: 'VERIFIED' }
   | { type: 'CANCEL' }
   | { type: 'CONNECT' }
@@ -62,19 +68,24 @@ const LINK_RESEND_SECONDS = 60;
 const tick = { actions: assign(context => ({ resendSeconds: Math.max(0, context.resendSeconds - 1) })) };
 const fail = assign<ErrorInvokeEvent>((_, event) => ({ error: toFormError(event.error) }));
 const resend = {
-  target: 'starting',
+  target: 'resending',
   guard: (context: Context) => context.resendSeconds === 0,
   actions: assign(() => ({ error: undefined })),
 };
-const start = {
-  target: 'starting',
-  actions: assign<Extract<Event, { type: 'START' }>>((_, event) => ({
+const ready = {
+  target: 'ready',
+  actions: assign<Extract<Event, { type: 'READY' }>>((_, event) => ({
     verifyingId: event.id,
     emailAddress: event.emailAddress,
     verifier: event.verifier,
-    verification: undefined,
+    verification: event.verification,
     error: undefined,
-    resendSeconds: 0,
+    resendSeconds:
+      event.verification.method === 'link'
+        ? LINK_RESEND_SECONDS
+        : event.verification.method === 'code'
+          ? CODE_RESEND_SECONDS
+          : 0,
   })),
 };
 
@@ -102,36 +113,37 @@ const machine = createMachine({
             resendSeconds: 0,
           })),
         },
-        START: start,
+        READY: ready,
       },
     },
     email: {
-      on: { CANCEL: 'idle', START: start },
+      on: { CANCEL: 'idle', READY: ready },
     },
-    starting: {
-      entry: assign(context => ({
-        verification: context.verifier ? context.verifier.start() : undefined,
-        error: undefined,
-      })),
-      always: ({ context }) => {
-        const method = context.verification?.method;
-        if (method === 'code') {
-          return { target: 'sending' };
-        }
-        if (method === 'sso') {
-          return { target: 'connecting' };
-        }
-        return { target: 'waiting', context: { resendSeconds: method === 'link' ? LINK_RESEND_SECONDS : 0 } };
-      },
+    ready: {
+      always: ({ context }) => ({
+        target:
+          context.verification?.method === 'code'
+            ? 'verify'
+            : context.verification?.method === 'sso'
+              ? 'connecting'
+              : 'waiting',
+      }),
     },
-    sending: {
-      invoke: fromPromise(
-        context => (context.verification?.method === 'code' ? context.verification.sent : missingDependency()),
-        {
-          onDone: { target: 'verify', actions: assign(() => ({ resendSeconds: CODE_RESEND_SECONDS })) },
-          onError: { target: 'verify', actions: fail },
+    resending: {
+      on: { CANCEL: { target: 'idle', guard: context => context.verification?.method === 'link' } },
+      invoke: fromPromise(context => (context.verifier ? context.verifier.prepare() : missingDependency()), {
+        onDone: {
+          target: 'ready',
+          actions: assign<DoneInvokeEvent<UserProfileEmailVerification>>((_, event) => ({
+            verification: event.output,
+            resendSeconds: event.output.method === 'link' ? LINK_RESEND_SECONDS : CODE_RESEND_SECONDS,
+          })),
         },
-      ),
+        onError: [
+          { target: 'linkFailed', guard: context => context.verification?.method === 'link', actions: fail },
+          { target: 'verify', actions: fail },
+        ],
+      }),
     },
     waiting: {
       on: { CANCEL: 'idle', TICK: tick, RESEND: resend },
@@ -139,10 +151,13 @@ const machine = createMachine({
         context => (context.verification?.method === 'link' ? context.verification.verified : missingDependency()),
         {
           onDone: 'idle',
-          onError: { actions: fail },
+          onError: { target: 'linkFailed', actions: fail },
         },
       ),
     },
+    linkFailed: {
+      on: { CANCEL: 'idle', TICK: tick, RESEND: resend },
+    },
     connecting: {
       on: { CANCEL: 'idle', CONNECT: 'redirecting' },
     },
@@ -172,13 +187,33 @@ export function useUserProfileAddEmailController({
   const errorText = useErrorText();
   const handle = useMemo(() => Dialog.createHandle(), []);
   const [snapshot, send, actor] = useMachine(machine);
+  const activeVerifier = useRef<UserProfileEmailVerifier>(undefined);
+  const created = useRef<{ value: string; verifier: UserProfileEmailVerifier }>(undefined);
+  const generation = useRef(0);
+  useEffect(() => {
+    return () => {
+      activeVerifier.current?.cancel();
+    };
+  }, []);
   const { resendSeconds, error, verification } = snapshot.context;
   const emailForm = useForm({
     initialValues: { emailAddress: initialEmailAddress },
     canSubmit: values => values.emailAddress !== '' && values.emailAddress !== username,
     onSubmit: async ({ emailAddress }) => {
       if (onCreate) {
-        send({ type: 'START', emailAddress, verifier: await onCreate(emailAddress) });
+        if (created.current?.value !== emailAddress) {
+          const verifier = await onCreate(emailAddress);
+          if (actor.getSnapshot().status !== 'active') {
+            return;
+          }
+          created.current = { value: emailAddress, verifier };
+        }
+        const { verifier } = created.current;
+        activeVerifier.current = verifier;
+        const verification = await verifier.prepare();
+        if (actor.getSnapshot().status === 'active') {
+          send({ type: 'READY', emailAddress, verifier, verification });
+        }
       }
     },
   });
@@ -214,7 +249,7 @@ export function useUserProfileAddEmailController({
   return {
     handle,
     resendSeconds,
-    isResending: state === 'sending',
+    isResending: state === 'resending',
     open,
     step,
     reverification,
@@ -231,11 +266,17 @@ export function useUserProfileAddEmailController({
         }
         reverification.onCancel();
       }
+      if (actor.getSnapshot().value === 'resending' && verification?.method !== 'link') {
+        return;
+      }
+      generation.current++;
       if (open) {
+        created.current = undefined;
         emailForm.reset();
         codeForm.reset();
         send({ type: 'ADD' });
       } else {
+        activeVerifier.current?.cancel();
         send({ type: 'CANCEL' });
       }
     },
@@ -260,9 +301,23 @@ export function useUserProfileAddEmailController({
     },
     onConnect: () => send({ type: 'CONNECT' }),
     verifyingId: snapshot.context.verifyingId,
-    onVerifyEmail: (email, verifier) => {
-      codeForm.reset();
-      send({ type: 'START', id: email.id, emailAddress: email.value, verifier });
+    onVerifyEmail: async (email, verifier) => {
+      if (actor.getSnapshot().value !== 'idle') {
+        return;
+      }
+      const started = generation.current;
+      activeVerifier.current = verifier;
+      const verification = await verifier.prepare();
+      if (
+        actor.getSnapshot().status === 'active' &&
+        generation.current === started &&
+        actor.getSnapshot().value === 'idle'
+      ) {
+        codeForm.reset();
+        send({ type: 'READY', id: email.id, emailAddress: email.value, verifier, verification });
+      } else {
+        verifier.cancel();
+      }
     },
   };
 }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.dialog.tsx b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.dialog.tsx
index a54f6f89993..3dd1234367b 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.dialog.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.dialog.tsx
@@ -1,7 +1,7 @@
 import { useMergeRefs } from '@floating-ui/react';
 import * as stylex from '@stylexjs/stylex';
 import type { FormEvent, Ref } from 'react';
-import { useId, useRef } from 'react';
+import { useId, useRef, useState } from 'react';
 
 import { Button, SubmitButton } from '../../../components/button';
 import { Card } from '../../../components/card';
@@ -52,18 +52,24 @@ export interface UserProfileAddEmailDialogProps {
 export function UserProfileAddEmailDialog(props: UserProfileAddEmailDialogProps) {
   const emailRef = useRef<HTMLInputElement>(null);
   const codeRef = useRef<HTMLInputElement>(null);
+  const [lastShownStep, setLastShownStep] = useState(props.step);
+  const step =
+    props.open && props.isPending && props.step === 'email' && lastShownStep === 'reverify' ? 'reverify' : props.step;
+  if (step !== lastShownStep) {
+    setLastShownStep(step);
+  }
 
   return (
     <Dialog.Root
       handle={props.handle}
       open={props.open}
       onOpenChange={props.onOpenChange}
-      shouldCloseOnInteractOutside={props.step !== 'reverify'}
-      showCloseButton={props.step !== 'reverify' || Boolean(props.reverification.onCancel)}
+      shouldCloseOnInteractOutside={step !== 'reverify'}
+      showCloseButton={step !== 'reverify' || Boolean(props.reverification.onCancel)}
     >
       <Dialog.Popup
         variant='card'
-        initialFocus={props.step === 'email' ? emailRef : props.step === 'verify' ? codeRef : undefined}
+        initialFocus={step === 'email' ? emailRef : step === 'verify' ? codeRef : undefined}
         finalFocus={props.finalFocus}
       >
         <Card.Root
@@ -71,7 +77,7 @@ export function UserProfileAddEmailDialog(props: UserProfileAddEmailDialogProps)
           renderBranding={false}
         >
           <Flow.Root
-            value={props.step}
+            value={step}
             state={props}
           >
             {current => (
@@ -97,6 +103,7 @@ export function UserProfileAddEmailDialog(props: UserProfileAddEmailDialogProps)
                   <VerifyLinkStep
                     emailAddress={current.emailAddress}
                     onResend={current.onResend}
+                    isResending={current.isResending}
                     errorMessage={current.errorMessage}
                     resendSeconds={current.resendSeconds}
                   />
@@ -296,6 +303,7 @@ function VerifyEmailStep(props: VerifyEmailStepProps) {
 }
 
 interface VerifyLinkStepProps {
+  isResending?: boolean;
   emailAddress: string;
   onResend: () => void;
   errorMessage?: string;
@@ -322,6 +330,7 @@ function VerifyLinkStep(props: VerifyLinkStepProps) {
         ) : null}
         <ResendButton
           labels={m.link}
+          isResending={props.isResending}
           onResend={props.onResend}
           resendSeconds={props.resendSeconds}
         />
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.messages.ts b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.messages.ts
index ac0bcf3bd32..b4171e14b71 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.messages.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-add-email.messages.ts
@@ -23,6 +23,7 @@ export const userProfileAddEmailMessages = {
     description: 'Open the link we sent to {emailAddress}',
     cancel: 'Cancel',
     resend: 'Didn’t receive a link? Resend',
+    resending: 'Sending link…',
     resendCountdown: 'Didn’t receive a link? Resend ({seconds})',
   },
   sso: {
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.controller.ts b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.controller.ts
index 822bdeca9b9..1358c1a2a8a 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.controller.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.controller.ts
@@ -24,6 +24,7 @@ export function useUserProfileEmailSectionController({
     reverification: createReverification,
   });
   const setPrimary = usePendingAction();
+  const verify = usePendingAction();
   const rowRef = useRef<HTMLDivElement>(null);
   const removalFocus = useListRemovalFocus({
     ids: emails.map(email => email.id),
@@ -39,7 +40,8 @@ export function useUserProfileEmailSectionController({
     emails,
     canAdd: Boolean(onCreateEmail),
     verification,
-    error: setPrimary.error,
+    error: verify.error ?? setPrimary.error,
+    pendingVerifyId: verify.pendingKey,
     rowRef,
     registerTrigger: removalFocus.registerTrigger,
     remove: onRemoveEmail ? remove : undefined,
@@ -50,9 +52,13 @@ export function useUserProfileEmailSectionController({
     onVerify: id => {
       const email = emails.find(email => email.id === id);
       if (email) {
-        verification.onVerifyEmail(email, getEmailVerifier(id));
+        setPrimary.reset();
+        void verify.run(id, () => verification.onVerifyEmail(email, getEmailVerifier(id)));
       }
     },
-    onSetPrimary: id => void setPrimary.run(id, () => onSetPrimaryEmail(id)),
+    onSetPrimary: id => {
+      verify.reset();
+      void setPrimary.run(id, () => onSetPrimaryEmail(id));
+    },
   };
 }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.model.ts b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.model.ts
index d72a5ef20b6..c50b9bd4ad2 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.model.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.model.ts
@@ -28,12 +28,11 @@ function verifyRedirectUrl(userProfileUrl: string): string {
   return buildURL({ base: userProfileUrl, hashPath: '/verify' }, { stringify: true });
 }
 
-function startEmailVerification(
-  email: EmailAddressResource,
-  linkRedirectUrl: string | undefined,
+async function prepareEmailVerification(
+  currentEmail: () => EmailAddressResource,
   router: MosaicRouter,
-): UserProfileEmailVerification {
-  if (email.matchesSsoConnection) {
+): Promise<UserProfileEmailVerification> {
+  if (currentEmail().matchesSsoConnection) {
     return {
       method: 'sso',
       /*
@@ -48,7 +47,7 @@ function startEmailVerification(
       */
       connect: () =>
         save(async () => {
-          const prepared = await email.prepareVerification({
+          const prepared = await currentEmail().prepareVerification({
             strategy: 'enterprise_sso',
             redirectUrl: window.location.href,
           });
@@ -60,25 +59,28 @@ function startEmailVerification(
         }),
     };
   }
-  if (linkRedirectUrl === undefined) {
-    return { method: 'code', sent: save(() => email.prepareVerification({ strategy: 'email_code' })) };
-  }
-  const { startEmailLinkFlow, cancelEmailLinkFlow } = email.createEmailLinkFlow();
-  return {
-    method: 'link',
-    verified: save(() => startEmailLinkFlow({ redirectUrl: linkRedirectUrl })),
-    cancel: cancelEmailLinkFlow,
-  };
+  await save(() => currentEmail().prepareVerification({ strategy: 'email_code' }));
+  currentEmail();
+  return { method: 'code' };
 }
 
 function toEmailVerifier(
-  email: EmailAddressResource,
+  currentEmail: () => EmailAddressResource,
   linkRedirectUrl: string | undefined,
   router: MosaicRouter,
 ): UserProfileEmailVerifier {
+  const linkFlow = linkRedirectUrl === undefined ? undefined : currentEmail().createEmailLinkFlow();
   return {
-    start: () => startEmailVerification(email, linkRedirectUrl, router),
-    verifyCode: code => save(() => email.attemptVerification({ code }), ADD_EMAIL_FIELDS),
+    prepare: async () => {
+      if (linkFlow && linkRedirectUrl && !currentEmail().matchesSsoConnection) {
+        linkFlow.cancelEmailLinkFlow();
+        const verified = save(() => linkFlow.startEmailLinkFlow({ redirectUrl: linkRedirectUrl }));
+        return { method: 'link' as const, verified, cancel: linkFlow.cancelEmailLinkFlow };
+      }
+      return prepareEmailVerification(currentEmail, router);
+    },
+    cancel: () => linkFlow?.cancelEmailLinkFlow(),
+    verifyCode: code => save(() => currentEmail().attemptVerification({ code }), ADD_EMAIL_FIELDS),
   };
 }
 
@@ -113,7 +115,8 @@ export function useUserProfileEmailSectionModel(): UserProfileEmailSectionModel
 
   const verifiesByLink = Boolean(attributes.email_address?.verifications.includes('email_link'));
   const linkRedirectUrl = verifiesByLink ? verifyRedirectUrl(environment.displayConfig.userProfileUrl) : undefined;
-  const verifierFor = (email: EmailAddressResource) => toEmailVerifier(email, linkRedirectUrl, router);
+  const verifierFor = (email: EmailAddressResource) =>
+    toEmailVerifier(() => byId(currentUser().emailAddresses, email.id, 'email address'), linkRedirectUrl, router);
 
   return {
     status: 'ready',
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.types.ts b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.types.ts
index 1b4985b0644..eafa33577aa 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.types.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.types.ts
@@ -18,6 +18,7 @@ export interface UserProfileEmailSectionViewProps {
   verificationFinalFocus: DialogFocusTarget;
   setPrimaryReverification: ReverificationController;
   setPrimaryFinalFocus: DialogFocusTarget;
+  pendingVerifyId?: string;
   onVerify: (id: string) => void;
   onSetPrimary: (id: string) => void;
 }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.view.tsx
index 11c03774c45..e25f7de94c9 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-email-section/user-profile-email-section.view.tsx
@@ -22,6 +22,7 @@ export function UserProfileEmailSectionView({
   verificationFinalFocus,
   setPrimaryReverification,
   setPrimaryFinalFocus,
+  pendingVerifyId,
   onVerify,
   onSetPrimary,
 }: UserProfileEmailSectionViewProps) {
@@ -32,6 +33,7 @@ export function UserProfileEmailSectionView({
       render={
         <Button
           aria-label={m.email.add}
+          disabled={pendingVerifyId !== undefined}
           color='neutral'
           size='sm'
           variant='outline'
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-interactions.feature.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-interactions.feature.test.tsx
index 8afba0590d5..04a507a05b8 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-interactions.feature.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-interactions.feature.test.tsx
@@ -45,8 +45,8 @@ describe('User profile MFA interaction boundaries', () => {
     await user.click(screen.getByRole('button', { name: 'Add verification method' }));
     await user.click(screen.getByRole('button', { name: /Authenticator app/ }));
     await waitFor(() => expect(screen.getByRole('alert')).toHaveTextContent('Please try again.'));
-    const retry = screen.getByRole('button', { name: 'Try again' });
-    await waitFor(() => expect(retry).toHaveFocus());
+    const retry = screen.getByRole('button', { name: /Authenticator app/ });
+    expect(retry).toBeEnabled();
     await user.click(retry);
     expect(await screen.findByRole('img', { name: /QR code/i })).toBeVisible();
     const code = screen.getByRole('textbox', { name: 'Verification code' });
@@ -74,7 +74,7 @@ describe('User profile MFA interaction boundaries', () => {
     expect(fapi.mfa.totpCreations).toBe(1);
   });
 
-  it('disables Back while authenticator preparation is pending', async () => {
+  it('disables method choices and prevents duplicate authenticator preparation', async () => {
     await renderMfa();
     const held = holdRequests('post', '/v1/me/totp');
     const user = userEvent.setup();
@@ -83,9 +83,12 @@ describe('User profile MFA interaction boundaries', () => {
     await waitFor(() => expect(held.requests).toHaveLength(1));
     try {
       await waitFor(() => {
-        expect(screen.getByRole('status', { name: 'Preparing authenticator…' })).toBeVisible();
-        expect(screen.getByRole('button', { name: 'Back' })).toBeDisabled();
+        expect(screen.getByRole('button', { name: /Authenticator app/ })).toHaveAttribute('aria-busy', 'true');
+        expect(screen.getByRole('button', { name: /Authenticator app/ })).toBeDisabled();
+        expect(screen.getByRole('button', { name: /SMS verification/ })).toBeDisabled();
       });
+      await user.click(screen.getByRole('button', { name: /Authenticator app/ }));
+      expect(held.requests).toHaveLength(1);
     } finally {
       held.release();
     }
@@ -202,9 +205,39 @@ describe('User profile MFA interaction boundaries', () => {
     await waitFor(() => expect(screen.getByRole('alert')).toHaveTextContent('Please try again.'));
     expect(screen.queryByRole('button', { name: 'Copy and close' })).toBeNull();
     expect(screen.queryByRole('button', { name: 'Download' })).toBeNull();
-    const retry = screen.getByRole('button', { name: 'Try again' });
-    await waitFor(() => expect(retry).toHaveFocus());
+    const retry = screen.getByRole('button', { name: /Backup codes/ });
+    expect(retry).toBeEnabled();
+    const held = holdRequests('post', '/v1/me/backup_codes/');
     await user.click(retry);
+    await waitFor(() => expect(held.requests).toHaveLength(1));
+    try {
+      expect(retry).toBeDisabled();
+      expect(retry).toHaveAttribute('aria-busy', 'true');
+      expect(screen.queryByRole('list', { name: 'Backup codes' })).toBeNull();
+      await user.click(retry);
+      expect(held.requests).toHaveLength(1);
+    } finally {
+      held.release();
+    }
+    expect(await screen.findByText('CODE0100')).toBeVisible();
+  });
+
+  it('keeps the selected backup choice while the account refresh completes', async () => {
+    await renderMfa(fapiUser({ id: 'user_1', totp_enabled: true, two_factor_enabled: true }));
+    const user = userEvent.setup();
+    await user.click(screen.getByRole('button', { name: 'Add verification method' }));
+    const held = holdRequests('get', '/v1/me');
+    await user.click(screen.getByRole('button', { name: /Backup codes/ }));
+    await waitFor(() => expect(held.requests).toHaveLength(1));
+    try {
+      expect(within(screen.getByRole('dialog')).getByRole('button', { name: /Backup codes/ })).toHaveAttribute(
+        'aria-busy',
+        'true',
+      );
+      expect(screen.queryByRole('list', { name: 'Backup codes' })).toBeNull();
+    } finally {
+      held.release();
+    }
     expect(await screen.findByText('CODE0100')).toBeVisible();
   });
 
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-management.feature.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-management.feature.test.tsx
index 059eecc91c5..e0970fdfc37 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-management.feature.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa-management.feature.test.tsx
@@ -1,4 +1,4 @@
-import { screen, waitFor, within } from '@testing-library/react';
+import { act, screen, waitFor, within } from '@testing-library/react';
 import userEvent from '@testing-library/user-event';
 import { http, HttpResponse } from 'msw';
 import { describe, expect, it, vi } from 'vitest';
@@ -355,7 +355,7 @@ describe('User profile MFA management', () => {
     expect(clerk.user?.id).toBe('user_2');
   });
 
-  it('opens the backup-code surface while regeneration is pending', async () => {
+  it('keeps the profile visible until regenerated backup codes are ready', async () => {
     await renderMfa(
       fapiUser({ id: 'user_1', totp_enabled: true, backup_code_enabled: true, two_factor_enabled: true }),
     );
@@ -364,15 +364,13 @@ describe('User profile MFA management', () => {
     await openMenu(user, screen.getByRole('button', { name: 'Manage Backup codes' }));
     await user.click(screen.getByRole('menuitem', { name: 'Regenerate' }));
     await waitFor(() => expect(held.requests).toHaveLength(1));
-    await waitFor(() => expect(screen.getByRole('status', { name: 'Generating backup codes' })).toBeVisible());
-    for (const name of ['Print', 'Download']) {
-      expect(screen.getByRole('button', { name })).toBeVisible();
-      expect(screen.getByRole('button', { name })).toBeDisabled();
+    try {
+      expect(screen.queryByRole('dialog')).toBeNull();
+      expect(screen.getByRole('button', { name: 'Add verification method' })).toBeDisabled();
+      expect(screen.getByRole('button', { name: 'Manage Backup codes' })).toBeVisible();
+    } finally {
+      held.release();
     }
-    expect(screen.getByRole('button', { name: 'Copy and close' })).toBeVisible();
-    expect(screen.getByRole('button', { name: 'Copy and close' })).toHaveAttribute('aria-disabled', 'true');
-    expect(screen.queryByRole('button', { name: 'Close' })).toBeNull();
-    held.release();
     await waitFor(() => expect(screen.getByText('CODE0100')).toBeVisible());
     expect(screen.getByRole('button', { name: 'Close' })).toBeVisible();
     for (const name of ['Print', 'Download', 'Copy and close']) {
@@ -380,6 +378,32 @@ describe('User profile MFA management', () => {
     }
   });
 
+  it('returns failed regeneration to the section and retries from the menu', async () => {
+    const fapi = await renderMfa(
+      fapiUser({ id: 'user_1', totp_enabled: true, backup_code_enabled: true, two_factor_enabled: true }),
+    );
+    const handlers = worker.listHandlers();
+    const held = holdRequests('post', '/v1/me/backup_codes/');
+    const user = userEvent.setup();
+    const trigger = screen.getByRole('button', { name: 'Manage Backup codes' });
+    await openMenu(user, trigger);
+    await user.click(screen.getByRole('menuitem', { name: 'Regenerate' }));
+    await waitFor(() => expect(held.requests).toHaveLength(1));
+    held.fail('action_blocked', 'Unable to create backup codes.');
+    await waitFor(() =>
+      expect(screen.getByRole('alert')).toHaveTextContent(
+        "This action couldn't be completed. Please try again later or contact support if this persists.",
+      ),
+    );
+    expect(screen.queryByRole('dialog')).toBeNull();
+    await waitFor(() => expect(screen.queryByRole('menu')).toBeNull());
+    worker.resetHandlers(...handlers);
+    await openMenu(user, trigger);
+    await user.click(screen.getByRole('menuitem', { name: 'Regenerate' }));
+    expect(await screen.findByText('CODE0100')).toBeVisible();
+    expect(fapi.mfa.backupCodeCreations).toBe(1);
+  });
+
   it('uses fresh server codes for explicit regeneration', async () => {
     const fapi = await renderMfa(
       fapiUser({ id: 'user_1', totp_enabled: true, backup_code_enabled: true, two_factor_enabled: true }),
@@ -414,7 +438,21 @@ describe('User profile MFA management', () => {
 
     await regenerate(user);
     expect(await screen.findByText('Enter your current password to continue')).toBeVisible();
-    await user.type(screen.getByLabelText('Password'), 'hunter2{Enter}');
+    await waitFor(() => expect(screen.getByLabelText('Password')).toHaveFocus());
+    const refresh = holdRequests('get', '/v1/me');
+    try {
+      await user.keyboard('hunter2{Enter}');
+      await act(async () => {
+        await waitFor(() => expect(refresh.requests).toHaveLength(1));
+      });
+      await user.keyboard('{Escape}');
+      expect(screen.getByRole('dialog')).toHaveAttribute('data-open');
+      expect(screen.getByText('Enter your current password to continue')).toBeVisible();
+      expect(screen.queryByRole('button', { name: 'Close' })).toBeNull();
+      expect(screen.getByRole('button', { name: 'Continue' })).toHaveAttribute('aria-busy', 'true');
+    } finally {
+      refresh.release();
+    }
 
     const list = await screen.findByRole('list', { name: 'Backup codes' });
     expect(within(list).getAllByRole('listitem')).toHaveLength(10);
@@ -445,6 +483,7 @@ describe('User profile MFA management', () => {
     await regenerate(user);
     await screen.findByText('Enter your current password to continue');
     const dialog = screen.getByRole('dialog');
+    const handlers = worker.listHandlers();
     const replay = holdRequests('post', '/v1/me/backup_codes/');
     await user.type(screen.getByLabelText('Password'), 'hunter2{Enter}');
     await waitFor(() => expect(replay.requests).toHaveLength(1));
@@ -454,47 +493,53 @@ describe('User profile MFA management', () => {
     expect(dialog).toBeVisible();
 
     replay.fail('action_blocked', 'Unable to create backup codes.');
-    await waitFor(() => expect(within(screen.getByRole('dialog')).getByRole('alert')).toBeVisible());
+    await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull());
+    expect(screen.getByRole('alert')).toHaveTextContent(
+      "This action couldn't be completed. Please try again later or contact support if this persists.",
+    );
     expect(screen.queryByRole('list', { name: 'Backup codes' })).toBeNull();
     expect(fapi.mfa.backupCodeCreations).toBe(0);
+    worker.resetHandlers(...handlers);
+    await regenerate(user);
+    await screen.findByRole('list', { name: 'Backup codes' });
+    expect(fapi.mfa.backupCodeCreations).toBe(1);
   });
 
-  it('cancels a loading verification when the backup-code dialog closes so regeneration can start again', async () => {
+  it('keeps the profile visible until verification preparation is ready', async () => {
     const fapi = await renderBackupCodesNeedingReverification();
     const start = holdRequests('post', '/v1/client/sessions/:id/verify');
     const user = userEvent.setup();
 
     await regenerate(user);
     await waitFor(() => expect(start.requests).toHaveLength(1));
-    await user.click(within(screen.getByRole('dialog')).getByRole('button', { name: 'Close' }));
-    await waitFor(() => expect(screen.queryByRole('dialog')).toBeNull());
-    start.release();
-
-    await regenerate(user);
+    try {
+      expect(screen.queryByRole('dialog')).toBeNull();
+      expect(screen.getByRole('button', { name: 'Manage Backup codes' })).toBeVisible();
+    } finally {
+      start.release();
+    }
+    await screen.findByText('Enter your current password to continue');
+    await waitFor(() => expect(screen.getByRole('dialog')).toContainElement(document.activeElement));
+    await user.type(screen.getByLabelText('Password'), 'hunter2{Enter}');
     await screen.findByRole('list', { name: 'Backup codes' });
     expect(fapi.mfa.backupCodeCreations).toBe(1);
   });
 
-  it('keeps the backup-code dialog open until the first response so a verification can appear', async () => {
-    const fapi = await renderBackupCodesNeedingReverification();
+  it('keeps the profile visible until the first response can request verification', async () => {
+    await renderBackupCodesNeedingReverification();
     const first = holdRequests('post', '/v1/me/backup_codes/');
     const user = userEvent.setup();
 
     await regenerate(user);
     await waitFor(() => expect(first.requests).toHaveLength(1));
-    const dialog = screen.getByRole('dialog');
     try {
-      expect(within(dialog).queryByRole('button', { name: 'Close' })).toBeNull();
-      await user.keyboard('{Escape}');
-      expect(dialog).toBeVisible();
+      expect(screen.queryByRole('dialog')).toBeNull();
+      expect(screen.getByRole('button', { name: 'Manage Backup codes' })).toBeVisible();
     } finally {
       first.release();
     }
 
-    expect(await within(dialog).findByText('Enter your current password to continue')).toBeVisible();
-    await user.type(screen.getByLabelText('Password'), 'hunter2{Enter}');
-    await screen.findByRole('list', { name: 'Backup codes' });
-    expect(fapi.mfa.backupCodeCreations).toBe(1);
+    expect(await screen.findByText('Enter your current password to continue')).toBeVisible();
   });
 
   const startSms = async (user: ReturnType<typeof userEvent.setup>) => {
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa.feature.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa.feature.test.tsx
index 7c0bfc11bbc..ae581bee984 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa.feature.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/__tests__/user-profile-mfa.feature.test.tsx
@@ -221,7 +221,16 @@ describe('User profile MFA', () => {
     const user = userEvent.setup();
     await user.click(screen.getByRole('button', { name: 'Add verification method' }));
     await user.click(screen.getByRole('button', { name: /SMS verification/ }));
+    const held = holdRequests('post', '/v1/me/phone_numbers/phone_1/prepare_verification');
     await user.click(screen.getByRole('button', { name: 'Continue' }));
+    await waitFor(() => expect(held.requests).toHaveLength(1));
+    try {
+      expect(screen.getByRole('combobox', { name: /Phone number/ })).toBeVisible();
+      expect(screen.getByRole('button', { name: 'Continue' })).toHaveAttribute('aria-busy', 'true');
+      expect(screen.queryByRole('textbox', { name: 'Verification code' })).toBeNull();
+    } finally {
+      held.release();
+    }
     expect(await screen.findByRole('textbox', { name: 'Verification code' })).toBeVisible();
     expect(fapi.mfa.phonePreparations).toEqual(['phone_1']);
     expect(fapi.mfa.phoneUpdates).toEqual([]);
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-authenticator.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-authenticator.view.tsx
index e254f6673d1..0f03eaf342d 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-authenticator.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-authenticator.view.tsx
@@ -5,16 +5,13 @@ import { Card } from '../../../components/card';
 import { Field } from '../../../components/field';
 import { useFlowAutoFocus } from '../../../components/flow';
 import { Otp } from '../../../components/otp';
-import { Text } from '../../../components/text';
 import { useMessages } from '../../../localization';
 import { Form } from '../../../primitives/form';
 import { styles } from './user-profile-add-authenticator.styles';
 import { UserProfileAuthenticatorSetupView } from './user-profile-authenticator-setup.view';
 
 export interface UserProfileAddAuthenticatorViewProps {
-  setup?: { secret: string; uri: string };
-  setupErrorMessage?: string;
-  onRetry: () => void;
+  setup: { secret: string; uri: string };
   onBack: () => void;
   code: string;
   onCodeChange: (value: string) => void;
@@ -26,8 +23,6 @@ export interface UserProfileAddAuthenticatorViewProps {
 export function UserProfileAddAuthenticatorView({
   onBack,
   setup,
-  setupErrorMessage,
-  onRetry,
   code,
   onCodeChange,
   onSubmit,
@@ -35,76 +30,49 @@ export function UserProfileAddAuthenticatorView({
   errorMessage,
 }: UserProfileAddAuthenticatorViewProps) {
   const m = useMessages('userProfileAddAuthenticator');
-  const setupMessages = useMessages('userProfileAuthenticatorSetup');
   const formId = useId();
   const actionRef = useFlowAutoFocus<HTMLButtonElement>();
   const inputRef = useFlowAutoFocus<HTMLInputElement>();
   const submitCode = (value: string) => {
-    if (setup && !isPending && value.length === 6) {
+    if (!isPending && value.length === 6) {
       onSubmit(value);
     }
   };
 
   return (
     <>
-      {setup ? (
-        <UserProfileAuthenticatorSetupView {...setup} />
-      ) : (
-        <>
-          <Card.Header>
-            <Card.Title>{setupMessages.title}</Card.Title>
-          </Card.Header>
-          <Card.Banner
-            role='alert'
-            color='negative'
-          >
-            {setupErrorMessage}
-          </Card.Banner>
-          {setupErrorMessage ? null : (
-            <Card.Content>
-              <Text
-                role='status'
-                aria-label={m.preparing}
-              >
-                {m.preparing}
-              </Text>
-            </Card.Content>
-          )}
-        </>
-      )}
-      {setup ? (
-        <Card.Content
-          xstyle={styles.verification}
-          render={
-            <Form
-              id={formId}
-              onSubmit={event => {
-                event.preventDefault();
-                submitCode(code);
-              }}
-            />
-          }
+      <UserProfileAuthenticatorSetupView {...setup} />
+      <Card.Content
+        xstyle={styles.verification}
+        render={
+          <Form
+            id={formId}
+            onSubmit={event => {
+              event.preventDefault();
+              submitCode(code);
+            }}
+          />
+        }
+      >
+        <Field.Root
+          required
+          disabled={isPending}
+          invalid={Boolean(errorMessage)}
+          xstyle={styles.field}
         >
-          <Field.Root
-            required
-            disabled={isPending}
-            invalid={Boolean(errorMessage)}
-            xstyle={styles.field}
-          >
-            <Field.Label xstyle={styles.label}>{m.codeLabel}</Field.Label>
-            <Otp
-              ref={inputRef}
-              name='code'
-              value={code}
-              onValueChange={onCodeChange}
-              onComplete={submitCode}
-            />
-            <Field.Message>
-              <Field.Error>{errorMessage}</Field.Error>
-            </Field.Message>
-          </Field.Root>
-        </Card.Content>
-      ) : null}
+          <Field.Label xstyle={styles.label}>{m.codeLabel}</Field.Label>
+          <Otp
+            ref={inputRef}
+            name='code'
+            value={code}
+            onValueChange={onCodeChange}
+            onComplete={submitCode}
+          />
+          <Field.Message>
+            <Field.Error>{errorMessage}</Field.Error>
+          </Field.Message>
+        </Field.Root>
+      </Card.Content>
       <Card.Footer>
         <Button
           type='button'
@@ -118,16 +86,15 @@ export function UserProfileAddAuthenticatorView({
         </Button>
         <SubmitButton
           ref={actionRef}
-          type={setup ? 'submit' : 'button'}
-          form={setup ? formId : undefined}
+          type='submit'
+          form={formId}
           fullWidth
-          isPending={setup ? isPending : !setupErrorMessage}
-          disabled={Boolean(setup) && code.length !== 6}
+          isPending={isPending}
+          disabled={code.length !== 6}
           focusableWhenDisabled
-          pendingLabel={setup ? m.pending : m.preparing}
-          onClick={setup ? undefined : onRetry}
+          pendingLabel={m.pending}
         >
-          {setup ? m.verify : setupErrorMessage ? m.retry : m.preparing}
+          {m.verify}
         </SubmitButton>
       </Card.Footer>
     </>
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.dialog.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.dialog.tsx
index 64784d426db..d236e6fed57 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.dialog.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.dialog.tsx
@@ -3,13 +3,14 @@ import { type ReactNode, type Ref, useRef } from 'react';
 
 import { Button } from '../../../components/button';
 import { Card } from '../../../components/card';
-import { Dialog } from '../../../components/dialog';
+import { Dialog, type DialogFocusTarget } from '../../../components/dialog';
 import { Icon } from '../../../components/icon';
 import { Plus } from '../../../icons/glyphs/plus';
 import { useMessages } from '../../../localization';
 
 export interface UserProfileAddMfaDialogProps {
   open: boolean;
+  initialFocus?: DialogFocusTarget;
   onOpenChange: (open: boolean) => void;
   children: ReactNode;
   disabled?: boolean;
@@ -21,6 +22,7 @@ export interface UserProfileAddMfaDialogProps {
 
 export function UserProfileAddMfaDialog({
   open,
+  initialFocus,
   onOpenChange,
   children,
   disabled,
@@ -62,6 +64,7 @@ export function UserProfileAddMfaDialog({
       ) : null}
       <Dialog.Popup
         variant='card'
+        initialFocus={initialFocus}
         finalFocus={addButtonRef}
       >
         <Card.Root
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.view.tsx
index 51415a3af39..bcfae640950 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-add-mfa.view.tsx
@@ -2,6 +2,7 @@ import { Card } from '../../../components/card';
 import { useFlowAutoFocus } from '../../../components/flow';
 import { Icon, IconFrame } from '../../../components/icon';
 import { Item } from '../../../components/item';
+import { Spinner } from '../../../components/spinner';
 import { ChevronRight } from '../../../icons/glyphs/chevron-right';
 import { Numbers } from '../../../icons/glyphs/numbers';
 import { SecurityLockSquare } from '../../../icons/glyphs/security-lock-square';
@@ -10,6 +11,8 @@ import { useMessages } from '../../../localization';
 import type { UserProfileMfaAddableMethod } from './user-profile-mfa-section.view';
 
 export interface UserProfileAddMfaViewProps {
+  pendingMethod?: 'authenticator' | 'backup-codes';
+  errorMessage?: string;
   methods: readonly UserProfileMfaAddableMethod[];
   onSelect: (type: UserProfileMfaAddableMethod) => void;
 }
@@ -20,7 +23,7 @@ const icons = {
   'backup-codes': Numbers,
 } as const;
 
-export function UserProfileAddMfaView({ methods, onSelect }: UserProfileAddMfaViewProps) {
+export function UserProfileAddMfaView({ methods, onSelect, pendingMethod, errorMessage }: UserProfileAddMfaViewProps) {
   const m = useMessages('userProfileMfa');
   const firstMethodRef = useFlowAutoFocus<HTMLDivElement>();
   return (
@@ -30,6 +33,12 @@ export function UserProfileAddMfaView({ methods, onSelect }: UserProfileAddMfaVi
         <Card.Description>{m.addDialog.description}</Card.Description>
       </Card.Header>
       <Card.Content>
+        <Card.Banner
+          role='alert'
+          color='negative'
+        >
+          {errorMessage}
+        </Card.Banner>
         <Item.Group variant='outline'>
           {methods.map((type, index) => (
             <Item.Root
@@ -39,6 +48,8 @@ export function UserProfileAddMfaView({ methods, onSelect }: UserProfileAddMfaVi
               render={
                 <button
                   type='button'
+                  disabled={pendingMethod !== undefined}
+                  aria-busy={pendingMethod === type}
                   onClick={() => onSelect(type)}
                 />
               }
@@ -55,9 +66,7 @@ export function UserProfileAddMfaView({ methods, onSelect }: UserProfileAddMfaVi
                 <Item.Label>{m.methods[type]}</Item.Label>
                 <Item.Description>{m.addDialog.methods[type]}</Item.Description>
               </Item.Content>
-              <Item.Actions>
-                <Icon glyph={ChevronRight} />
-              </Item.Actions>
+              <Item.Actions>{pendingMethod === type ? <Spinner /> : <Icon glyph={ChevronRight} />}</Item.Actions>
             </Item.Root>
           ))}
         </Item.Group>
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.controller.ts b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.controller.ts
index cb49e5444e5..59b2ea9de24 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.controller.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.controller.ts
@@ -15,14 +15,13 @@ type ReadyModel = Extract<UserProfileMfaModel, { status: 'ready' }>;
 type AuthenticatorSetup = { secret: string; uri: string };
 type MfaAction = 'prepareAuthenticator' | 'verifyAuthenticator' | 'sms' | 'resend' | 'generate' | 'copy';
 type MfaFlow =
-  | { kind: 'closed' }
-  | { kind: 'select' }
+  | { kind: 'closed'; error?: ErrorDescription }
+  | { kind: 'select'; methods: readonly UserProfileMfaAddableMethod[]; error?: ErrorDescription }
   | {
       kind: 'authenticator';
-      setup?: AuthenticatorSetup;
+      setup: AuthenticatorSetup;
       code: string;
       error?: ErrorDescription;
-      setupError?: ErrorDescription;
     }
   | {
       kind: 'sms';
@@ -48,11 +47,16 @@ interface MfaContext {
 }
 
 type MfaEvent =
-  | { type: 'OPEN' }
+  | { type: 'OPEN'; methods: readonly UserProfileMfaAddableMethod[] }
   | { type: 'CLOSE' }
-  | { type: 'SELECT'; method: UserProfileMfaAddableMethod; phoneId: string; hasPhones: boolean }
+  | {
+      type: 'SELECT';
+      method: Exclude<UserProfileMfaAddableMethod, 'backup-codes'>;
+      phoneId: string;
+      hasPhones: boolean;
+    }
   | { type: 'ADD_PHONE' }
-  | { type: 'BACK'; hasPhones: boolean }
+  | { type: 'BACK'; hasPhones: boolean; methods: readonly UserProfileMfaAddableMethod[] }
   | { type: 'EDIT_PHONE_ID'; value: string }
   | { type: 'EDIT_PHONE_NUMBER'; value: string }
   | { type: 'EDIT_CODE'; value: string }
@@ -80,7 +84,7 @@ const mfaMachine = createMachine({
   states: {
     idle: {
       on: {
-        OPEN: { actions: assign(() => ({ flow: { kind: 'select' } })) },
+        OPEN: { actions: assign((_, event) => ({ flow: { kind: 'select', methods: event.methods } })) },
         CLOSE: {
           actions: assign(() => ({ flow: { kind: 'closed' }, savedSetup: undefined, resendSeconds: 0 })),
         },
@@ -97,9 +101,9 @@ const mfaMachine = createMachine({
                     phoneNumber: '',
                     code: '',
                   }
-                : event.method === 'backup-codes'
-                  ? { kind: 'backup', codes: [] }
-                  : { kind: 'authenticator', setup: context.savedSetup, code: '' },
+                : context.savedSetup
+                  ? { kind: 'authenticator', setup: context.savedSetup, code: '' }
+                  : context.flow,
           })),
         },
         ADD_PHONE: {
@@ -130,7 +134,7 @@ const mfaMachine = createMachine({
               return { flow: { ...flow, step: 'select', origin: 'existing', phoneId: undefined, error: undefined } };
             }
             return {
-              flow: { kind: 'select' },
+              flow: { kind: 'select', methods: event.methods },
               savedSetup: flow.kind === 'authenticator' ? flow.setup : context.savedSetup,
             };
           }),
@@ -173,7 +177,8 @@ const mfaMachine = createMachine({
         },
         RUN: {
           target: 'busy',
-          actions: assign((_, event) => ({
+          actions: assign((context, event) => ({
+            flow: { ...context.flow, error: undefined },
             pending: event.key,
             dismissed: false,
             run: event.run,
@@ -185,7 +190,9 @@ const mfaMachine = createMachine({
     },
     busy: {
       on: {
-        OPEN: { actions: assign(() => ({ flow: { kind: 'select' }, dismissed: true })) },
+        OPEN: {
+          actions: assign((_, event) => ({ flow: { kind: 'select', methods: event.methods }, dismissed: true })),
+        },
         CLOSE: {
           actions: assign(() => ({
             flow: { kind: 'closed' },
@@ -244,18 +251,9 @@ const mfaMachine = createMachine({
               if (isReverificationCancelledError(event.error)) {
                 return { flow: { kind: 'closed' }, pending: undefined };
               }
-              if (flow.kind !== 'authenticator' && flow.kind !== 'sms' && flow.kind !== 'backup') {
-                return { pending: undefined };
-              }
               const error = toLocalizableError(event.error);
               return {
-                flow:
-                  flow.kind === 'authenticator'
-                    ? {
-                        ...flow,
-                        ...(context.pending === 'prepareAuthenticator' ? { setupError: error } : { error }),
-                      }
-                    : { ...flow, error },
+                flow: { ...flow, error },
                 pending: undefined,
               };
             }),
@@ -283,7 +281,7 @@ function createAuthenticatorActions(model: ReadyModel, flow: MfaFlow, run: RunMf
 
   const verifyAuthenticator = (code: string) => {
     const verify = model.verifyAuthenticator;
-    if (!verify || flow.kind !== 'authenticator' || !flow.setup) {
+    if (!verify || flow.kind !== 'authenticator') {
       return;
     }
     void run('verifyAuthenticator', async () => {
@@ -351,7 +349,6 @@ function createBackupCodeActions(
     if (!generate) {
       return;
     }
-    send({ type: 'SELECT', method: 'backup-codes', phoneId: '', hasPhones: false });
     void run('generate', async () => {
       const codes = await generate();
       return { kind: 'backup', codes };
@@ -418,7 +415,6 @@ interface MfaSetupActions {
   close: () => void;
   submitSms: (code?: string) => void;
   resendSms: () => void;
-  prepareAuthenticator: () => void;
   verifyAuthenticator: (code: string) => void;
   generateBackupCodes: () => void;
   copy: () => void;
@@ -435,6 +431,7 @@ function createSetupProps(
   reverification: ReverificationController,
 ): UserProfileMfaSetupViewProps {
   const flow = context.flow;
+  const errorMessage = flow.error ? errorText(flow.error) : undefined;
   const sms = flow.kind === 'sms' ? flow : undefined;
   const authenticator = flow.kind === 'authenticator' ? flow : undefined;
   const backup = flow.kind === 'backup' ? flow : undefined;
@@ -452,8 +449,15 @@ function createSetupProps(
   }
   return {
     step,
+    pendingMethod:
+      context.pending === 'prepareAuthenticator'
+        ? 'authenticator'
+        : context.pending === 'generate'
+          ? 'backup-codes'
+          : undefined,
+    errorMessage,
     reverification,
-    methods: model.addableMethods,
+    methods: flow.kind === 'select' ? flow.methods : model.addableMethods,
     onSelect: actions.select,
     onBack: actions.back,
     onCancel: actions.close,
@@ -473,18 +477,18 @@ function createSetupProps(
       isPending: context.pending === 'sms',
       isResending: context.pending === 'resend',
       resendSeconds: context.resendSeconds,
-      errorMessage: sms?.error ? errorText(sms.error) : undefined,
-    },
-    authenticator: {
-      setup: authenticator?.setup,
-      setupErrorMessage: authenticator?.setupError ? errorText(authenticator.setupError) : undefined,
-      onRetry: actions.prepareAuthenticator,
-      code: authenticator?.code ?? '',
-      onCodeChange: value => send({ type: 'EDIT_CODE', value }),
-      onSubmit: actions.verifyAuthenticator,
-      isPending: context.pending === 'prepareAuthenticator' || context.pending === 'verifyAuthenticator',
-      errorMessage: authenticator?.error ? errorText(authenticator.error) : undefined,
+      errorMessage,
     },
+    authenticator: authenticator
+      ? {
+          setup: authenticator.setup,
+          code: authenticator.code,
+          onCodeChange: value => send({ type: 'EDIT_CODE', value }),
+          onSubmit: actions.verifyAuthenticator,
+          isPending: context.pending === 'verifyAuthenticator',
+          errorMessage,
+        }
+      : undefined,
     backupCodes: {
       codes: backup?.codes ?? [],
       onRetry: actions.generateBackupCodes,
@@ -492,7 +496,7 @@ function createSetupProps(
       onDownload: actions.download,
       onPrint: actions.print,
       pendingAction: context.pending === 'generate' || context.pending === 'copy' ? context.pending : undefined,
-      errorMessage: backup?.error ? errorText(backup.error) : undefined,
+      errorMessage,
     },
   };
 }
@@ -512,7 +516,8 @@ export function useUserProfileMfaController(model: ReadyModel) {
   };
   const { resendSeconds } = context;
   const flow = context.flow;
-  const dialogOpen = flow.kind !== 'closed';
+  const dialogOpen =
+    flow.kind !== 'closed' || (context.pending === 'generate' && model.backupCodesReverification.visible);
   useEffect(() => {
     if (!dialogOpen || resendSeconds === 0) {
       return;
@@ -531,18 +536,18 @@ export function useUserProfileMfaController(model: ReadyModel) {
   );
 
   const close = () => send({ type: 'CLOSE' });
-  const back = () => send({ type: 'BACK', hasPhones: model.phones.length > 0 });
+  const back = () => send({ type: 'BACK', hasPhones: model.phones.length > 0, methods: model.addableMethods });
 
   const select = (method: UserProfileMfaAddableMethod) => {
     if (isBusy) {
       return;
     }
-    send({ type: 'SELECT', method, phoneId: model.phones[0]?.id ?? '', hasPhones: model.phones.length > 0 });
     if (method === 'authenticator' && !context.savedSetup) {
       prepareAuthenticator();
-    }
-    if (method === 'backup-codes') {
+    } else if (method === 'backup-codes') {
       generateBackupCodes();
+    } else {
+      send({ type: 'SELECT', method, phoneId: model.phones[0]?.id ?? '', hasPhones: model.phones.length > 0 });
     }
   };
 
@@ -561,7 +566,6 @@ export function useUserProfileMfaController(model: ReadyModel) {
       close,
       submitSms,
       resendSms,
-      prepareAuthenticator,
       verifyAuthenticator,
       generateBackupCodes,
       copy,
@@ -576,6 +580,7 @@ export function useUserProfileMfaController(model: ReadyModel) {
     methods: [...model.methods],
     addableMethods: model.addableMethods,
     onRegenerateBackupCodes: model.generateBackupCodes ? generateBackupCodes : undefined,
+    regenerateError: flow.kind === 'closed' && flow.error ? errorText(flow.error) : undefined,
     onRemove: model.remove,
     onSetDefault: model.setDefault,
     removeReverification: model.removeReverification,
@@ -583,7 +588,6 @@ export function useUserProfileMfaController(model: ReadyModel) {
   };
 
   const showAddTrigger = model.addableMethods.length > 0;
-  const reverifying = setupProps.step === 'verify';
   const hasPendingReverification = context.pending !== undefined && REVERIFIABLE_ACTIONS.includes(context.pending);
   const canClose = !hasPendingReverification || Boolean(reverification.onCancel);
 
@@ -591,7 +595,7 @@ export function useUserProfileMfaController(model: ReadyModel) {
     dialogOpen,
     showAddTrigger,
     showAddControl: showAddTrigger || dialogOpen,
-    reverifying,
+    isPending: isBusy,
     onDialogOpenChange: (open: boolean) => {
       if (!open && !canClose) {
         return;
@@ -599,7 +603,7 @@ export function useUserProfileMfaController(model: ReadyModel) {
       if (!open && hasPendingReverification) {
         reverification.onCancel?.();
       }
-      send({ type: open ? 'OPEN' : 'CLOSE' });
+      send(open ? { type: 'OPEN', methods: model.addableMethods } : { type: 'CLOSE' });
     },
     showCloseButton: canClose,
     sectionProps,
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.tsx
index ac404b503a2..932f01e88f6 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.tsx
@@ -1,4 +1,4 @@
-import type { ReactNode } from 'react';
+import { type ReactNode, useRef, useState } from 'react';
 
 import { UserProfileAddMfaDialog } from './user-profile-add-mfa.dialog';
 import { useUserProfileMfaController } from './user-profile-mfa-section.controller';
@@ -33,20 +33,42 @@ export function mfaSectionNode(model: UserProfileMfaModel, fallback: ReactNode =
 
 function MfaEditor({ model }: { model: Extract<UserProfileMfaModel, { status: 'ready' }> }) {
   const controller = useUserProfileMfaController(model);
+  const initialFocusRef = useRef<HTMLElement>(null);
+  const [lastShownStep, setLastShownStep] = useState(controller.setupProps.step);
+  const step = controller.isPending && lastShownStep === 'verify' ? 'verify' : controller.setupProps.step;
+  if (step !== lastShownStep) {
+    setLastShownStep(step);
+  }
+  const reverifying = step === 'verify';
+  const onOpenChange = (open: boolean) => {
+    if (!open && controller.showCloseButton) {
+      setLastShownStep('select');
+    }
+    controller.onDialogOpenChange(open);
+  };
 
   return (
     <UserProfileMfaSectionView
       {...controller.sectionProps}
       addControl={
-        controller.showAddControl ? (
+        controller.showAddControl || reverifying ? (
           <UserProfileAddMfaDialog
-            open={controller.dialogOpen}
-            onOpenChange={controller.onDialogOpenChange}
+            open={controller.dialogOpen || reverifying}
+            disabled={controller.isPending}
+            onOpenChange={onOpenChange}
             hideTrigger={!controller.showAddTrigger}
-            reverifying={controller.reverifying}
+            reverifying={reverifying}
             showCloseButton={controller.showCloseButton}
+            initialFocus={
+              reverifying && controller.setupProps.reverification.status !== 'error' ? initialFocusRef : undefined
+            }
           >
-            <UserProfileMfaSetupView {...controller.setupProps} />
+            <UserProfileMfaSetupView
+              {...controller.setupProps}
+              step={step}
+              initialFocusRef={initialFocusRef}
+              onReverificationClose={() => onOpenChange(false)}
+            />
           </UserProfileAddMfaDialog>
         ) : undefined
       }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.view.tsx
index 4644ff977e2..bbd9969879d 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-section.view.tsx
@@ -22,6 +22,7 @@ export interface UserProfileMfaSectionViewProps {
   addControl?: ReactNode;
   onAdd?: (type: UserProfileMfaAddableMethod) => void;
   onRegenerateBackupCodes?: () => void;
+  regenerateError?: string;
   onRemove?: (id: string) => void | Promise<void>;
   onSetDefault?: (id: string) => void | Promise<void>;
   removeReverification?: ReverificationController;
@@ -35,6 +36,7 @@ export function UserProfileMfaSectionView({
   addControl,
   onAdd,
   onRegenerateBackupCodes,
+  regenerateError,
   onRemove,
   onSetDefault,
   removeReverification,
@@ -84,7 +86,7 @@ export function UserProfileMfaSectionView({
           />
         ))}
       </UserProfileSecurityList>
-      <Section.Error>{controller.defaultError}</Section.Error>
+      <Section.Error>{regenerateError ?? controller.defaultError}</Section.Error>
       {controller.remove ? (
         <Confirmation
           controller={controller.remove}
diff --git a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-setup.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-setup.view.tsx
index 12541dbb03b..7b4d41d4077 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-setup.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-mfa-section/user-profile-mfa-setup.view.tsx
@@ -1,3 +1,6 @@
+import { useMergeRefs } from '@floating-ui/react';
+import type { Ref } from 'react';
+
 import { Flow, useFlowAutoFocus } from '../../../components/flow';
 import type { ReverificationController } from '../../reverification';
 import { Reverification } from '../../reverification';
@@ -14,19 +17,19 @@ import type { UserProfileMfaAddableMethod } from './user-profile-mfa-section.typ
 export interface UserProfileMfaSetupViewProps extends UserProfileAddMfaViewProps {
   step: UserProfileMfaAddableMethod | 'select' | 'verify';
   reverification: ReverificationController;
+  initialFocusRef?: Ref<HTMLElement>;
+  onReverificationClose?: () => void;
   sms: UserProfileAddSmsViewProps;
-  authenticator: Omit<UserProfileAddAuthenticatorViewProps, 'onBack'>;
+  authenticator?: Omit<UserProfileAddAuthenticatorViewProps, 'onBack'>;
   backupCodes: Omit<UserProfileBackupCodesViewProps, 'onCancel'>;
   onBack: () => void;
   onCancel: () => void;
 }
 
 export function UserProfileMfaSetupView(props: UserProfileMfaSetupViewProps) {
-  const step = props.step === 'authenticator' && props.authenticator.setup ? 'authenticator-verify' : props.step;
-
   return (
     <Flow.Root
-      value={step}
+      value={props.step}
       direction={props.step === 'select' ? -1 : 1}
       state={props}
     >
@@ -35,6 +38,8 @@ export function UserProfileMfaSetupView(props: UserProfileMfaSetupViewProps) {
           <Flow.Step ids={['select']}>
             <UserProfileAddMfaView
               methods={current.methods}
+              pendingMethod={current.pendingMethod}
+              errorMessage={current.errorMessage}
               onSelect={current.onSelect}
             />
           </Flow.Step>
@@ -42,16 +47,12 @@ export function UserProfileMfaSetupView(props: UserProfileMfaSetupViewProps) {
             <UserProfileAddSmsView {...current.sms} />
           </Flow.Step>
           <Flow.Step ids={['authenticator']}>
-            <UserProfileAddAuthenticatorView
-              {...current.authenticator}
-              onBack={current.onBack}
-            />
-          </Flow.Step>
-          <Flow.Step ids={['authenticator-verify']}>
-            <UserProfileAddAuthenticatorView
-              {...current.authenticator}
-              onBack={current.onBack}
-            />
+            {current.authenticator ? (
+              <UserProfileAddAuthenticatorView
+                {...current.authenticator}
+                onBack={current.onBack}
+              />
+            ) : null}
           </Flow.Step>
           <Flow.Step ids={['backup-codes']}>
             <UserProfileBackupCodesView
@@ -60,7 +61,11 @@ export function UserProfileMfaSetupView(props: UserProfileMfaSetupViewProps) {
             />
           </Flow.Step>
           <Flow.Step ids={['verify']}>
-            <ReverifyStep controller={current.reverification} />
+            <ReverifyStep
+              controller={current.reverification}
+              initialFocusRef={current.initialFocusRef}
+              onClose={current.onReverificationClose}
+            />
           </Flow.Step>
         </>
       )}
@@ -68,8 +73,13 @@ export function UserProfileMfaSetupView(props: UserProfileMfaSetupViewProps) {
   );
 }
 
-function ReverifyStep(props: { controller: ReverificationController }) {
-  const initialFocusRef = useFlowAutoFocus<HTMLElement>();
+function ReverifyStep(props: {
+  controller: ReverificationController;
+  initialFocusRef?: Ref<HTMLElement>;
+  onClose?: () => void;
+}) {
+  const flowFocusRef = useFlowAutoFocus<HTMLElement>();
+  const initialFocusRef = useMergeRefs([flowFocusRef, props.initialFocusRef]);
 
   return (
     <Reverification
diff --git a/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/__tests__/user-profile-passkeys-section.feature.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/__tests__/user-profile-passkeys-section.feature.test.tsx
index 9fe0c4e0ad2..1e7ce77b38d 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/__tests__/user-profile-passkeys-section.feature.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/__tests__/user-profile-passkeys-section.feature.test.tsx
@@ -259,18 +259,24 @@ describe('Adding a passkey', () => {
     const creation = holdRequests('post', '/v1/me/passkeys');
     const user = userEvent.setup();
     const add = screen.getByRole('button', { name: 'Add passkey' });
-    await user.click(add);
-    await waitFor(() => expect(creation.requests).toHaveLength(1));
-    expect(add).toHaveTextContent(/^Add$/);
-    expect(add).toBeDisabled();
-    expect(add).toHaveAttribute('aria-busy', 'true');
-    await user.click(add);
-    expect(creation.requests).toHaveLength(1);
-    creation.release();
-    expect(await screen.findByText('Chrome on macOS')).toBeVisible();
-    expect(fapi.client.sessions[0]?.user.passkeys).toHaveLength(1);
-    expect(authenticator).toHaveBeenCalledOnce();
-    expect(add).toBeEnabled();
+    try {
+      await user.click(add);
+      await waitFor(() => expect(creation.requests).toHaveLength(1));
+      expect(add).toHaveTextContent(/^Add$/);
+      await waitFor(() => expect(within(add).getByRole('progressbar')).toBeVisible());
+      expect(add).toHaveAttribute('aria-disabled', 'true');
+      expect(add).toHaveAttribute('aria-busy', 'true');
+      expect(add).toHaveAccessibleName('Add passkey');
+      await user.keyboard('{Enter}');
+      expect(creation.requests).toHaveLength(1);
+      creation.release();
+      expect(await screen.findByText('Chrome on macOS')).toBeVisible();
+      expect(fapi.client.sessions[0]?.user.passkeys).toHaveLength(1);
+      expect(authenticator).toHaveBeenCalledOnce();
+      expect(add).toBeEnabled();
+    } finally {
+      creation.release();
+    }
   });
 
   it('shows a creation error and allows a manual retry', async () => {
diff --git a/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.messages.ts b/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.messages.ts
index 7502840cd63..27d46a8691b 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.messages.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.messages.ts
@@ -2,6 +2,7 @@ export const userProfilePasskeysMessages = {
   label: 'Passkeys',
   add: 'Add',
   addLabel: 'Add passkey',
+  addPending: 'Adding passkey…',
   empty: 'No passkeys added',
   details: '{createdAt} · {lastUsedAt}',
   createdAt: 'Created: {date}',
diff --git a/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.view.tsx
index d3425ae5af2..1da27e91b97 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-passkeys-section/user-profile-passkeys-section.view.tsx
@@ -3,7 +3,7 @@ import type { Ref } from 'react';
 import type { ConfirmController } from '../../../blocks/confirm';
 import { Confirmation } from '../../../blocks/confirmation';
 import { ReverificationDialog } from '../../../blocks/reverification';
-import { Button } from '../../../components/button';
+import { SubmitButton } from '../../../components/button';
 import type { DialogFocusTarget } from '../../../components/dialog';
 import { Field } from '../../../components/field';
 import { Icon } from '../../../components/icon';
@@ -69,14 +69,15 @@ export function UserProfilePasskeysSectionView({
             </Section.Content>
             {onAdd ? (
               <Section.Actions>
-                <Button
+                <SubmitButton
                   ref={addButtonRef}
                   aria-label={m.addLabel}
                   color='neutral'
                   size='sm'
                   variant='outline'
-                  disabled={isAdding}
-                  aria-busy={isAdding}
+                  type='button'
+                  isPending={isAdding}
+                  pendingLabel={m.addPending}
                   onClick={onAdd}
                 >
                   <Icon
@@ -85,7 +86,7 @@ export function UserProfilePasskeysSectionView({
                     size='sm'
                   />
                   {m.add}
-                </Button>
+                </SubmitButton>
               </Section.Actions>
             ) : null}
           </Section.Header>
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.controller.test.ts b/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.controller.test.ts
index 3340d462079..672e1ac134f 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.controller.test.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.controller.test.ts
@@ -43,12 +43,12 @@ describe('useUserProfileAddPhoneController', () => {
     const verifier = { sendCode, verifyCode: () => Promise.resolve() };
     expect(result.current.verifyingId).toBeUndefined();
 
-    act(() => result.current.onVerifyPhone({ id: 'phone_2', value: '+18015550101' }, verifier));
+    await act(() => result.current.onVerifyPhone({ id: 'phone_2', value: '+18015550101' }, verifier));
     expect(result.current.verifyingId).toBe('phone_2');
     await act(async () => vi.advanceTimersByTimeAsync(0));
     expect(result.current.step).toBe('verify');
 
-    act(() => result.current.onVerifyPhone({ id: 'phone_3', value: '+18015550102' }, verifier));
+    await act(() => result.current.onVerifyPhone({ id: 'phone_3', value: '+18015550102' }, verifier));
     expect(result.current.verifyingId).toBe('phone_2');
     expect(result.current.phoneNumber).toBe('+18015550101');
 
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.dialog.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.dialog.test.tsx
index 9cc88879a47..9a28ea458c6 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.dialog.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-add-phone.dialog.test.tsx
@@ -55,8 +55,7 @@ describe('UserProfileAddPhoneDialog', () => {
     const user = userEvent.setup();
     const onSubmit = vi.fn();
     render(<VerificationExample onSubmit={onSubmit} />);
-    await waitFor(() => expect(screen.getByRole('button', { name: 'Close', exact: true })).toHaveFocus());
-    await user.click(screen.getByRole('textbox', { name: 'Verification code' }));
+    await waitFor(() => expect(screen.getByRole('textbox', { name: 'Verification code' })).toHaveFocus());
 
     if (method === 'typing') {
       await user.keyboard('12345');
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-phone-section.feature.test.tsx b/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-phone-section.feature.test.tsx
index 1fd442dabb0..1d3189a20e2 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-phone-section.feature.test.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/__tests__/user-profile-phone-section.feature.test.tsx
@@ -262,6 +262,50 @@ describe('phone reverification', () => {
     });
   const savedPhones = (fapi: ReturnType<typeof serveFapi>) => fapi.client.sessions[0]?.user.phone_numbers;
 
+  it('holds password confirmation until phone code preparation finishes', async () => {
+    const { actor } = await renderSection(challenged());
+    demandReverificationOnce('/v1/me/phone_numbers');
+    const prepare = holdRequests('post', '/v1/me/phone_numbers/:id/prepare_verification');
+
+    try {
+      await addPhone(actor, '8015550100');
+      await actor.type(await screen.findByPlaceholderText('Enter your password'), 'hunter2{Enter}');
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+
+      expect(screen.getByLabelText('Password')).toBeVisible();
+      expect(screen.getByRole('button', { name: 'Continue' })).toHaveAttribute('aria-busy', 'true');
+      expect(screen.queryByRole('button', { name: 'Close' })).toBeNull();
+      await actor.keyboard('{Escape}{Enter}');
+      expect(prepare.requests).toHaveLength(1);
+
+      prepare.release();
+      const input = await screen.findByRole('textbox', { name: 'Verification code' });
+      await waitFor(() => expect(input).not.toHaveAttribute('aria-disabled'));
+    } finally {
+      prepare.release();
+    }
+  });
+
+  it('returns to the phone form after preparation fails', async () => {
+    const { actor } = await renderSection(challenged());
+    demandReverificationOnce('/v1/me/phone_numbers');
+    const prepare = holdRequests('post', '/v1/me/phone_numbers/:id/prepare_verification');
+
+    try {
+      await addPhone(actor, '8015550100');
+      await actor.type(await screen.findByPlaceholderText('Enter your password'), 'hunter2{Enter}');
+      await waitFor(() => expect(prepare.requests).toHaveLength(1));
+      expect(screen.getByLabelText('Password')).toBeVisible();
+      prepare.fail('form_param_invalid', 'Could not send code.', 'phone_number');
+
+      const input = await screen.findByRole('textbox', { name: 'Phone' });
+      await waitFor(() => expect(input).toHaveFocus());
+      await waitFor(() => expect(input).toHaveAccessibleDescription('Could not send code.'));
+    } finally {
+      prepare.release();
+    }
+  });
+
   it('confirms it is the user before a phone number is added, then verifies its code', async () => {
     const { actor, fapi } = await renderSection(challenged());
     demandReverificationOnce('/v1/me/phone_numbers');
@@ -498,6 +542,8 @@ describe('phone reverification', () => {
 
     await manage(actor, WORK_LABEL, 'Set as primary');
     await waitFor(() => expect(start.requests).toHaveLength(1));
+    expect(screen.queryByRole('menu')).toBeNull();
+    expect(within(row()).getByText(WORK_LABEL)).toBeVisible();
     expect(screen.queryByRole('dialog')).toBeNull();
 
     start.release();
@@ -523,3 +569,67 @@ describe('Removing a number', () => {
     expect(screen.queryByRole('alertdialog')).toBeNull();
   });
 });
+
+it('keeps Send code pending until phone verification is ready', async () => {
+  const { actor } = await renderSection();
+  const prepare = holdRequests('post', '/v1/me/phone_numbers/:id/prepare_verification');
+  try {
+    await addPhone(actor, '8015550100');
+    await waitFor(() => expect(prepare.requests).toHaveLength(1));
+    expect(screen.getByRole('button', { name: 'Send code' })).toHaveAttribute('aria-busy', 'true');
+    expect(screen.getByRole('textbox', { name: 'Phone' })).toBeVisible();
+    expect(screen.queryByRole('textbox', { name: 'Verification code' })).not.toBeInTheDocument();
+    prepare.release();
+    await enterCode(actor, VERIFICATION_CODE);
+    await waitFor(() => expect(screen.queryByRole('dialog')).not.toBeInTheDocument());
+  } finally {
+    prepare.release();
+  }
+});
+
+it('keeps the profile visible until phone verification is ready and focuses the code field', async () => {
+  const pending = fapiPhoneNumber({
+    id: 'idn_pending',
+    phone_number: '+18015550199',
+    verification: fapiVerification('phone_code', { status: 'unverified' }),
+  });
+  const { actor } = await renderSection(signedIn([HOME, pending]));
+  const prepare = holdRequests('post', '/v1/me/phone_numbers/:id/prepare_verification');
+  try {
+    await manage(actor, WORK_LABEL, 'Verify phone number');
+    await waitFor(() => expect(prepare.requests).toHaveLength(1));
+    await waitFor(() => expect(screen.queryByRole('menu')).toBeNull());
+    expect(within(row()).getByText(WORK_LABEL)).toBeVisible();
+    expect(screen.getByRole('button', { name: 'Add phone number' })).toBeDisabled();
+    expect(screen.queryByRole('dialog')).toBeNull();
+    prepare.release();
+    await waitFor(() => expect(screen.getByRole('textbox', { name: 'Verification code' })).toHaveFocus());
+  } finally {
+    prepare.release();
+  }
+});
+
+it('retries phone preparation from the entry form without creating another number', async () => {
+  const { actor, fapi } = await renderSection();
+  const prepare = holdRequests('post', '/v1/me/phone_numbers/:id/prepare_verification');
+  try {
+    await addPhone(actor, '8015550100');
+    await waitFor(() => expect(prepare.requests).toHaveLength(1));
+    prepare.fail('action_blocked');
+    await waitFor(() =>
+      expect(screen.getByRole('button', { name: 'Send code' })).not.toHaveAttribute('aria-busy', 'true'),
+    );
+    const retry = holdRequests('post', '/v1/me/phone_numbers/:id/prepare_verification');
+    try {
+      await actor.click(screen.getByRole('button', { name: 'Send code' }));
+      await waitFor(() => expect(retry.requests).toHaveLength(1));
+      expect(fapi.client.sessions[0]?.user.phone_numbers).toHaveLength(1);
+      retry.release();
+      expect(await screen.findByRole('textbox', { name: 'Verification code' })).toBeVisible();
+    } finally {
+      retry.release();
+    }
+  } finally {
+    prepare.release();
+  }
+});
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.controller.ts b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.controller.ts
index 7e6bf1d0a0b..ce5001d642d 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.controller.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.controller.ts
@@ -1,4 +1,4 @@
-import { useEffect, useMemo } from 'react';
+import { useEffect, useMemo, useRef } from 'react';
 
 import type { DialogHandle } from '../../../components/dialog';
 import { Dialog } from '../../../components/dialog';
@@ -23,7 +23,7 @@ export interface UserProfileAddPhoneControllerOptions {
 export interface UserProfileAddPhoneController extends UserProfileAddPhoneDialogProps {
   handle: DialogHandle<unknown>;
   verifyingId: string | undefined;
-  onVerifyPhone: (phone: Pick<UserProfilePhone, 'id' | 'value'>, verifier: UserProfilePhoneVerifier) => void;
+  onVerifyPhone: (phone: Pick<UserProfilePhone, 'id' | 'value'>, verifier: UserProfilePhoneVerifier) => Promise<void>;
 }
 
 interface Context {
@@ -36,7 +36,7 @@ interface Context {
 
 type Event =
   | { type: 'ADD' }
-  | { type: 'START'; id?: string; phoneNumber: string; verifier: UserProfilePhoneVerifier }
+  | { type: 'READY'; id?: string; phoneNumber: string; verifier: UserProfilePhoneVerifier }
   | { type: 'VERIFIED' }
   | { type: 'CANCEL' }
   | { type: 'RESEND' }
@@ -52,14 +52,14 @@ const CODE_RESEND_SECONDS = 30;
 
 const tick = { actions: assign(context => ({ resendSeconds: Math.max(0, context.resendSeconds - 1) })) };
 const fail = assign<ErrorInvokeEvent>((_, event) => ({ error: toFormError(event.error) }));
-const start = {
-  target: 'sending',
-  actions: assign<Extract<Event, { type: 'START' }>>((_, event) => ({
+const ready = {
+  target: 'verify',
+  actions: assign<Extract<Event, { type: 'READY' }>>((_, event) => ({
     verifyingId: event.id,
     phoneNumber: event.phoneNumber,
     verifier: event.verifier,
     error: undefined,
-    resendSeconds: 0,
+    resendSeconds: CODE_RESEND_SECONDS,
   })),
 };
 
@@ -80,11 +80,11 @@ const machine = createMachine({
           target: 'phone',
           actions: assign(() => ({ verifyingId: undefined, verifier: undefined, error: undefined, resendSeconds: 0 })),
         },
-        START: start,
+        READY: ready,
       },
     },
     phone: {
-      on: { CANCEL: 'idle', START: start },
+      on: { CANCEL: 'idle', READY: ready },
     },
     sending: {
       invoke: fromPromise(context => (context.verifier ? context.verifier.sendCode() : missingDependency()), {
@@ -114,12 +114,25 @@ export function useUserProfileAddPhoneController({
   const errorText = useErrorText();
   const handle = useMemo(() => Dialog.createHandle(), []);
   const [snapshot, send, actor] = useMachine(machine);
+  const created = useRef<{ value: string; verifier: UserProfilePhoneVerifier }>(undefined);
+  const generation = useRef(0);
   const { resendSeconds, error } = snapshot.context;
   const phoneForm = useForm({
     initialValues: { phoneNumber: '' },
     onSubmit: async ({ phoneNumber }) => {
       if (onCreate) {
-        send({ type: 'START', phoneNumber, verifier: await onCreate(phoneNumber) });
+        if (created.current?.value !== phoneNumber) {
+          const verifier = await onCreate(phoneNumber);
+          if (actor.getSnapshot().status !== 'active') {
+            return;
+          }
+          created.current = { value: phoneNumber, verifier };
+        }
+        const { verifier } = created.current;
+        await verifier.sendCode();
+        if (actor.getSnapshot().status === 'active') {
+          send({ type: 'READY', phoneNumber, verifier });
+        }
       }
     },
   });
@@ -167,7 +180,9 @@ export function useUserProfileAddPhoneController({
         }
         reverification.onCancel();
       }
+      generation.current++;
       if (open) {
+        created.current = undefined;
         phoneForm.reset();
         codeForm.reset();
         send({ type: 'ADD' });
@@ -195,9 +210,20 @@ export function useUserProfileAddPhoneController({
       }
     },
     verifyingId: snapshot.context.verifyingId,
-    onVerifyPhone: (phone, verifier) => {
-      codeForm.reset();
-      send({ type: 'START', id: phone.id, phoneNumber: phone.value, verifier });
+    onVerifyPhone: async (phone, verifier) => {
+      if (actor.getSnapshot().value !== 'idle') {
+        return;
+      }
+      const started = generation.current;
+      await verifier.sendCode();
+      if (
+        actor.getSnapshot().status === 'active' &&
+        generation.current === started &&
+        actor.getSnapshot().value === 'idle'
+      ) {
+        codeForm.reset();
+        send({ type: 'READY', id: phone.id, phoneNumber: phone.value, verifier });
+      }
     },
   };
 }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.dialog.tsx b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.dialog.tsx
index dac98862d02..80d338be7f7 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.dialog.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-add-phone.dialog.tsx
@@ -1,4 +1,4 @@
-import { useRef } from 'react';
+import { useRef, useState } from 'react';
 
 import { Card } from '../../../components/card';
 import type { DialogFocusTarget, DialogHandle } from '../../../components/dialog';
@@ -31,18 +31,25 @@ export interface UserProfileAddPhoneDialogProps {
 
 export function UserProfileAddPhoneDialog(props: UserProfileAddPhoneDialogProps) {
   const phoneRef = useRef<HTMLInputElement>(null);
+  const codeRef = useRef<HTMLInputElement>(null);
+  const [lastShownStep, setLastShownStep] = useState(props.step);
+  const step =
+    props.open && props.isPending && props.step === 'phone' && lastShownStep === 'reverify' ? 'reverify' : props.step;
+  if (step !== lastShownStep) {
+    setLastShownStep(step);
+  }
 
   return (
     <Dialog.Root
       handle={props.handle}
       open={props.open}
       onOpenChange={props.onOpenChange}
-      shouldCloseOnInteractOutside={props.step !== 'reverify'}
-      showCloseButton={props.step !== 'reverify' || Boolean(props.reverification?.onCancel)}
+      shouldCloseOnInteractOutside={step !== 'reverify'}
+      showCloseButton={step !== 'reverify' || Boolean(props.reverification?.onCancel)}
     >
       <Dialog.Popup
         variant='card'
-        initialFocus={props.step === 'phone' ? phoneRef : undefined}
+        initialFocus={step === 'phone' ? phoneRef : codeRef}
         finalFocus={props.finalFocus}
       >
         <Card.Root
@@ -50,7 +57,7 @@ export function UserProfileAddPhoneDialog(props: UserProfileAddPhoneDialogProps)
           renderBranding={false}
         >
           <Flow.Root
-            value={props.step}
+            value={step}
             state={props}
           >
             {current => (
@@ -76,6 +83,7 @@ export function UserProfileAddPhoneDialog(props: UserProfileAddPhoneDialogProps)
                 </Flow.Step>
                 <Flow.Step ids={['verify']}>
                   <VerifyPhoneStep
+                    inputRef={codeRef}
                     phoneNumber={current.phoneNumber}
                     code={current.code}
                     onCodeChange={current.onCodeChange}
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.controller.ts b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.controller.ts
index 9419a425010..a3780313aef 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.controller.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.controller.ts
@@ -24,6 +24,7 @@ export function useUserProfilePhoneSectionController({
     reverification: createReverification,
   });
   const setPrimary = usePendingAction();
+  const verify = usePendingAction();
   const rowRef = useRef<HTMLDivElement>(null);
   const removalFocus = useListRemovalFocus({
     ids: phones.map(phone => phone.id),
@@ -40,7 +41,8 @@ export function useUserProfilePhoneSectionController({
     defaultPhoneCountry,
     canAdd: Boolean(onCreatePhone),
     verification,
-    error: setPrimary.error,
+    error: verify.error ?? setPrimary.error,
+    pendingVerifyId: verify.pendingKey,
     rowRef,
     registerTrigger: removalFocus.registerTrigger,
     remove: onRemovePhone ? remove : undefined,
@@ -51,9 +53,13 @@ export function useUserProfilePhoneSectionController({
     onVerify: id => {
       const phone = phones.find(phone => phone.id === id);
       if (phone) {
-        verification.onVerifyPhone(phone, getPhoneVerifier(id));
+        setPrimary.reset();
+        void verify.run(id, () => verification.onVerifyPhone(phone, getPhoneVerifier(id)));
       }
     },
-    onSetPrimary: id => void setPrimary.run(id, () => onSetPrimaryPhone(id)),
+    onSetPrimary: id => {
+      verify.reset();
+      void setPrimary.run(id, () => onSetPrimaryPhone(id));
+    },
   };
 }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.model.ts b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.model.ts
index aec4af43bfb..98f39011b09 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.model.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.model.ts
@@ -12,10 +12,14 @@ import type { UserProfilePhoneSectionModel } from './user-profile-phone-section.
 
 const ADD_PHONE_FIELDS: readonly UserProfileAddPhoneField[] = ['phoneNumber', 'code'];
 
-function toPhoneVerifier(phone: PhoneNumberResource): UserProfilePhoneVerifier {
+function toPhoneVerifier(currentPhone: () => PhoneNumberResource): UserProfilePhoneVerifier {
   return {
-    sendCode: () => save(() => phone.prepareVerification()),
-    verifyCode: code => save(() => phone.attemptVerification({ code }), ADD_PHONE_FIELDS),
+    sendCode: () =>
+      save(async () => {
+        await currentPhone().prepareVerification();
+        currentPhone();
+      }),
+    verifyCode: code => save(() => currentPhone().attemptVerification({ code }), ADD_PHONE_FIELDS),
   };
 }
 
@@ -56,10 +60,12 @@ export function useUserProfilePhoneSectionModel(): UserProfilePhoneSectionModel
       ? async phoneNumber => {
           const request = createPhone(currentUser, phoneNumber);
           await save(() => request, ADD_PHONE_FIELDS);
-          return toPhoneVerifier(await request);
+          currentUser();
+          const phone = await request;
+          return toPhoneVerifier(() => byId(currentUser().phoneNumbers, phone.id, 'phone number'));
         }
       : undefined,
-    getPhoneVerifier: id => toPhoneVerifier(byId(user.phoneNumbers, id, 'phone number')),
+    getPhoneVerifier: id => toPhoneVerifier(() => byId(currentUser().phoneNumbers, id, 'phone number')),
     onSetPrimaryPhone: id => saveAsUser(current => setPrimaryPhone(current, id)),
     onRemovePhone: access.canRemove ? id => saveAsUser(current => removePhone(current, id)) : undefined,
     removeReverification,
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.types.ts b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.types.ts
index b9a659e3f4c..e769ed57c8f 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.types.ts
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.types.ts
@@ -20,6 +20,7 @@ export interface UserProfilePhoneSectionViewProps {
   verificationFinalFocus: DialogFocusTarget;
   setPrimaryReverification: ReverificationController;
   setPrimaryFinalFocus: DialogFocusTarget;
+  pendingVerifyId?: string;
   onVerify: (id: string) => void;
   onSetPrimary: (id: string) => void;
 }
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.view.tsx b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.view.tsx
index cd13d1f4408..26d6269e575 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.view.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone-section/user-profile-phone-section.view.tsx
@@ -23,6 +23,7 @@ export function UserProfilePhoneSectionView({
   verificationFinalFocus,
   setPrimaryReverification,
   setPrimaryFinalFocus,
+  pendingVerifyId,
   onVerify,
   onSetPrimary,
 }: UserProfilePhoneSectionViewProps) {
@@ -33,6 +34,7 @@ export function UserProfilePhoneSectionView({
       render={
         <Button
           aria-label={m.phone.add}
+          disabled={pendingVerifyId !== undefined}
           color='neutral'
           size='sm'
           variant='outline'
diff --git a/packages/mosaic/src/features/user-profile/user-profile-phone.steps.tsx b/packages/mosaic/src/features/user-profile/user-profile-phone.steps.tsx
index ab058ded2b1..0d90369eb98 100644
--- a/packages/mosaic/src/features/user-profile/user-profile-phone.steps.tsx
+++ b/packages/mosaic/src/features/user-profile/user-profile-phone.steps.tsx
@@ -92,6 +92,7 @@ export function EnterPhoneStep(props: EnterPhoneStepProps) {
 }
 
 interface VerifyPhoneStepProps {
+  inputRef?: Ref<HTMLInputElement>;
   secondaryAction?: ReactNode;
   phoneNumber: string;
   code: string;
@@ -108,6 +109,7 @@ export function VerifyPhoneStep(props: VerifyPhoneStepProps) {
   const m = useMessages('userProfileAddPhone');
   const verifyFormId = useId();
   const canSubmit = props.code.length === CODE_LENGTH;
+  const inputRef = useMergeRefs([props.inputRef, useFlowAutoFocus<HTMLInputElement>()]);
 
   const submitCode = (code?: string) => {
     if (!props.isPending && !props.isResending) {
@@ -146,7 +148,7 @@ export function VerifyPhoneStep(props: VerifyPhoneStepProps) {
         >
           <Field.Label visuallyHidden>{m.verify.label}</Field.Label>
           <Otp
-            ref={useFlowAutoFocus<HTMLInputElement>()}
+            ref={inputRef}
             name='code'
             value={props.code}
             onValueChange={props.onCodeChange}
diff --git a/packages/swingset/src/stories/fixtures/user-profile-add-email.ts b/packages/swingset/src/stories/fixtures/user-profile-add-email.ts
index 55846e757b7..623d62a206a 100644
--- a/packages/swingset/src/stories/fixtures/user-profile-add-email.ts
+++ b/packages/swingset/src/stories/fixtures/user-profile-add-email.ts
@@ -19,7 +19,7 @@ export function createUserProfileAddEmailFixture({
   onCreated,
   onVerified,
 }: FixtureOptions = {}): Pick<ReadyEmailSectionModel, 'onCreateEmail' | 'getEmailVerifier'> {
-  const startLink = (id: string): UserProfileEmailVerification => {
+  const startLink = (id: string): Extract<UserProfileEmailVerification, { method: 'link' }> => {
     let cancelled = false;
     const verified = delay(fail === 'verify' ? 2000 : 4000).then(() => {
       if (fail === 'verify') {
@@ -43,24 +43,32 @@ export function createUserProfileAddEmailFixture({
     },
   });
 
-  const verifier = (id: string): UserProfileEmailVerifier => ({
-    start: () => {
-      if (method === 'link') {
-        return startLink(id);
-      }
-      if (method === 'sso') {
-        return startSso(id);
-      }
-      return { method: 'code', sent: delay(700).then(() => undefined) };
-    },
-    verifyCode: async code => {
-      await delay(700);
-      if (fail === 'verify' || code === '000000') {
-        throw new Error('That code is incorrect. Try again.');
-      }
-      onVerified?.(id);
-    },
-  });
+  const verifier = (id: string): UserProfileEmailVerifier => {
+    let cancelLink: (() => void) | undefined;
+    return {
+      prepare: async () => {
+        cancelLink?.();
+        if (method === 'link') {
+          const verification = startLink(id);
+          cancelLink = verification.cancel;
+          return verification;
+        }
+        if (method === 'sso') {
+          return startSso(id);
+        }
+        await delay(700);
+        return { method: 'code' };
+      },
+      cancel: () => cancelLink?.(),
+      verifyCode: async code => {
+        await delay(700);
+        if (fail === 'verify' || code === '000000') {
+          throw new Error('That code is incorrect. Try again.');
+        }
+        onVerified?.(id);
+      },
+    };
+  };
 
   return {
     onCreateEmail: async emailAddress => {
diff --git a/packages/swingset/src/stories/fixtures/user-profile-mfa.ts b/packages/swingset/src/stories/fixtures/user-profile-mfa.ts
index d51fc6d64b8..38a3ff41d70 100644
--- a/packages/swingset/src/stories/fixtures/user-profile-mfa.ts
+++ b/packages/swingset/src/stories/fixtures/user-profile-mfa.ts
@@ -81,7 +81,7 @@ export function useUserProfileMfaFixture({
     onBack: () => void;
   };
   section: UserProfileMfaSectionViewProps;
-  authenticator: UserProfileMfaSetupViewProps['authenticator'];
+  authenticator: NonNullable<UserProfileMfaSetupViewProps['authenticator']>;
   sms: UserProfileMfaSetupViewProps['sms'];
   backupCodes: UserProfileMfaSetupViewProps['backupCodes'];
 } {
@@ -358,7 +358,6 @@ export function useUserProfileMfaFixture({
     },
     authenticator: {
       setup: authenticatorSetup,
-      onRetry: () => undefined,
       code,
       onCodeChange,
       onSubmit: value => void verifyAuthenticator(value),