diff --git a/welcome.html b/welcome.html
index 8bac03a..3410465 100644
--- a/welcome.html
+++ b/welcome.html
@@ -58,7 +58,16 @@ input:focus { border-color: #FF6B8A; }
     <div id="create-msg" class="msg"></div>
   </div>
 
-  <!-- Step 3: Dashboard -->
+  <!-- Step 3: 登录 -->
+  <div id="step-login" class="step">
+    <p style="text-align:center;color:#666;font-size:14px;margin-bottom:16px;">管理员账户已存在，请登录</p>
+    <label>密码</label>
+    <input type="password" id="login-password" placeholder="输入管理员密码">
+    <button class="btn" onclick="loginUser()">登录</button>
+    <div id="login-msg" class="msg"></div>
+  </div>
+
+  <!-- Step 4: Dashboard -->
   <div id="step-dashboard" class="step">
     <div class="stat">
       <span class="stat-label">系统状态</span>
@@ -109,12 +118,13 @@ async function init() {
     if (!r.ok) { show('step-loading'); document.querySelector('#step-loading .msg').textContent = '系统未就绪，请稍后刷新'; return; }
     var steps = await r.json();
     var allDone = steps.every(function(s) { return s.done; });
-    if (allDone) {
-      // 已有用户，需要登录 — 但 trusted_networks 不可用
-      // 暂时降级：引导重新创建
+  var userDone = steps.some(function(s) { return s.step === 'user' && s.done; });
+    if (!userDone) {
       show('step-create');
+    } else if (!allDone) {
+      show('step-login');
     } else {
-      show('step-create');
+      show('step-login');
     }
   } catch(e) {
     show('step-loading');
@@ -122,6 +132,57 @@ async function init() {
   }
 }
 
+async function loginUser() {
+  var p = document.getElementById('login-password').value;
+  var msg = document.getElementById('login-msg');
+  if (!p) { msg.className = 'msg error'; msg.textContent = '请输入密码'; return; }
+
+  msg.className = 'msg'; msg.textContent = '正在登录...';
+  var btn = document.querySelector('#step-login .btn');
+  btn.disabled = true;
+
+  try {
+    // 通过 login_flow 认证
+    var flow = await fetch(API + '/auth/login_flow', {
+      method: 'POST',
+      headers: {'Content-Type': 'application/json'},
+      body: JSON.stringify({client_id: window.location.origin + '/', redirect_uri: window.location.origin + '/', handler: ['homeassistant', null]})
+    });
+    var fid = (await flow.json()).flow_id;
+
+    var step = await fetch(API + '/auth/login_flow/' + fid, {
+      method: 'POST',
+      headers: {'Content-Type': 'application/json'},
+      body: JSON.stringify({client_id: window.location.origin + '/', username: 'admin', password: p})
+    });
+    var code = (await step.json()).result;
+
+    var tokenResp = await fetch(API + '/auth/token', {
+      method: 'POST',
+      headers: {'Content-Type': 'application/x-www-form-urlencoded'},
+      body: 'grant_type=authorization_code&code=' + code + '&client_id=' + window.location.origin + '/'
+    });
+    token = (await tokenResp.json()).access_token;
+    localStorage.setItem('pxh_token', token);
+
+    // 完成剩余 onboarding steps
+    var ond = await fetch(API + '/api/onboarding');
+    var steps = await ond.json();
+    for (var s of steps) {
+      if (!s.done && s.step !== 'user') {
+        await api('POST', '/api/onboarding/' + s.step, {});
+      }
+    }
+
+    show('step-dashboard');
+    loadDevices();
+  } catch(e) {
+    msg.className = 'msg error';
+    msg.textContent = '登录失败: ' + e.message;
+    btn.disabled = false;
+  }
+}
+
 async function createUser() {
   var u = document.getElementById('username').value.trim();
   var p = document.getElementById('password').value;